fix: ci cache-key, drift-guard, and container frontend correctness

.github/workflows/base-refresh.yaml

@@ -40,7 +40,9 @@ jobs:
           token: ${{ secrets.BOT_PAT }}
 
       - name: Resolve + rewrite drifted base pins
-        run: make update-base | tee /tmp/base-refresh.log
+        run: |
+          set -eo pipefail
+          make update-base | tee /tmp/base-refresh.log
 
       - name: Open / update PR on drift
         env:

.github/workflows/binaries.yaml

@@ -21,18 +21,19 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       # Cache the cross-compiled binaries between runs, keyed on every
-      # input that affects the build: the build script + the makefile
-      # (which holds the version pins CHISEL_REF / SPREAD_REF /
-      # DOCKER_VERSION / GO_BUILDER_IMAGE). Hit -> skip the make step.
-      # Miss -> make rebuilds and the cache auto-saves at job end.
+      # input that affects the build: the build script, the chisel patches,
+      # + the makefile (which holds the version pins CHISEL_REF / SPREAD_REF /
+      # DOCKER_VERSION / GO_BUILDER_IMAGE). Mirrors hack/hash_inputs.sh's
+      # binaries input set. Hit -> skip the make step. Miss -> make rebuilds
+      # and the cache auto-saves at job end.
       - name: Restore binaries cache
         id: binaries-cache
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             cache/binaries/
             .stamp/binaries
-          key: binaries-${{ hashFiles('hack/build_binaries.sh', 'makefile') }}
+          key: binaries-${{ hashFiles('hack/build_binaries.sh', 'patches/chisel/*.patch', 'makefile') }}
 
       - name: Build go binaries (chisel + spread + docker static)
         if: steps.binaries-cache.outputs.cache-hit != 'true'

.github/workflows/ci.yaml

@@ -36,3 +36,22 @@ jobs:
       matrix: >-
         [{"runner": "ubuntu-24.04", "arch": "s390x",   "qemu": true},
          {"runner": "ubuntu-24.04", "arch": "ppc64le", "qemu": true}]
+
+  # Guard: inlined/*.yaml is generated from templates/ + scripts/ and also
+  # committed (repo-tree consumers grab it directly). Regenerate and fail on
+  # drift so a template or script edit can't land without its matching
+  # inlined refresh. Ubuntu runners ship ruby, so no extra setup.
+  check-inlined:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Assert committed inlined yamls match templates + scripts
+        run: |
+          make inlined-yaml-files
+          if ! git diff --exit-code inlined/; then
+            echo "::error::inlined/*.yaml is stale -- run 'make inlined-yaml-files' and commit the result"
+            exit 1
+          fi

demo/spread.yaml

@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -69,7 +67,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-22.04.yaml

@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-24.04.yaml

@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-25.10.yaml

@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-26.04.yaml

@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-26.10.yaml

@@ -15,8 +15,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -73,7 +71,7 @@ backends:
       docker run \
           --rm \
           --platform "linux/$arch" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-chisel-releases-22.04.yaml

@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-chisel-releases-24.04.yaml

@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-chisel-releases-25.10.yaml

@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-chisel-releases-26.04.yaml

@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

inlined/bread-chisel-releases-26.10.yaml

@@ -22,8 +22,6 @@ backends:
   docker:
     type: adhoc
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -79,7 +77,7 @@ backends:
           --platform "linux/$arch" \
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           $publish_flag \

scripts/spread_allocate_bread-chisel-releases.sh

@@ -1,5 +1,3 @@
-#spellchecker: ignore noninteractice
-
 set -e
 
 ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -55,7 +53,7 @@ docker run \
     --platform "linux/$arch" \
     --privileged \
     -v /var/run/docker.sock:/var/run/docker.sock \
-    -e DEBIAN_FRONTEND=noninteractice \
+    -e DEBIAN_FRONTEND=noninteractive \
     -e "usr=$SPREAD_SYSTEM_USERNAME" \
     -e "pass=$SPREAD_SYSTEM_PASSWORD" \
     $publish_flag \

scripts/spread_allocate_bread.sh

@@ -1,5 +1,3 @@
-#spellchecker: ignore noninteractice
-
 set -e
 
 ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # e.g., ubuntu-24.04-amd64 -> 24.04
@@ -56,7 +54,7 @@ echo "container_name: $container_name"
 docker run \
     --rm \
     --platform "linux/$arch" \
-    -e DEBIAN_FRONTEND=noninteractice \
+    -e DEBIAN_FRONTEND=noninteractive \
     -e "usr=$SPREAD_SYSTEM_USERNAME" \
     -e "pass=$SPREAD_SYSTEM_PASSWORD" \
     $publish_flag \

tests/spread.yaml

@@ -17,8 +17,6 @@ backends:
     type: adhoc
 
     allocate: |
-      #spellchecker: ignore noninteractice
-
       set -e
 
       ver=$(echo "$SPREAD_SYSTEM" | cut -d- -f2)   # ubuntu-26.04-amd64 -> 26.04
@@ -54,7 +52,7 @@ backends:
           --privileged \
           -v /var/run/docker.sock:/var/run/docker.sock \
           -v "$repo_root:/spread-bread:ro" \
-          -e DEBIAN_FRONTEND=noninteractice \
+          -e DEBIAN_FRONTEND=noninteractive \
           -e "usr=$SPREAD_SYSTEM_USERNAME" \
           -e "pass=$SPREAD_SYSTEM_PASSWORD" \
           --name "$container_name" \