From c143a3ab9ff669be920e91a5e95eb1bcde283b94 Mon Sep 17 00:00:00 2001
From: Paul Jolly <paul@myitcv.org.uk>
Date: Mon, 3 May 2021 09:38:54 +0100
Subject: [PATCH] ci: fix tip triggers with proper quoting

Change-Id: Idd7a4e784f077ea0084d0387154bb5436f143bc7
Reviewed-on: https://cue-review.googlesource.com/c/cue/+/9623
Reviewed-by: CUE cueckoo <cueckoo@gmail.com>
Reviewed-by: Paul Jolly <paul@myitcv.org.uk>
---
 .github/workflows/new_version_triggers.yml | 12 ++---
 .github/workflows/test.yml                 |  6 +--
 .github/workflows/tip_triggers.yml         |  8 +--
 cmd/cue/cmd/testdata/script/cmd_github.txt | 34 ++++++-------
 cue/testdata/eval/github.txtar             | 58 +++++++++++-----------
 internal/ci/workflows.cue                  | 20 ++++----
 6 files changed, 69 insertions(+), 69 deletions(-)

diff --git a/.github/workflows/new_version_triggers.yml b/.github/workflows/new_version_triggers.yml
index 1135c0abe..a1eb6948c 100644
--- a/.github/workflows/new_version_triggers.yml
+++ b/.github/workflows/new_version_triggers.yml
@@ -13,11 +13,11 @@ jobs:
         shell: bash
     steps:
     - name: Rebuild tip.cuelang.org
-      run: 'curl -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
-        }} --request POST --data-binary "{"event_type": "Re-test post release of ${GITHUB_REF##refs/tags/}"}"
-        https://api.github.com/repos/cuelang/cuelang.org/dispatches'
+      run: 'curl -f -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
+        }} --request POST --data-binary "{\"event_type\": \"Re-test post release of
+        ${GITHUB_REF##refs/tags/}\"}" https://api.github.com/repos/cuelang/cuelang.org/dispatches'
     - name: Trigger unity build
-      run: 'curl -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
-        }} --request POST --data-binary "{"event_type": "Check against CUE ${GITHUB_REF##refs/tags/}",
-        "client_payload": {"type": "unity", "payload": {"versions": "\"${GITHUB_REF##refs/tags/}\"}}}"
+      run: 'curl -f -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
+        }} --request POST --data-binary "{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\",
+        \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}"
         https://api.github.com/repos/cue-sh/unity/dispatches'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 037af3244..7bd027132 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -19,7 +19,7 @@ jobs:
       run: echo "${{ secrets.gerritCookie }}" > ~/.gitcookies
     - if: ${{ startsWith(github.ref, 'refs/heads/ci/') }}
       name: Update Gerrit CL message with starting message
-      run: 'curl -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Started
+      run: 'curl -f -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Started
         the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{
         github.run_id }}"}'' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename
         $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review'
@@ -82,7 +82,7 @@ jobs:
         GOPROXY=https://proxy.golang.org go get -d cuelang.org/go/cmd/cue@$v
     - if: ${{ startsWith(github.ref, 'refs/heads/ci/') && failure() }}
       name: Post any failures for this matrix entry
-      run: 'curl -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Build
+      run: 'curl -f -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Build
         failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url
         }}/actions/runs/${{ github.run_id }} for more details","labels":{"Code-Review":-1}}''
         -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename
@@ -98,7 +98,7 @@ jobs:
     - name: Write the gitcookies file
       run: echo "${{ secrets.gerritCookie }}" > ~/.gitcookies
     - name: Update Gerrit CL message with success message
-      run: 'curl -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Build
+      run: 'curl -f -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Build
         succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id
         }}","labels":{"Code-Review":1}}'' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename
         $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review'
diff --git a/.github/workflows/tip_triggers.yml b/.github/workflows/tip_triggers.yml
index 3bae34bb6..067fe4e2c 100644
--- a/.github/workflows/tip_triggers.yml
+++ b/.github/workflows/tip_triggers.yml
@@ -13,10 +13,10 @@ jobs:
         shell: bash
     steps:
     - name: Rebuild tip.cuelang.org
-      run: curl -s -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook
+      run: curl -f -s -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook
         }}
     - name: Trigger unity build
-      run: 'echo curl -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
-        }} --request POST --data-binary "{"event_type": "Check against ${GITHUB_SHA}",
-        "client_payload": {"type": "unity", "payload": {"versions": "\"commit:${GITHUB_SHA}\""}}}"
+      run: 'curl -f -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
+        }} --request POST --data-binary "{\"event_type\": \"Check against ${GITHUB_SHA}\",
+        \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}"
         https://api.github.com/repos/cue-sh/unity/dispatches'
diff --git a/cmd/cue/cmd/testdata/script/cmd_github.txt b/cmd/cue/cmd/testdata/script/cmd_github.txt
index d56fe306d..bc1260c70 100644
--- a/cmd/cue/cmd/testdata/script/cmd_github.txt
+++ b/cmd/cue/cmd/testdata/script/cmd_github.txt
@@ -66,13 +66,13 @@ jobs:
         shell: bash
     steps:
     - name: Rebuild tip.cuelang.org
-      run: 'curl -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
-        }} --request POST --data-binary "{"event_type": "Re-test post release of ${GITHUB_REF##refs/tags/}"}"
-        https://api.github.com/repos/cuelang/cuelang.org/dispatches'
+      run: 'curl -f -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
+        }} --request POST --data-binary "{\"event_type\": \"Re-test post release of
+        ${GITHUB_REF##refs/tags/}\"}" https://api.github.com/repos/cuelang/cuelang.org/dispatches'
     - name: Trigger unity build
-      run: 'curl -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
-        }} --request POST --data-binary "{"event_type": "Check against CUE ${GITHUB_REF##refs/tags/}",
-        "client_payload": {"type": "unity", "payload": {"versions": "\"${GITHUB_REF##refs/tags/}\"}}}"
+      run: 'curl -f -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
+        }} --request POST --data-binary "{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\",
+        \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}"
         https://api.github.com/repos/cue-sh/unity/dispatches'
 -- .github/workflows/release.yml.golden --
 # Generated by internal/ci/ci_tool.cue; do not edit
@@ -231,7 +231,7 @@ jobs:
       run: echo "${{ secrets.gerritCookie }}" > ~/.gitcookies
     - if: ${{ startsWith(github.ref, 'refs/heads/ci/') }}
       name: Update Gerrit CL message with starting message
-      run: 'curl -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Started
+      run: 'curl -f -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Started
         the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{
         github.run_id }}"}'' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename
         $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review'
@@ -294,7 +294,7 @@ jobs:
         GOPROXY=https://proxy.golang.org go get -d cuelang.org/go/cmd/cue@$v
     - if: ${{ startsWith(github.ref, 'refs/heads/ci/') && failure() }}
       name: Post any failures for this matrix entry
-      run: 'curl -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Build
+      run: 'curl -f -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Build
         failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url
         }}/actions/runs/${{ github.run_id }} for more details","labels":{"Code-Review":-1}}''
         -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename
@@ -310,7 +310,7 @@ jobs:
     - name: Write the gitcookies file
       run: echo "${{ secrets.gerritCookie }}" > ~/.gitcookies
     - name: Update Gerrit CL message with success message
-      run: 'curl -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Build
+      run: 'curl -f -s -H "Content-Type: application/json" --request POST --data ''{"tag":"trybot","message":"Build
         succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id
         }}","labels":{"Code-Review":1}}'' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename
         $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review'
@@ -346,12 +346,12 @@ jobs:
         shell: bash
     steps:
     - name: Rebuild tip.cuelang.org
-      run: curl -s -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook
+      run: curl -f -s -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook
         }}
     - name: Trigger unity build
-      run: 'echo curl -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
-        }} --request POST --data-binary "{"event_type": "Check against ${GITHUB_SHA}",
-        "client_payload": {"type": "unity", "payload": {"versions": "\"commit:${GITHUB_SHA}\""}}}"
+      run: 'curl -f -s -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT
+        }} --request POST --data-binary "{\"event_type\": \"Check against ${GITHUB_SHA}\",
+        \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}"
         https://api.github.com/repos/cue-sh/unity/dispatches'
 -- internal/ci/ci_tool.cue --
 // Copyright 2021 The CUE Authors
@@ -1414,7 +1414,7 @@ tip_triggers: _#bashWorkflow & {
 			run:  "\(_#curl) -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook }}"
 		}, {
 			name: "Trigger unity build"
-			run:  "echo \(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Check against ${GITHUB_SHA}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches"
+			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Check against ${GITHUB_SHA}\\\", \\\"client_payload\\\": {\\\"type\\\": \\\"unity\\\", \\\"payload\\\": {\\\"versions\\\": \\\"\\\\\\\"commit:${GITHUB_SHA}\\\\\\\"\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches"
 		}]
 	}
 }
@@ -1425,10 +1425,10 @@ new_version_triggers: _#bashWorkflow & {
 		"runs-on": _#linuxMachine
 		steps: [{
 			name: "Rebuild tip.cuelang.org"
-			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Re-test post release of ${GITHUB_REF##refs/tags/}\"}\" https://api.github.com/repos/cuelang/cuelang.org/dispatches"
+			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Re-test post release of ${GITHUB_REF##refs/tags/}\\\"}\" https://api.github.com/repos/cuelang/cuelang.org/dispatches"
 		}, {
 			name: "Trigger unity build"
-			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches"
+			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Check against CUE ${GITHUB_REF##refs/tags/}\\\", \\\"client_payload\\\": {\\\"type\\\": \\\"unity\\\", \\\"payload\\\": {\\\"versions\\\": \\\"\\\\\\\"${GITHUB_REF##refs/tags/}\\\\\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches"
 		}]
 	}
 }
@@ -1559,4 +1559,4 @@ _#copybaraSteps: {
 	_#name: string
 	_#cmd:  string
 }
-_#curl: "curl -s"
+_#curl: "curl -f -s"
diff --git a/cue/testdata/eval/github.txtar b/cue/testdata/eval/github.txtar
index 189a295ef..ab68341bb 100644
--- a/cue/testdata/eval/github.txtar
+++ b/cue/testdata/eval/github.txtar
@@ -260,7 +260,7 @@ tip_triggers: _#bashWorkflow & {
 			run:  "\(_#curl) -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook }}"
 		}, {
 			name: "Trigger unity build"
-			run:  "echo \(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Check against ${GITHUB_SHA}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches"
+			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Check against ${GITHUB_SHA}\\\", \\\"client_payload\\\": {\\\"type\\\": \\\"unity\\\", \\\"payload\\\": {\\\"versions\\\": \\\"\\\\\\\"commit:${GITHUB_SHA}\\\\\\\"\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches"
 		}]
 	}
 }
@@ -271,10 +271,10 @@ new_version_triggers: _#bashWorkflow & {
 		"runs-on": _#linuxMachine
 		steps: [{
 			name: "Rebuild tip.cuelang.org"
-			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Re-test post release of ${GITHUB_REF##refs/tags/}\"}\" https://api.github.com/repos/cuelang/cuelang.org/dispatches"
+			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Re-test post release of ${GITHUB_REF##refs/tags/}\\\"}\" https://api.github.com/repos/cuelang/cuelang.org/dispatches"
 		}, {
 			name: "Trigger unity build"
-			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches"
+			run:  "\(_#curl) -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Check against CUE ${GITHUB_REF##refs/tags/}\\\", \\\"client_payload\\\": {\\\"type\\\": \\\"unity\\\", \\\"payload\\\": {\\\"versions\\\": \\\"\\\\\\\"${GITHUB_REF##refs/tags/}\\\\\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches"
 		}]
 	}
 }
@@ -405,7 +405,7 @@ _#copybaraSteps: {
 	_#name: string
 	_#cmd:  string
 }
-_#curl: "curl -s"
+_#curl: "curl -f -s"
 -- cue.mod/module.cue --
 module: "mod.com"
 
@@ -1131,7 +1131,7 @@ import "strings"
               }
               1: (#struct){
                 name: (string){ "Update Gerrit CL message with starting message" }
-                run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Started the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\"}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+                run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Started the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\"}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
                 if: (string){ "${{ startsWith(github.ref, 'refs/heads/ci/') }}" }
               }
             }
@@ -1221,7 +1221,7 @@ import "strings"
               11: (#struct){
                 if: (string){ "${{ startsWith(github.ref, 'refs/heads/ci/') && failure() }}" }
                 name: (string){ "Post any failures for this matrix entry" }
-                run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }} for more details\",\"labels\":{\"Code-Review\":-1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+                run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }} for more details\",\"labels\":{\"Code-Review\":-1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
               }
             }
             defaults: (#struct){
@@ -1241,7 +1241,7 @@ import "strings"
               }
               1: (#struct){
                 name: (string){ "Update Gerrit CL message with success message" }
-                run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\",\"labels\":{\"Code-Review\":1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+                run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\",\"labels\":{\"Code-Review\":1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
               }
             }
             defaults: (#struct){
@@ -1286,16 +1286,16 @@ import "strings"
         }
         _#startCLBuild(:ci): (#struct){
           name: (string){ "Update Gerrit CL message with starting message" }
-          run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Started the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\"}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+          run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Started the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\"}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
         }
         _#failCLBuild(:ci): (#struct){
           if: (string){ "${{ startsWith(github.ref, 'refs/heads/ci/') && failure() }}" }
           name: (string){ "Post any failures for this matrix entry" }
-          run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }} for more details\",\"labels\":{\"Code-Review\":-1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+          run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }} for more details\",\"labels\":{\"Code-Review\":-1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
         }
         _#passCLBuild(:ci): (#struct){
           name: (string){ "Update Gerrit CL message with success message" }
-          run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\",\"labels\":{\"Code-Review\":1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+          run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\",\"labels\":{\"Code-Review\":1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
         }
         _#gerrit(:ci): (#struct){
           _#setCodeReview(:ci): (#struct){
@@ -1615,11 +1615,11 @@ import "strings"
             steps: (#list){
               0: (#struct){
                 name: (string){ "Rebuild tip.cuelang.org" }
-                run: (string){ "curl -s -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook }}" }
+                run: (string){ "curl -f -s -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook }}" }
               }
               1: (#struct){
                 name: (string){ "Trigger unity build" }
-                run: (string){ "echo curl -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Check against ${GITHUB_SHA}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches" }
+                run: (string){ "curl -f -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Check against ${GITHUB_SHA}\\\", \\\"client_payload\\\": {\\\"type\\\": \\\"unity\\\", \\\"payload\\\": {\\\"versions\\\": \\\"\\\\\\\"commit:${GITHUB_SHA}\\\\\\\"\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches" }
               }
             }
             defaults: (#struct){
@@ -1686,11 +1686,11 @@ import "strings"
             steps: (#list){
               0: (#struct){
                 name: (string){ "Rebuild tip.cuelang.org" }
-                run: (string){ "curl -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Re-test post release of ${GITHUB_REF##refs/tags/}\"}\" https://api.github.com/repos/cuelang/cuelang.org/dispatches" }
+                run: (string){ "curl -f -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Re-test post release of ${GITHUB_REF##refs/tags/}\\\"}\" https://api.github.com/repos/cuelang/cuelang.org/dispatches" }
               }
               1: (#struct){
                 name: (string){ "Trigger unity build" }
-                run: (string){ "curl -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches" }
+                run: (string){ "curl -f -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Check against CUE ${GITHUB_REF##refs/tags/}\\\", \\\"client_payload\\\": {\\\"type\\\": \\\"unity\\\", \\\"payload\\\": {\\\"versions\\\": \\\"\\\\\\\"${GITHUB_REF##refs/tags/}\\\\\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches" }
               }
             }
             defaults: (#struct){
@@ -1837,7 +1837,7 @@ import "strings"
           }
           1: (#struct){
             name: (string){ "Update Gerrit CL message with starting message" }
-            run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Started the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\"}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+            run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Started the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\"}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
             if: (string){ "${{ startsWith(github.ref, 'refs/heads/ci/') }}" }
           }
         }
@@ -1927,7 +1927,7 @@ import "strings"
           11: (#struct){
             if: (string){ "${{ startsWith(github.ref, 'refs/heads/ci/') && failure() }}" }
             name: (string){ "Post any failures for this matrix entry" }
-            run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }} for more details\",\"labels\":{\"Code-Review\":-1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+            run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }} for more details\",\"labels\":{\"Code-Review\":-1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
           }
         }
         defaults: (#struct){
@@ -1947,7 +1947,7 @@ import "strings"
           }
           1: (#struct){
             name: (string){ "Update Gerrit CL message with success message" }
-            run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\",\"labels\":{\"Code-Review\":1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+            run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\",\"labels\":{\"Code-Review\":1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
           }
         }
         defaults: (#struct){
@@ -1992,16 +1992,16 @@ import "strings"
     }
     _#startCLBuild(:ci): (#struct){
       name: (string){ "Update Gerrit CL message with starting message" }
-      run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Started the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\"}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+      run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Started the build... see progress at ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\"}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
     }
     _#failCLBuild(:ci): (#struct){
       if: (string){ "${{ startsWith(github.ref, 'refs/heads/ci/') && failure() }}" }
       name: (string){ "Post any failures for this matrix entry" }
-      run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }} for more details\",\"labels\":{\"Code-Review\":-1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+      run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build failed for ${{ runner.os }}-${{ matrix.go-version }}; see ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }} for more details\",\"labels\":{\"Code-Review\":-1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
     }
     _#passCLBuild(:ci): (#struct){
       name: (string){ "Update Gerrit CL message with success message" }
-      run: (string){ "curl -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\",\"labels\":{\"Code-Review\":1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
+      run: (string){ "curl -f -s -H \"Content-Type: application/json\" --request POST --data '{\"tag\":\"trybot\",\"message\":\"Build succeeded for ${{ github.event.repository.html_url }}/actions/runs/${{ github.run_id }}\",\"labels\":{\"Code-Review\":1}}' -b ~/.gitcookies https://cue-review.googlesource.com/a/changes/$(basename $(dirname $GITHUB_REF))/revisions/$(basename $GITHUB_REF)/review" }
     }
     _#gerrit(:ci): (#struct){
       _#setCodeReview(:ci): (#struct){
@@ -2385,11 +2385,11 @@ import "strings"
         steps: (#list){
           0: (#struct){
             name: (string){ "Rebuild tip.cuelang.org" }
-            run: (string){ "curl -s -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook }}" }
+            run: (string){ "curl -f -s -X POST -d {} https://api.netlify.com/build_hooks/${{ secrets.CuelangOrgTipRebuildHook }}" }
           }
           1: (#struct){
             name: (string){ "Trigger unity build" }
-            run: (string){ "echo curl -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Check against ${GITHUB_SHA}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches" }
+            run: (string){ "curl -f -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Check against ${GITHUB_SHA}\\\", \\\"client_payload\\\": {\\\"type\\\": \\\"unity\\\", \\\"payload\\\": {\\\"versions\\\": \\\"\\\\\\\"commit:${GITHUB_SHA}\\\\\\\"\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches" }
           }
         }
         defaults: (#struct){
@@ -2453,11 +2453,11 @@ import "strings"
         steps: (#list){
           0: (#struct){
             name: (string){ "Rebuild tip.cuelang.org" }
-            run: (string){ "curl -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Re-test post release of ${GITHUB_REF##refs/tags/}\"}\" https://api.github.com/repos/cuelang/cuelang.org/dispatches" }
+            run: (string){ "curl -f -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Re-test post release of ${GITHUB_REF##refs/tags/}\\\"}\" https://api.github.com/repos/cuelang/cuelang.org/dispatches" }
           }
           1: (#struct){
             name: (string){ "Trigger unity build" }
-            run: (string){ "curl -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches" }
+            run: (string){ "curl -f -s -H \"Content-Type: application/json\" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary \"{\\\"event_type\\\": \\\"Check against CUE ${GITHUB_REF##refs/tags/}\\\", \\\"client_payload\\\": {\\\"type\\\": \\\"unity\\\", \\\"payload\\\": {\\\"versions\\\": \\\"\\\\\\\"${GITHUB_REF##refs/tags/}\\\\\\\"}}}\" https://api.github.com/repos/cue-sh/unity/dispatches" }
           }
         }
         defaults: (#struct){
@@ -2641,7 +2641,7 @@ import "strings"
       }
     }
   }
-  _#curl(:ci): (string){ "curl -s" }
+  _#curl(:ci): (string){ "curl -f -s" }
 }
 -- out/compile --
 --- workflows.cue
@@ -2954,7 +2954,7 @@ import "strings"
           },
           {
             name: "Trigger unity build"
-            run: "echo \(〈4;_#curl〉) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{"event_type": "Check against ${GITHUB_SHA}", "client_payload": {"type": "unity", "payload": {"versions": "\"commit:${GITHUB_SHA}\""}}}" https://api.github.com/repos/cue-sh/unity/dispatches"
+            run: "\(〈4;_#curl〉) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Check against ${GITHUB_SHA}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}" https://api.github.com/repos/cue-sh/unity/dispatches"
           },
         ]
       }
@@ -2975,11 +2975,11 @@ import "strings"
         steps: [
           {
             name: "Rebuild tip.cuelang.org"
-            run: "\(〈4;_#curl〉) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{"event_type": "Re-test post release of ${GITHUB_REF##refs/tags/}"}" https://api.github.com/repos/cuelang/cuelang.org/dispatches"
+            run: "\(〈4;_#curl〉) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Re-test post release of ${GITHUB_REF##refs/tags/}\"}" https://api.github.com/repos/cuelang/cuelang.org/dispatches"
           },
           {
             name: "Trigger unity build"
-            run: "\(〈4;_#curl〉) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{"event_type": "Check against CUE ${GITHUB_REF##refs/tags/}", "client_payload": {"type": "unity", "payload": {"versions": "\"${GITHUB_REF##refs/tags/}\"}}}" https://api.github.com/repos/cue-sh/unity/dispatches"
+            run: "\(〈4;_#curl〉) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}" https://api.github.com/repos/cue-sh/unity/dispatches"
           },
         ]
       }
@@ -3107,5 +3107,5 @@ import "strings"
     _#name: string
     _#cmd: string
   }
-  _#curl: "curl -s"
+  _#curl: "curl -f -s"
 }
diff --git a/internal/ci/workflows.cue b/internal/ci/workflows.cue
index db7e35709..fb5b1d820 100644
--- a/internal/ci/workflows.cue
+++ b/internal/ci/workflows.cue
@@ -332,9 +332,9 @@ tip_triggers: _#bashWorkflow & {
 			},
 			{
 				name: "Trigger unity build"
-				run:  """
-					echo \(_#curl) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Check against ${GITHUB_SHA}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}" https://api.github.com/repos/cue-sh/unity/dispatches
-					"""
+				run:  #"""
+					\#(_#curl) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Check against ${GITHUB_SHA}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"commit:${GITHUB_SHA}\\\"\"}}}" https://api.github.com/repos/cue-sh/unity/dispatches
+					"""#
 			},
 		]
 	}
@@ -349,15 +349,15 @@ new_version_triggers: _#bashWorkflow & {
 		steps: [
 			{
 				name: "Rebuild tip.cuelang.org"
-				run:  """
-					\(_#curl) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Re-test post release of ${GITHUB_REF##refs/tags/}\"}" https://api.github.com/repos/cuelang/cuelang.org/dispatches
-					"""
+				run:  #"""
+					\#(_#curl) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Re-test post release of ${GITHUB_REF##refs/tags/}\"}" https://api.github.com/repos/cuelang/cuelang.org/dispatches
+					"""#
 			},
 			{
 				name: "Trigger unity build"
-				run:  """
-					\(_#curl) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}" https://api.github.com/repos/cue-sh/unity/dispatches
-					"""
+				run:  #"""
+					\#(_#curl) -H "Content-Type: application/json" -u cueckoo:${{ secrets.CUECKOO_GITHUB_PAT }} --request POST --data-binary "{\"event_type\": \"Check against CUE ${GITHUB_REF##refs/tags/}\", \"client_payload\": {\"type\": \"unity\", \"payload\": {\"versions\": \"\\\"${GITHUB_REF##refs/tags/}\\\"}}}" https://api.github.com/repos/cue-sh/unity/dispatches
+					"""#
 			},
 		]
 	}
@@ -504,4 +504,4 @@ _#copybaraSteps: {
 	]
 }
 
-_#curl: "curl -s"
+_#curl: "curl -f -s"