[apotema]

Problem

labelle-assembler's "Examples integration test" job failed four consecutive times (labelle-toolkit/labelle-assembler PR #656's checks) because https://www.lua.org/ftp/lua-5.4.8.tar.gz timed out from GitHub's runners. That URL is this repo's .lua dependency in build.zig.zon — the manifest's single URL made lua.org a single point of failure for every consumer's CI.

Fix

Point the .lua dependency at a byte-identical copy hosted on this repo's deps-mirror release — GitHub is the CI's own network, so the fetch can only fail when CI itself can't run anyway.

Why the swap is safe

Zig pins dependencies by content hash, not by URL. The .hash field (N-V-__8AAKEzFAAA695b9LXBhUSVK5MAV_VKSm1mEj3Acbze) is unchanged, so any URL must serve content-identical bytes or every consumer's fetch fails loudly. The URL choice cannot change what is built.

How the mirror was verified

• lua.org itself was unreachable during this work (same outage), so the canonical bytes were obtained from two independent distro distfile mirrors — FreeBSD's distcache.freebsd.org/ports-distfiles/ and OpenBSD's ftp.openbsd.org/pub/OpenBSD/distfiles/ — which agree byte-for-byte: sha256 4f18ddae154e793e46eeab727c59ef1c0c0c2b744e7b94219710d76f530629ae (374332 bytes).
• zig fetch http://distcache.freebsd.org/ports-distfiles/lua-5.4.8.tar.gz printed the exact pinned hash.
• After uploading that file to the release: zig fetch https://github.com/labelle-toolkit/labelle-scripting/releases/download/deps-mirror/lua-5.4.8.tar.gz → N-V-__8AAKEzFAAA695b9LXBhUSVK5MAV_VKSm1mEj3Acbze — identical to the manifest's pin.

Neither public mirror was usable directly in the manifest: FreeBSD's distcache is plain-http only (no TLS) and is an evicting package-build cache; OpenBSD's serves Content-Type: text/plain, which zig fetch rejects outright.

Validation

zig build test here compiles every language toolchain (mruby, quickjs, go, crystal, csharp, rust), so it wasn't run for a URL-only manifest change — the load-bearing check is the zig fetch hash match above. zig build --fetch passes (manifest parses, all deps resolve).

quickjs audit (no change)

The other dependency, quickjs (https://github.com/quickjs-ng/quickjs/archive/refs/tags/v0.15.1.tar.gz), does not share the hazard: it's a github.com URL, and GitHub is the CI's network. No non-GitHub single-source dependencies remain in the manifest.

🤖 Generated with Claude Code

https://claude.ai/code/session_014pbwN1ytAa8tctZMaTMjAk

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f13eb7a-bc38-4793-b6a6-b88ae7379f60

📥 Commits

Reviewing files that changed from the base of the PR and between 625fed2 and cb047d4.

📒 Files selected for processing (1)

• build.zig.zon

---

📝 Walkthrough

Walkthrough

The build manifest changes the Lua 5.4.8 dependency URL from lua.org to a GitHub release mirror. The content hash remains unchanged, and comments document the mirror provenance.

Changes

Lua dependency source

Layer / File(s)	Summary
Update Lua archive mirror build.zig.zon	The pinned Lua 5.4.8 archive now uses a GitHub release mirror. The existing content hash remains unchanged. Comments document the mirror provenance.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the Lua dependency URL change and the CI reliability reason.
Description check	✅ Passed	The description explains the Lua mirror change, hash verification, validation, and scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/lua-tarball-mirror

---

_{Comment @coderabbitai help to get the list of available commands.}