ci: pin MoonBit toolchain via cache + fix $|/#| mixed string lint

Second bleeding-edge toolchain break after the async [3002] one: the newest
MoonBit compiler added syntax_lint [0063], which errors under `moon check
--deny-warn` when a multi-line string literal mixes `$|` and `#|` prefixes.
CI installs the toolchain via `curl ... | bash` (always latest), so this broke
the `test` job on main and every PR.

Two changes:

1. upload_pack_process.mbt: the partial-clone config template mixed `#|`
   (static) and `$|` (interpolated) lines in one literal. Converted all lines
   to `$|`; the static lines contain no backslash/`\{`, so the emitted config
   is byte-identical. Verified with `moon build --target native`.

2. Pin the toolchain. MoonBit's installer only fetches `latest`/`nightly`
   (cli.moonbitlang.com returns 403 for version strings — no real pinning), so
   a new composite action `.github/actions/setup-moon` caches ~/.moon
   (toolchain only; `moon update` still refreshes the registry) keyed by a
   `pin` marker. The toolchain is frozen to whatever was current when `pin`
   was last bumped; bump it to upgrade intentionally. Wired into every Unix
   install across ci/js-build/pages-demo/git-compat-random/copilot-setup/
   release. The Windows install and nix-build (already overlay-pinned) are
   unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WHFC6qxKjqjrixgjFtGihM

Author: claude

.github/actions/setup-moon/action.yml

@@ -0,0 +1,33 @@
+name: Setup MoonBit (pinned)
+description: >
+  Install the MoonBit toolchain, pinned via an actions/cache key. MoonBit's
+  installer can only fetch `latest`/`nightly` (it has no version-pinning), so a
+  bleeding-edge release can break CI at any time (see #83: async [3002] and the
+  $|/#| syntax_lint [0063]). Caching ~/.moon freezes the toolchain to whatever
+  was current when `pin` was last bumped; bump `pin` to intentionally upgrade.
+inputs:
+  pin:
+    description: Toolchain pin marker. Bump this string to pull a newer toolchain.
+    required: false
+    default: "2026-06-22"
+runs:
+  using: composite
+  steps:
+    - name: Restore MoonBit toolchain cache
+      id: moon-cache
+      uses: actions/cache@v4
+      with:
+        # Cache the toolchain only (binaries + bundled core), not the registry
+        # index — `moon update` still refreshes ~/.moon/registry every run.
+        path: |
+          ~/.moon/bin
+          ~/.moon/lib
+          ~/.moon/include
+        key: moon-toolchain-${{ runner.os }}-${{ inputs.pin }}
+    - name: Install MoonBit CLI
+      if: steps.moon-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
+    - name: Add MoonBit to PATH
+      shell: bash
+      run: echo "$HOME/.moon/bin" >> "$GITHUB_PATH"

.github/workflows/ci.yml

@@ -21,10 +21,8 @@ jobs:
         uses: mizchi/pkspec@v0.2.1
         with:
           pkl-version: none
-      - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+      - name: Setup MoonBit (pinned toolchain)
+        uses: ./.github/actions/setup-moon
       - name: Moon update
         run: moon update
       - name: pkf run check
@@ -88,10 +86,8 @@ jobs:
         uses: mizchi/pkspec@v0.2.1
         with:
           pkl-version: none
-      - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+      - name: Setup MoonBit (pinned toolchain)
+        uses: ./.github/actions/setup-moon
       - name: Moon update
         run: moon update
       - name: Build native binary for wbtests
@@ -127,10 +123,8 @@ jobs:
         uses: actions/checkout@v4
         with:
           submodules: true
-      - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+      - name: Setup MoonBit (pinned toolchain)
+        uses: ./.github/actions/setup-moon
       - name: Moon update
         run: moon update
       - name: Distributed tests
@@ -180,10 +174,8 @@ jobs:
           cd third_party/git
           make -j$(nproc)
 
-      - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+      - name: Setup MoonBit (pinned toolchain)
+        uses: ./.github/actions/setup-moon
 
       - name: Moon update
         run: moon update

.github/workflows/copilot-setup-steps.yml

@@ -29,10 +29,8 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Set up MoonBit
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> $GITHUB_PATH
+      - name: Set up MoonBit (pinned toolchain)
+        uses: ./.github/actions/setup-moon
 
       - name: Update MoonBit dependencies
         run: |

.github/workflows/git-compat-random.yml

@@ -74,11 +74,9 @@ jobs:
         if: ${{ steps.shard_guard.outputs.should_run == 'true' }}
         uses: mizchi/pkfire@v0
 
-      - name: Install MoonBit CLI
+      - name: Setup MoonBit (pinned toolchain)
         if: ${{ steps.shard_guard.outputs.should_run == 'true' }}
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moon
 
       - name: Build git from source
         if: ${{ steps.shard_guard.outputs.should_run == 'true' }}

.github/workflows/js-build.yml

@@ -34,10 +34,8 @@ jobs:
         with:
           bun-version: 1.3.5
 
-      - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+      - name: Setup MoonBit (pinned toolchain)
+        uses: ./.github/actions/setup-moon
 
       - name: Moon update
         run: moon update

.github/workflows/pages-demo.yml

@@ -56,10 +56,8 @@ jobs:
         with:
           bun-version: 1.3.5
 
-      - name: Install MoonBit CLI
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+      - name: Setup MoonBit (pinned toolchain)
+        uses: ./.github/actions/setup-moon
 
       - name: Moon update
         run: moon update

.github/workflows/release.yml

@@ -27,11 +27,9 @@ jobs:
         with:
           submodules: true
 
-      - name: Install MoonBit CLI (Unix)
+      - name: Setup MoonBit (pinned toolchain, Unix)
         if: runner.os != 'Windows'
-        run: |
-          curl -fsSL https://cli.moonbitlang.com/install/unix.sh | bash
-          echo "$HOME/.moon/bin" >> "$GITHUB_PATH"
+        uses: ./.github/actions/setup-moon
 
       - name: Install MoonBit CLI (Windows)
         if: runner.os == 'Windows'

modules/bit_io/src/native/upload_pack_process.mbt

@@ -1325,19 +1325,19 @@ fn write_partial_clone_metadata(
   let filter_value = filter.to_string()
   let config_path = @bit.join_path(git_dir, "config")
   let config =
-    #|[core]
-    #|	repositoryformatversion = 1
-    #|	filemode = true
-    #|	bare = false
-    #|	logallrefupdates = true
-    #|[extensions]
-    #|	partialclone = origin
+    $|[core]
+    $|	repositoryformatversion = 1
+    $|	filemode = true
+    $|	bare = false
+    $|	logallrefupdates = true
+    $|[extensions]
+    $|	partialclone = origin
     $|[remote "origin"]
     $|	url = \{remote}
-    #|	fetch = +refs/heads/*:refs/remotes/origin/*
-    #|	promisor = true
+    $|	fetch = +refs/heads/*:refs/remotes/origin/*
+    $|	promisor = true
     $|	partialclonefilter = \{filter_value}
-    #|
+    $|
   fs.write_string(config_path, config)
   let packed_refs_path = @bit.join_path(git_dir, "packed-refs")
   fs.write_string(packed_refs_path, "# pack-refs with: peeled fully-peeled\n")