ci: install cargo-insta and cargo-nextest into the tend sandbox

.config/tend.yaml

@@ -10,6 +10,31 @@ secrets:
     - DOCKERHUB_USERNAME
 setup:
   - uses: ./.github/actions/tend-setup
+# cargo-insta and cargo-nextest are used only by the agent, never by a
+# runner-side step. `tend-setup` used to install them with `cargo-install`,
+# under the *runner* user's home — which tend deliberately keeps off the sandbox
+# PATH, since that home can hold credentials — so the agent got a stub that
+# exits 127. Install them under the sandbox user's home instead, which is what
+# that stub asks for. Both ship prebuilt binaries, so this downloads rather than
+# builds (~1s for the pair).
+#
+# `~/.local/bin` rather than the cargo default: it is first on the sandbox PATH,
+# ahead of both `~/.tend-blocked/bin` (where the 127 stubs live) and
+# `~/.cargo/bin`. Hence `CARGO_HOME` on the cargo-dist installer, which places
+# the binary at `$CARGO_HOME/bin`.
+#
+# Without this, `task prqlc:test` — the inner loop `CLAUDE.md` documents —
+# aborts in every tend session. `task prqlc:pull-request` needs more: it also
+# reaches `cargo llvm-cov` and `pre-commit`, neither of which is on the sandbox
+# PATH at all.
+sandbox_setup:
+  - mkdir -p ~/.local/bin
+  - curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+  - cargo-nextest --version
+  - curl -LsSf
+    https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh
+    | CARGO_HOME=~/.local sh
+  - cargo-insta --version
 workflows:
   ci-fix:
     watched_workflows:

.github/actions/tend-setup/action.yaml

@@ -17,14 +17,6 @@ runs:
         repo-token: ${{ inputs.github-token }}
         version: 3.53.1
 
-    - uses: baptiste0928/cargo-install@v3
-      with:
-        crate: cargo-insta
-
-    - uses: baptiste0928/cargo-install@v3
-      with:
-        crate: cargo-nextest
-
     - run: ./.github/workflows/scripts/set_version.sh
       shell: bash
 

.github/workflows/tend-ci-fix.yaml

@@ -41,6 +41,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:ci-fix ${{ github.event.workflow_run.id }}
             - Run URL: ${{ github.event.workflow_run.html_url }}

.github/workflows/tend-mention.yaml

@@ -427,6 +427,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: >-
             ${{ steps.delay.outputs.seconds
             && format('This job started {0}s after the triggering event (over ~40s means it was queued). ',

.github/workflows/tend-nightly.yaml

@@ -41,5 +41,11 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:nightly

.github/workflows/tend-notifications.yaml

@@ -131,6 +131,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:notifications
 

.github/workflows/tend-review-runs.yaml

@@ -41,5 +41,11 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:review-runs

.github/workflows/tend-review.yaml

@@ -84,6 +84,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:review ${{ github.event.pull_request.number }}
 

.github/workflows/tend-triage.yaml

@@ -53,6 +53,12 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:triage ${{ github.event.issue.number }}
 

.github/workflows/tend-weekly.yaml

@@ -41,5 +41,11 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           bot_name: prql-bot
           model: opus
+          sandbox_setup: |
+            mkdir -p ~/.local/bin
+            curl -LsSf https://get.nexte.st/latest/linux | tar zxf - -C ~/.local/bin
+            cargo-nextest --version
+            curl -LsSf https://github.com/mitsuhiko/insta/releases/latest/download/cargo-insta-installer.sh | CARGO_HOME=~/.local sh
+            cargo-insta --version
           prompt: |2
             /tend-ci-runner:weekly