From 5e2ae29660ef02abd65bd54bf295f7af3bebcb44 Mon Sep 17 00:00:00 2001
From: technofab <admin@technofab.de>
Date: Thu, 4 Sep 2025 08:34:25 +0200
Subject: [PATCH 1/3] chore: better solution for handling store paths in
 variables

---
 lib/impl/jobPatched.nix | 40 ++++++++++++++++++++++++++--------------
 tests/cilib_test.nix    |  5 +----
 2 files changed, 27 insertions(+), 18 deletions(-)

diff --git a/lib/impl/jobPatched.nix b/lib/impl/jobPatched.nix
index 9997caa..c7134fb 100644
--- a/lib/impl/jobPatched.nix
+++ b/lib/impl/jobPatched.nix
@@ -11,21 +11,33 @@ in
     pipelineName,
     nixConfig,
   }:
-    job
+    (builtins.removeAttrs job ["variables" "cache"])
     // (optionalAttrs nixConfig.enable (
       (prependToBeforeScript ["source setup_nix_ci \"gitlab-ci:pipeline:${pipelineName}:job-deps:${key}\""] job)
       // (appendToAfterScript ["finalize_nix_ci"] job)
     ))
-    // optionalAttrs nixConfig.enable {
-      variables =
-        (filterJobVariables false job)
-        // optionalAttrs nixConfig.enableRunnerCache {
-          NIX_CI_CACHE_STRATEGY = "runner";
-        };
-      cache =
-        (toList (job.cache or []))
-        ++ (optional nixConfig.enableRunnerCache {
-          key = nixConfig.runnerCacheKey;
-          paths = [".nix-cache/"];
-        });
-    }
+    // optionalAttrs nixConfig.enable (
+      (let
+        variables =
+          (filterJobVariables false job)
+          // optionalAttrs nixConfig.enableRunnerCache {
+            NIX_CI_CACHE_STRATEGY = "runner";
+          };
+      in
+        # filter empty variables
+        optionalAttrs (variables != {}) {
+          inherit variables;
+        })
+      // (let
+        cache =
+          (toList (job.cache or []))
+          ++ (optional nixConfig.enableRunnerCache {
+            key = nixConfig.runnerCacheKey;
+            paths = [".nix-cache/"];
+          });
+      in
+        # filter empty cache
+        optionalAttrs (cache != []) {
+          inherit cache;
+        })
+    )
diff --git a/tests/cilib_test.nix b/tests/cilib_test.nix
index d37da49..78e99a3 100644
--- a/tests/cilib_test.nix
+++ b/tests/cilib_test.nix
@@ -148,10 +148,7 @@
         name = "handle store paths in variables";
         expected = {
           stages = ["test"];
-          test = {
-            stage = "test";
-            variables."TEST" = "${pkgs.hello}";
-          };
+          test.stage = "test";
         };
         actual =
           (mkPipeline {

From 2a0a3f5881526a7272796baec0a436fe0c8b0ddc Mon Sep 17 00:00:00 2001
From: technofab <admin@technofab.de>
Date: Thu, 4 Sep 2025 08:39:37 +0200
Subject: [PATCH 2/3] chore(ci): try setting ssl env vars in the test directly
 (cuz pure mode)

---
 nix/repo/ci.nix            | 4 ----
 tests/flake_parts_test.nix | 2 ++
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/nix/repo/ci.nix b/nix/repo/ci.nix
index 5e14188..747c9d8 100644
--- a/nix/repo/ci.nix
+++ b/nix/repo/ci.nix
@@ -64,10 +64,6 @@ in
           script = [
             "nix run .#tests -- --junit=junit.xml"
           ];
-          variables = {
-            "SSL_CERT_FILE" = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-            "NIX_SSL_CERT_FILE" = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-          };
           allow_failure = true;
           artifacts = {
             when = "always";
diff --git a/tests/flake_parts_test.nix b/tests/flake_parts_test.nix
index 0b11ef2..e998f45 100644
--- a/tests/flake_parts_test.nix
+++ b/tests/flake_parts_test.nix
@@ -14,6 +14,8 @@
           ''
             ${ntlib.helpers.scriptHelpers}
             ${ntlib.helpers.path (with pkgs; [coreutils nix gnused gnugrep jq])}
+            export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+            export NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
             repo_path=${../.}
 
             cp ${./fixtures/flake_parts}/* .

From 00cf5b83c6c46698fba12a54b9cc15c6d4e5a4dd Mon Sep 17 00:00:00 2001
From: technofab <admin@technofab.de>
Date: Thu, 4 Sep 2025 10:29:56 +0200
Subject: [PATCH 3/3] chore: bump version

---
 lib/VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/VERSION b/lib/VERSION
index 0786c6b..18b1307 100644
--- a/lib/VERSION
+++ b/lib/VERSION
@@ -1 +1 @@
-3.0.0-alpha.1
+3.0.0-alpha.2