🔧 fix(ci): run a dagger CLI whose dockerBuild works with the ghcontrib module

[jasonwc]

The PR checks on this repo were failing before checking anything: every workflow installed dagger v0.20.6, and the ghcontrib module (which runs the PR title and Linear magic-word checks) now requires v0.20.8, so module load itself failed.

First attempt bumped to v0.20.8 — that fixed module load (title/magic-word/load all went green) but exposed a bug in the v0.20.8 engine itself: Directory.dockerBuild fails with proto: wrong wireType = 0 for field LinuxResources, killing the image build. Final state: DAGGER_VERSION: 0.21.7 (what tapesctl CI already runs) in ci, pr, and publish workflows. The module keeps engineVersion: v0.20.6 — it loads in compat mode.

Verification (local, pinned CLIs)

• v0.20.8: dagger call -m github.com/papercomputeco/daggerverse/ghcontrib --help loads (the original failure path) — but CI showed its dockerBuild proto bug.
• v0.21.7: dagger call build-postgres-image completes against this repo with the module unchanged — the exact function that failed in CI.

related to PCC-1159

🤖 Generated with Claude Code

[linear-code]

PCC-1159 A tapes-crates main push should open bump PRs in both consumers instead of waiting to be noticed

Problem

Ten hand-authored pin/vendor chore commits landed in tapesctl over nine days (eight in the final three), and every one was a human noticing that a shared crate had moved and re-typing the same repin dance. The lag between "crate main moved" and "consumer noticed" is exactly the window PCC-1147 lived in.

What to build

Contract RFD Option A: a bump-consumers.yaml in tapes-crates that, on a main push, opens a repin PR in each consumer — implemented as a make bump-harnesses REV=… target per consumer so the same move is one command by hand, with the PR body carrying git log old..new so review is informed. Reviewed PRs only; no auto-merge — the pin-agreement check (PCC-1158) is the enforcement, this is the convenience.

Prerequisite, validate first: the RFD's Step 0 — allowBuiltinFetchGit = true in both consumer flakes — which deletes the cargoLock.outputHashes recompute and roughly halves the machinery. If Step 0 doesn't hold, the design changes; prove it before building anything else.

Couple this to PCC-1158 as one commitment, not a ranked pair — the gate detects skew but does not reduce the toil; this is the half that does.

When crates.io publication lands (PCC-1149), this becomes version-bump PRs — same shape, simpler diff.

Review in Linear

[greptile-apps]

Greptile Summary

Updates the Dagger CLI from v0.20.6 to v0.20.8 across all GitHub Actions workflows so the ghcontrib module can load.

• Aligns CI, pull-request checks, and publishing on the minimum compatible CLI version.
• Leaves workflow behavior and permissions otherwise unchanged.

Confidence Score: 5/5

The PR appears safe to merge, with the consistent patch-version update addressing the stated workflow module-loading failure.

All three workflows make the same narrowly scoped CLI version update, and the provided verification confirms both the external ghcontrib module and the repository’s v0.20.6-engine module load under CLI v0.20.8.

Important Files Changed

Filename	Overview
.github/workflows/ci.yaml	Updates the Dagger CLI patch version used by the build workflow; no actionable issue identified.
.github/workflows/pr.yaml	Updates the Dagger CLI patch version so ghcontrib-based pull-request checks can load; no actionable issue identified.
.github/workflows/publish.yaml	Applies the same Dagger CLI patch update to publishing; no actionable issue identified.

_{Reviews (1): Last reviewed commit: "🔧 fix(ci): run a dagger CLI new enough ..." | Re-trigger Greptile}