toolchain: sync vendored v0.3

Single non-merge commit (archive replace, not subtree pull) so the update stays rebase-mergeable.

git-subtree-dir: toolchain
git-subtree-split: 267a74a88114dc9c292e49acc6b950241190058e

Author: julian-goldstein

template/build/toolchain.lock

@@ -5,7 +5,7 @@
 # release `v<TOOLCHAIN_VERSION>` holding the whole set; consumers pin this one
 # number, and the cache is keyed by it (cache/yeet/toolchain/v<N>/<arch>/). CI
 # bumps it by 0.1 on every publish (which only happens when build/ changes).
-TOOLCHAIN_VERSION=0.1
+TOOLCHAIN_VERSION=0.3
 
 # Where a consumer fetches assets from: the version-tagged release. The fetch
 # appends `/v<TOOLCHAIN_VERSION>/<tool>-<arch>`.
@@ -27,7 +27,7 @@ CLANG_SHA256_aarch64=105fb2d324095127a127bcba56702a86229ed8892ce6429802d30585fa2
 BPFTOOL_VERSION=7.7.0
 BPFTOOL_SHA256_x86_64=74bd16335aa1c40714fb50287a42766c6faa4958f969cce32fef89485ce4934c
 BPFTOOL_SHA256_aarch64=2b3fc4dd5e4e40bd8d670c5f1fa9693b3f879a122c0f6a3eb806dfc6735da6b7
-LIBBPF_HEADERS_SHA256=f19af8beb34b8274890ca30821eccaced42083c2a923853a73e76cca9bbf4625
+LIBBPF_HEADERS_SHA256=bd0f88dbf44ec9bff33fba039bc824e48bdd5f35b7217e510fffe1623a7cb648
 
 # GNU make — the build driver. Built static from source (tiny, fast). Since
 # make can't fetch itself, `yeet build` bootstraps it into the cache at the

toolchain/.github/workflows/vendor.yml

@@ -166,14 +166,36 @@ jobs:
           sed -i "s|^LIBBPF_HEADERS_SHA256=.*|LIBBPF_HEADERS_SHA256=${hsum}|" build/versions.env
           grep -E '_SHA256_|^LIBBPF_HEADERS_SHA256=' build/versions.env
 
+      - name: Tag immutable v${{ env.TC }} snapshot
+        run: |
+          set -euo pipefail
+          tag="v${TC}"
+          # master is protected (PR/merge-queue only), so we never push it. The
+          # recorded lock (bumped version + checksums) and the SDK headers land
+          # in the commit the version tag points at, so the tag is fully
+          # self-contained: `git show ${tag}:build/versions.env` yields the exact
+          # lock for this release. Binaries are NOT committed — they ride the
+          # release as assets (x86_64/ and aarch64/ are gitignored).
+          if git ls-remote --exit-code --tags origin "refs/tags/${tag}" >/dev/null 2>&1; then
+            echo "tag ${tag} already exists — leaving the immutable tag as-is"
+          else
+            git config user.name  "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git add include build/versions.env
+            git commit -m "toolchain ${tag}: record version, checksums + headers"
+            git tag -a "$tag" -m "Static build toolchain ${tag}"
+            git push origin "refs/tags/${tag}"
+          fi
+
       - name: Publish v${{ env.TC }} release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           set -euo pipefail
           tag="v${TC}"
-          # Immutable, version-tagged release; the tag carries the version, so
-          # assets are plain-named (<tool>-<arch>). Consumers pin this one tag.
+          # Immutable, version-tagged release pinned to the snapshot tag above;
+          # the tag carries the version, so assets are plain-named (<tool>-<arch>).
+          # Consumers pin this one tag.
           mkdir -p dist
           for a in x86_64 aarch64; do
             for t in clang make bpftool esbuild git; do cp "$a/$t" "dist/${t}-${a}"; done
@@ -184,20 +206,3 @@ jobs:
                  --notes "Static build toolchain $tag — clang/make/git built from source; bpftool/esbuild/libbpf headers re-hosted."
           # --clobber so a same-version re-run refreshes assets.
           gh release upload "$tag" dist/* --clobber
-
-      - name: Commit headers + recorded checksums
-        run: |
-          set -euo pipefail
-          # Binaries are NOT committed — they are published as release assets
-          # above and fetched into the per-machine cache. Only the SDK headers
-          # and the recorded checksums land in git (x86_64/ and aarch64/ are
-          # gitignored).
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add include build/versions.env
-          if git diff --cached --quiet; then
-            echo "no changes to commit"
-          else
-            git commit -m "toolchain v${TC}: record version, checksums + headers"
-            git push
-          fi

toolchain/build/versions.env

@@ -5,7 +5,7 @@
 # release `v<TOOLCHAIN_VERSION>` holding the whole set; consumers pin this one
 # number, and the cache is keyed by it (cache/yeet/toolchain/v<N>/<arch>/). CI
 # bumps it by 0.1 on every publish (which only happens when build/ changes).
-TOOLCHAIN_VERSION=0.1
+TOOLCHAIN_VERSION=0.3
 
 # Where a consumer fetches assets from: the version-tagged release. The fetch
 # appends `/v<TOOLCHAIN_VERSION>/<tool>-<arch>`.
@@ -27,7 +27,7 @@ CLANG_SHA256_aarch64=105fb2d324095127a127bcba56702a86229ed8892ce6429802d30585fa2
 BPFTOOL_VERSION=7.7.0
 BPFTOOL_SHA256_x86_64=74bd16335aa1c40714fb50287a42766c6faa4958f969cce32fef89485ce4934c
 BPFTOOL_SHA256_aarch64=2b3fc4dd5e4e40bd8d670c5f1fa9693b3f879a122c0f6a3eb806dfc6735da6b7
-LIBBPF_HEADERS_SHA256=f19af8beb34b8274890ca30821eccaced42083c2a923853a73e76cca9bbf4625
+LIBBPF_HEADERS_SHA256=bd0f88dbf44ec9bff33fba039bc824e48bdd5f35b7217e510fffe1623a7cb648
 
 # GNU make — the build driver. Built static from source (tiny, fast). Since
 # make can't fetch itself, `yeet build` bootstraps it into the cache at the