ci: run zig build headless, then smoke-test what it installed

[Parth]

The workflows named packages and asserted on paths, so every new package needed a matrix row and every moved file needed a workflow edit. They now do what a person does on a new machine — bootstrap, zig build headless, check the result — and the checking lives in zig/smoke.zig, which imports the package lists instead of repeating them.

67 + 27 jobs → 5 + 6, and every remaining square has to be green.

The bug that was hiding everything else

login_shell.zig called std.c.getpwuid from build.zig. The build runner is not linked against libc on Linux, so this was a compile error for the entire build graph:

std/c.zig:10326:12: error: dependency on libc must be explicitly specified in the build command
pub extern "c" fn getpwuid(uid: uid_t) ?*passwd;
referenced by: currentShell: zig/packages/login_shell.zig:41:21

Every zig build <anything> on every Linux runner and all 27 containers died there before doing any work — zig build ripgrep included, since build.zig imports every package at comptime. macOS links libc unconditionally, which is why it was the only platform where anything passed, and why the matrix read as "macOS green, Linux red" rather than "one function is wrong". $SHELL answers the same question without libc.

login-shell stayed in headless, and now runs unattended

chsh asks PAM for a password only when run as an ordinary user. It reaches chsh as root either way now — via sudo, which was already required to append to /etc/shells, or directly in containers where there is nothing to elevate and often no sudo binary. That choice is made at run time by id -u. The /etc/shells check moved to run time too and then disappeared: duplicates are harmless, and the append is not a precondition for anything, since root chsh ignores the file entirely.

zig/smoke.zig

zig build smoke runs eight tests against $DOTFILES_PREFIX, importing config.links, nvim_plugins.plugins and treesitter.grammars from the packages, so adding a grammar or plugin extends the tests for free:

• every installed binary runs — nvim, rg, zls, fish, cargo, lua-language-server — and rust-analyzer is in the toolchain
• every config link is a symlink and resolves — a dangling link is what a test -d misses
• every plugin is unpacked, including libfzf.so (telescope silently degrades without it)
• every grammar is compiled and has queries installed
• neovim starts on the real config with nothing matching E\d+: in :messages
• neovim can actually vim.treesitter.language.add each grammar — compiled and loadable differ
• fish sources the shipped conf.d

Each command has a 60s timeout, since a language server given arguments it dislikes waits on stdin forever.

It is deliberately not a dependency of headless, so it can re-check an existing install without rebuilding.

Platforms dropped

Both were red for upstream reasons, and both are gone rather than carried as permanently-failing squares:

• ubuntu-24.04-arm — neovim's nlua0 build helper dies on aarch64 because lua_newstate() returns null for the LuaJIT it is built against. Filed upstream as neovim/neovim#40149, open since June with no maintainer response. Worth knowing: the same build succeeds when cross-compiled, because build.zig:97 (host_use_luajit = if (cross_compiling) false else use_luajit) then backs nlua0 with PUC Lua instead. So -Dhost=native is a plausible untested workaround if this ever matters.
• alpine:3.22 headless — everything builds and 7 of 8 smoke tests pass; lua-language-server is the only dynamically linked binary we install and upstream ships no musl build, so it cannot spawn. alpine still appears under no-system-compiler, which passes.

Smaller findings

• Every commit built the matrix twice — on: push and on: pull_request were both unfiltered. push is now limited to master.
• Failures were unreadable. --summary all prints a 90-line green tree while the failing step's output streams inline thousands of lines earlier; zig keeps building independent steps after a failure, so the end-of-run summary is the only unambiguous place. Switched to --summary failures, which is how both platform bugs above were finally identified. smoke keeps --summary all because it is four lines and turns a silent pass into a test tally.
• Four bare squares were red by design — debian/ubuntu ship no curl and no xz, rocky no xz. One green job now runs all seven images in ~47s and writes the answer to the run summary. Its old error-extraction had a latent bug: under bash -e -o pipefail an unrecognised failure killed the step instead of reaching the see logs fallback.
• libuv needs linux/errqueue.h, which alpine does not ship — that was the alpine build failure, not musl incompatibility, and linux-headers fixed it.
• timeout-minutes: 60, so a hung step fails instead of running to GitHub's six-hour default.

Not done, on purpose

• Windows is dropped. bootstrap.sh builds a .tar.xz URL unconditionally and zig ships .zip for Windows; the old workflow carried two permanently-failing rows for it.
• no-system-compiler still names a package (zig build treesitter). The one deliberate exception to "don't reach in": it asserts no cc/gcc/clang/make/pkg-config exists and compiles C anyway, which is the load-bearing claim of the repo.
• neovim and fish are non-lazy dependencies, so zig build ripgrep still clones all of neovim first. Making them lazy would fix it, but it interacts with the memoisation in fish.zig and is not a CI problem.