sergio/takana

diff --git a/recipes/incoming/alterx.toml b/recipes/alterx.toml
similarity index 100%
rename from recipes/incoming/alterx.toml
rename to recipes/alterx.toml
diff --git a/recipes/incoming/asnmap.toml b/recipes/asnmap.toml
similarity index 100%
rename from recipes/incoming/asnmap.toml
rename to recipes/asnmap.toml
diff --git a/recipes/incoming/cdncheck.toml b/recipes/cdncheck.toml
similarity index 100%
rename from recipes/incoming/cdncheck.toml
rename to recipes/cdncheck.toml
diff --git a/recipes/incoming/cvemap.toml b/recipes/cvemap.toml
similarity index 100%
rename from recipes/incoming/cvemap.toml
rename to recipes/cvemap.toml
diff --git a/recipes/incoming/gospider.toml b/recipes/gospider.toml
similarity index 100%
rename from recipes/incoming/gospider.toml
rename to recipes/gospider.toml
diff --git a/recipes/incoming/gost.toml b/recipes/gost.toml
similarity index 100%
rename from recipes/incoming/gost.toml
rename to recipes/gost.toml
diff --git a/recipes/incoming/hakrawler.toml b/recipes/hakrawler.toml
similarity index 100%
rename from recipes/incoming/hakrawler.toml
rename to recipes/hakrawler.toml
diff --git a/recipes/incoming/k0sctl.toml b/recipes/k0sctl.toml
similarity index 100%
rename from recipes/incoming/k0sctl.toml
rename to recipes/k0sctl.toml
diff --git a/recipes/incoming/kiterunner.toml b/recipes/kiterunner.toml
similarity index 100%
rename from recipes/incoming/kiterunner.toml
rename to recipes/kiterunner.toml
diff --git a/recipes/incoming/lazyjournal.toml b/recipes/lazyjournal.toml
similarity index 100%
rename from recipes/incoming/lazyjournal.toml
rename to recipes/lazyjournal.toml
diff --git a/recipes/incoming/mapcidr.toml b/recipes/mapcidr.toml
similarity index 100%
rename from recipes/incoming/mapcidr.toml
rename to recipes/mapcidr.toml
diff --git a/recipes/incoming/meg.toml b/recipes/meg.toml
similarity index 100%
rename from recipes/incoming/meg.toml
rename to recipes/meg.toml
diff --git a/recipes/incoming/notify.toml b/recipes/notify.toml
similarity index 100%
rename from recipes/incoming/notify.toml
rename to recipes/notify.toml
diff --git a/recipes/incoming/open-policy-agent.toml b/recipes/open-policy-agent.toml
similarity index 100%
rename from recipes/incoming/open-policy-agent.toml
rename to recipes/open-policy-agent.toml
diff --git a/recipes/incoming/proxify.toml b/recipes/proxify.toml
similarity index 100%
rename from recipes/incoming/proxify.toml
rename to recipes/proxify.toml
diff --git a/recipes/ready/atlantis.toml b/recipes/ready/atlantis.toml
new file mode 100644
index 00000000..203f115d
--- /dev/null
+++ b/recipes/ready/atlantis.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "atlantis"
+version = "0.44.0"
+
+[source]
+repo   = "https://github.com/runatlantis/atlantis"
+commit = "v0.44.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/disable-race-tests.patch b/recipes/ready/disable-race-tests.patch
new file mode 100644
index 00000000..780f9f41
--- /dev/null
+++ b/recipes/ready/disable-race-tests.patch
@@ -0,0 +1,41 @@
+--- a/Makefile
++++ b/Makefile
+@@ -179,20 +179,20 @@
+ 	(cd web/; pnpm lint --quiet)
+ 
+ test-agent: ## Test agent code
+-	go test -race -cover -coverprofile agent-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/agent go.woodpecker-ci.org/woodpecker/v3/agent/...
++	go test  -cover -coverprofile agent-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/agent go.woodpecker-ci.org/woodpecker/v3/agent/...
+ 
+ test-server: ## Test server code
+-	go test -race -cover -coverprofile server-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/server $(shell go list go.woodpecker-ci.org/woodpecker/v3/server/... | grep -v '/store')
++	go test  -cover -coverprofile server-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/server $(shell go list go.woodpecker-ci.org/woodpecker/v3/server/... | grep -v '/store')
+ 
+ test-cli: ## Test cli code
+-	go test -race -cover -coverprofile cli-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/cli go.woodpecker-ci.org/woodpecker/v3/cli/...
++	go test  -cover -coverprofile cli-coverage.out -timeout 60s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/cmd/cli go.woodpecker-ci.org/woodpecker/v3/cli/...
+ 
+ test-server-datastore: ## Test server datastore
+ 	go test -timeout 300s -tags 'test $(TAGS)' -run TestMigrate go.woodpecker-ci.org/woodpecker/v3/server/store/...
+-	go test -race -timeout 120s -tags 'test $(TAGS)' -skip TestMigrate go.woodpecker-ci.org/woodpecker/v3/server/store/...
++	go test  -timeout 120s -tags 'test $(TAGS)' -skip TestMigrate go.woodpecker-ci.org/woodpecker/v3/server/store/...
+ 
+ test-server-datastore-coverage: ## Test server datastore with coverage report
+-	go test -race -cover -coverprofile datastore-coverage.out -timeout 300s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/server/store/...
++	go test  -cover -coverprofile datastore-coverage.out -timeout 300s -tags 'test $(TAGS)' go.woodpecker-ci.org/woodpecker/v3/server/store/...
+ 
+ test-ui: ui-dependencies ## Test UI code
+ 	(cd web/; pnpm run lint)
+@@ -201,10 +201,10 @@
+ 	(cd web/; pnpm run test)
+ 
+ test-lib: ## Test lib code
+-	go test -race -cover -coverprofile coverage.out -timeout 60s -tags 'test $(TAGS)' $(shell go list ./... | grep -v '/cmd\|/agent\|/cli\|/server')
++	go test  -cover -coverprofile coverage.out -timeout 60s -tags 'test $(TAGS)' $(shell go list ./... | grep -v '/cmd\|/agent\|/cli\|/server')
+ 
+ test-e2e: ## Test by running yaml config and compare expected result
+-	go test -race -cover -coverpkg=./... -coverprofile e2e-coverage.out -timeout 60s -tags 'test $(TAGS)' ./e2e/...
++	go test  -cover -coverpkg=./... -coverprofile e2e-coverage.out -timeout 60s -tags 'test $(TAGS)' ./e2e/...
+ 
+ .PHONY: test
+ test: test-agent test-server test-server-datastore test-cli test-lib test-e2e ## Run all tests
diff --git a/recipes/ready/disable-ui-openai-generation.patch b/recipes/ready/disable-ui-openai-generation.patch
new file mode 100644
index 00000000..de59b099
--- /dev/null
+++ b/recipes/ready/disable-ui-openai-generation.patch
@@ -0,0 +1,11 @@
+--- a/Makefile
++++ b/Makefile
+@@ -214,7 +214,7 @@
+ build-ui: ## Build UI
+ 	(cd web/; pnpm install --frozen-lockfile; pnpm build)
+ 
+-build-server: build-ui generate-openapi ## Build server
++build-server: ## Build server
+ 	CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-server${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/server
+ 
+ build-agent: ## Build agent
diff --git a/recipes/ready/driftctl.toml b/recipes/ready/driftctl.toml
new file mode 100644
index 00000000..bcbb2cc6
--- /dev/null
+++ b/recipes/ready/driftctl.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "driftctl"
+version = "0.40.0"
+
+[source]
+repo   = "https://github.com/snyk/driftctl"
+commit = "v0.40.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/gh.toml b/recipes/ready/gh.toml
new file mode 100644
index 00000000..13953d9a
--- /dev/null
+++ b/recipes/ready/gh.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "gh"
+version = "2.95.0"
+
+[source]
+repo   = "https://github.com/cli/cli"
+commit = "v2.95.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/hcl2json.toml b/recipes/ready/hcl2json.toml
new file mode 100644
index 00000000..fe8ed2c8
--- /dev/null
+++ b/recipes/ready/hcl2json.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "hcl2json"
+version = "0.6.9"
+
+[source]
+repo   = "https://github.com/tmccombs/hcl2json"
+commit = "v0.6.9"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/helm.toml b/recipes/ready/helm.toml
new file mode 100644
index 00000000..fa7626ad
--- /dev/null
+++ b/recipes/ready/helm.toml
@@ -0,0 +1,19 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "helm"
+version = "0.9.0"
+
+[source]
+repo   = "https://github.com/mtytel/helm"
+commit = "v0.9.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[deps]
+build = ["libx11", "libxcomposite", "libxcursor", "libxext", "libxinerama", "libxrender", "libxrandr", "freetype", "alsa-lib", "curl", "libjack2", "glu", "libglvnd", "lv2"]
diff --git a/recipes/ready/kube-bench.toml b/recipes/ready/kube-bench.toml
new file mode 100644
index 00000000..c425c1ce
--- /dev/null
+++ b/recipes/ready/kube-bench.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "kube-bench"
+version = "0.15.0"
+
+[source]
+repo   = "https://github.com/aquasecurity/kube-bench"
+commit = "v0.15.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/nova.toml b/recipes/ready/nova.toml
new file mode 100644
index 00000000..18e2280c
--- /dev/null
+++ b/recipes/ready/nova.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "nova"
+version = "3.12.0"
+
+[source]
+repo   = "https://github.com/FairwindsOps/nova"
+commit = "v3.12.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/opentofu.toml b/recipes/ready/opentofu.toml
new file mode 100644
index 00000000..604ac19b
--- /dev/null
+++ b/recipes/ready/opentofu.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "opentofu"
+version = "1.12.3"
+
+[source]
+repo   = "https://github.com/opentofu/opentofu"
+commit = "v1.12.3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/packer.toml b/recipes/ready/packer.toml
new file mode 100644
index 00000000..0defc13a
--- /dev/null
+++ b/recipes/ready/packer.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "packer"
+version = "1.15.4"
+
+[source]
+repo   = "https://github.com/hashicorp/packer"
+commit = "v1.15.4"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/pluto.toml b/recipes/ready/pluto.toml
new file mode 100644
index 00000000..b1ed7a91
--- /dev/null
+++ b/recipes/ready/pluto.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "pluto"
+version = "5.24.0"
+
+[source]
+repo   = "https://github.com/FairwindsOps/pluto"
+commit = "v5.24.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/rclone.toml b/recipes/ready/rclone.toml
new file mode 100644
index 00000000..a135517a
--- /dev/null
+++ b/recipes/ready/rclone.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "rclone"
+version = "1.74.3"
+
+[source]
+repo   = "https://github.com/rclone/rclone"
+commit = "v1.74.3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, fuse
+[deps]
+build = ["go"]
diff --git a/recipes/ready/respect-cgo-flags.patch b/recipes/ready/respect-cgo-flags.patch
new file mode 100644
index 00000000..e082639f
--- /dev/null
+++ b/recipes/ready/respect-cgo-flags.patch
@@ -0,0 +1,102 @@
+--- a/Makefile
++++ b/Makefile
+@@ -120,11 +120,11 @@
+ .PHONY: generate
+ generate: install-mockery generate-openapi ## Run all code generations
+ 	mockery
+-	CGO_ENABLED=0 go generate ./...
++	CGO_ENABLED=${CGO_ENABLED} go generate ./...
+ 
+ generate-openapi: ## Run openapi code generation and format it
+-	CGO_ENABLED=0 go run github.com/swaggo/swag/cmd/swag fmt --exclude rpc/proto
+-	CGO_ENABLED=0 go generate cmd/server/openapi.go
++	CGO_ENABLED=${CGO_ENABLED} go run github.com/swaggo/swag/cmd/swag fmt --exclude rpc/proto
++	CGO_ENABLED=${CGO_ENABLED} go generate cmd/server/openapi.go
+ 
+ generate-license-header: install-addlicense
+ 	addlicense -c "Woodpecker Authors" -l apache -ignore "vendor/**" -ignore cmd/server/openapi/docs.go **/*.go
+@@ -218,10 +218,10 @@
+ 	CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-server${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/server
+ 
+ build-agent: ## Build agent
+-	CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-agent${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-agent${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+ 
+ build-cli: ## Build cli
+-	CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-cli${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -tags '$(TAGS)' -ldflags '${LDFLAGS}' -o ${DIST_DIR}/woodpecker-cli${BIN_SUFFIX} go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+ 
+ build-tarball: ## Build tar archive
+ 	mkdir -p ${DIST_DIR} && tar chzvf ${DIST_DIR}/woodpecker-src.tar.gz \
+@@ -291,13 +291,13 @@
+ 
+ release-agent: ## Create agent binaries for release
+ 	# compile
+-	GOOS=linux   GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_amd64/woodpecker-agent       go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=linux   GOARCH=arm64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_arm64/woodpecker-agent       go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=linux   GOARCH=riscv64 CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_riscv64/woodpecker-agent     go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=linux   GOARCH=arm     CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_arm/woodpecker-agent         go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=windows GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/windows_amd64/woodpecker-agent.exe go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=darwin  GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/darwin_amd64/woodpecker-agent      go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+-	GOOS=darwin  GOARCH=arm64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/darwin_arm64/woodpecker-agent      go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=linux   GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_amd64/woodpecker-agent       go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=linux   GOARCH=arm64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_arm64/woodpecker-agent       go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=linux   GOARCH=riscv64 CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_riscv64/woodpecker-agent     go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=linux   GOARCH=arm     CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/linux_arm/woodpecker-agent         go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=windows GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/windows_amd64/woodpecker-agent.exe go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=darwin  GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/darwin_amd64/woodpecker-agent      go.woodpecker-ci.org/woodpecker/v3/cmd/agent
++	GOOS=darwin  GOARCH=arm64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -tags 'grpcnotrace $(TAGS)' -o ${DIST_DIR}/agent/darwin_arm64/woodpecker-agent      go.woodpecker-ci.org/woodpecker/v3/cmd/agent
+ 	# tar binary files
+ 	tar -cvzf ${DIST_DIR}/woodpecker-agent_linux_amd64.tar.gz   -C ${DIST_DIR}/agent/linux_amd64   woodpecker-agent
+ 	tar -cvzf ${DIST_DIR}/woodpecker-agent_linux_arm64.tar.gz   -C ${DIST_DIR}/agent/linux_arm64   woodpecker-agent
+@@ -311,13 +311,13 @@
+ 
+ release-cli: ## Create cli binaries for release
+ 	# compile
+-	GOOS=linux   GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_amd64/woodpecker-cli       go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=linux   GOARCH=arm64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_arm64/woodpecker-cli       go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=linux   GOARCH=riscv64 CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_riscv64/woodpecker-cli     go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=linux   GOARCH=arm     CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_arm/woodpecker-cli         go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=windows GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/windows_amd64/woodpecker-cli.exe go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=darwin  GOARCH=amd64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/darwin_amd64/woodpecker-cli      go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+-	GOOS=darwin  GOARCH=arm64   CGO_ENABLED=0 go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/darwin_arm64/woodpecker-cli      go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=linux   GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_amd64/woodpecker-cli       go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=linux   GOARCH=arm64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_arm64/woodpecker-cli       go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=linux   GOARCH=riscv64 CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_riscv64/woodpecker-cli     go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=linux   GOARCH=arm     CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/linux_arm/woodpecker-cli         go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=windows GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/windows_amd64/woodpecker-cli.exe go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=darwin  GOARCH=amd64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/darwin_amd64/woodpecker-cli      go.woodpecker-ci.org/woodpecker/v3/cmd/cli
++	GOOS=darwin  GOARCH=arm64   CGO_ENABLED=${CGO_ENABLED} go build -ldflags '${LDFLAGS}' -o ${DIST_DIR}/cli/darwin_arm64/woodpecker-cli      go.woodpecker-ci.org/woodpecker/v3/cmd/cli
+ 	# tar binary files
+ 	tar -cvzf ${DIST_DIR}/woodpecker-cli_linux_amd64.tar.gz   -C ${DIST_DIR}/cli/linux_amd64   woodpecker-cli
+ 	tar -cvzf ${DIST_DIR}/woodpecker-cli_linux_arm64.tar.gz   -C ${DIST_DIR}/cli/linux_arm64   woodpecker-cli
+@@ -369,8 +369,8 @@
+ 
+ .PHONY: generate-docs
+ generate-docs: ## Generate docs (currently only for the cli)
+-	CGO_ENABLED=0 go generate cmd/cli/app.go
+-	CGO_ENABLED=0 go generate cmd/server/openapi.go
++	CGO_ENABLED=${CGO_ENABLED} go generate cmd/cli/app.go
++	CGO_ENABLED=${CGO_ENABLED} go generate cmd/server/openapi.go
+ 
+ .PHONY: build-docs
+ build-docs: generate-docs docs-dependencies ## Build the docs
+@@ -379,15 +379,15 @@
+ ##@ Man Pages
+ .PHONY: man-cli
+ man-cli: ## Generate man pages for cli
+-	mkdir -p dist/ && CGO_ENABLED=0 go run -tags man cmd/cli/man.go cmd/cli/app.go > dist/woodpecker-cli.man.1 && gzip -9 -f dist/woodpecker-cli.man.1
++	mkdir -p dist/ && CGO_ENABLED=${CGO_ENABLED} go run -tags man cmd/cli/man.go cmd/cli/app.go > dist/woodpecker-cli.man.1 && gzip -9 -f dist/woodpecker-cli.man.1
+ 
+ .PHONY: man-agent
+ man-agent: ## Generate man pages for agent
+-	mkdir -p dist/ && CGO_ENABLED=0 go run -tags man cmd/agent/man.go > dist/woodpecker-agent.man.1 && gzip -9 -f dist/woodpecker-agent.man.1
++	mkdir -p dist/ && CGO_ENABLED=${CGO_ENABLED} go run -tags man cmd/agent/man.go > dist/woodpecker-agent.man.1 && gzip -9 -f dist/woodpecker-agent.man.1
+ 
+ .PHONY: man-server
+ man-server: ## Generate man pages for server
+-	mkdir -p dist/ && CGO_ENABLED=0 go run -tags man go.woodpecker-ci.org/woodpecker/v3/cmd/server > dist/woodpecker-server.man.1 && gzip -9 -f dist/woodpecker-server.man.1
++	mkdir -p dist/ && CGO_ENABLED=${CGO_ENABLED} go run -tags man go.woodpecker-ci.org/woodpecker/v3/cmd/server > dist/woodpecker-server.man.1 && gzip -9 -f dist/woodpecker-server.man.1
+ 
+ .PHONY: man
+ man: man-cli man-agent man-server ## Generate all man pages
diff --git a/recipes/ready/skip-alternate-unix-sh-test.patch b/recipes/ready/skip-alternate-unix-sh-test.patch
new file mode 100644
index 00000000..8e1b38a4
--- /dev/null
+++ b/recipes/ready/skip-alternate-unix-sh-test.patch
@@ -0,0 +1,428 @@
+--- a/pipeline/backend/local/local_test.go
++++ b/pipeline/backend/local/local_test.go
+@@ -19,14 +19,14 @@
+ import (
+ 	"context"
+ 	"fmt"
+-	"io"
++//	"io"
+ 	"os"
+-	"os/exec"
++//	"os/exec"
+ 	"path/filepath"
+ 	"runtime"
+-	"slices"
++//	"slices"
+ 	"strings"
+-	"sync"
++//	"sync"
+ 	"sync/atomic"
+ 	"testing"
+ 	"time"
+@@ -163,206 +163,206 @@
+ 		}
+ 	})
+ }
+-
+-func TestRunStep(t *testing.T) {
+-	if runtime.GOOS != "linux" {
+-		t.Skip("skipping on non linux due to shell availability and symlink capability")
+-	}
+-
+-	// we lookup shell tools we use first and create the PATH var based on that
+-	shBinary, err := exec.LookPath("sh")
+-	require.NoError(t, err)
+-	path := []string{filepath.Dir(shBinary)}
+-	echoBinary, err := exec.LookPath("echo")
+-	require.NoError(t, err)
+-	if echoPath := filepath.Dir(echoBinary); !slices.Contains(path, echoPath) {
+-		path = append(path, echoPath)
+-	}
+-	// we make a symlinc to have a posix but non default shell
+-	altShellDir := t.TempDir()
+-	altShellPath := filepath.Join(altShellDir, "altsh")
+-	require.NoError(t, os.Symlink(shBinary, altShellPath))
+-	path = append(path, altShellDir)
+-
+-	prepairEnv(t)
+-	//nolint:usetesting // reason: we use prepairEnv()
+-	os.Setenv("PATH", strings.Join(path, ":"))
+-
+-	backend, _ := New().(*local)
+-	backend.tempDir = t.TempDir()
+-	backend.isolatedHome = true
+-	ctx := t.Context()
+-	taskUUID := "test-run-tasks"
+-
+-	// Setup workflow
+-	require.NoError(t, backend.SetupWorkflow(ctx, &types.Config{}, taskUUID))
+-
+-	t.Run("type commands", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID:     "step-1",
+-			Name:     "test-step",
+-			Type:     types.StepTypeCommands,
+-			Image:    "sh",
+-			Commands: []string{"echo hello", "env"},
+-			Environment: map[string]string{
+-				"TEST_VAR": "test_value",
+-			},
+-		}
+-
+-		t.Run("start successful", func(t *testing.T) {
+-			err = backend.StartStep(ctx, step, taskUUID)
+-			require.NoError(t, err)
+-
+-			// Verify command was started
+-			state, err := backend.getWorkflowState(taskUUID)
+-			require.NoError(t, err)
+-			stepStateWraped, contains := state.stepState.Load(step.UUID)
+-			assert.True(t, contains)
+-			stepState, _ := stepStateWraped.(*stepState)
+-			assert.NotNil(t, stepState.cmd)
+-
+-			var outputData []byte
+-			outputDataMutex := sync.Mutex{}
+-			go t.Run("TailStep", func(t *testing.T) {
+-				outputDataMutex.Lock()
+-				go outputDataMutex.Unlock()
+-				output, err := backend.TailStep(ctx, step, taskUUID)
+-				require.NoError(t, err)
+-				assert.NotNil(t, output)
+-
+-				// Read output
+-				outputData, err = io.ReadAll(output)
+-				require.NoError(t, err)
+-			})
+-
+-			// Wait for step to finish
+-			t.Run("TestWaitStep", func(t *testing.T) {
+-				time.Sleep(time.Second / 5) // needed to prevent race condition on outputData
+-				state, err := backend.WaitStep(ctx, step, taskUUID)
+-				require.NoError(t, err)
+-				assert.True(t, state.Exited)
+-				assert.Equal(t, 0, state.ExitCode)
+-			})
+-
+-			// Verify output
+-			outputDataMutex.Lock()
+-			go outputDataMutex.Unlock()
+-			outputLines := strings.Split(strings.TrimSpace(string(outputData)), "\n")
+-			require.Truef(t, len(outputLines) > 3, "output of lines must be bigger than 3 at least but we got: %#v", outputLines)
+-			// we first test output without environments
+-			wantBeforeEnvs := []string{
+-				"+ echo hello",
+-				"hello",
+-				"+ env",
+-			}
+-			gotBeforeEnvs := outputLines[:len(wantBeforeEnvs)]
+-			assert.Equal(t, wantBeforeEnvs, gotBeforeEnvs)
+-			// we filter out nixos specific stuff catched up in env output
+-			gotEnvs := slices.DeleteFunc(outputLines[len(wantBeforeEnvs):], func(s string) bool {
+-				return strings.HasPrefix(s, "_=") || strings.HasPrefix(s, "SHLVL=")
+-			})
+-			assert.ElementsMatch(t, []string{
+-				"PWD=" + state.baseDir + "/workspace",
+-				"USERPROFILE=" + state.baseDir + "/home",
+-				"TEST_VAR=test_value",
+-				"HOME=" + state.baseDir + "/home",
+-				"CI_WORKSPACE=" + state.baseDir + "/workspace",
+-				"PATH=" + strings.Join(path, ":"),
+-			}, gotEnvs)
+-
+-			t.Run("TestDestroyStep", func(t *testing.T) {
+-				err := backend.DestroyStep(ctx, step, taskUUID)
+-				require.NoError(t, err)
+-			})
+-		})
+-	})
+-
+-	t.Run("run command in alternate unix shell", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID:     "step-altshell",
+-			Name:     "altshell",
+-			Type:     types.StepTypeCommands,
+-			Image:    "altsh",
+-			Commands: []string{"echo success"},
+-		}
+-
+-		err = backend.StartStep(ctx, step, taskUUID)
+-		require.NoError(t, err)
+-
+-		state, err := backend.WaitStep(ctx, step, taskUUID)
+-		require.NoError(t, err)
+-		assert.True(t, state.Exited)
+-		assert.Equal(t, 0, state.ExitCode)
+-	})
+-
+-	t.Run("command should fail", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID:     "step-fail",
+-			Name:     "fail-step",
+-			Type:     types.StepTypeCommands,
+-			Image:    "sh",
+-			Commands: []string{"exit 1"},
+-		}
+-
+-		err = backend.StartStep(ctx, step, taskUUID)
+-		require.NoError(t, err)
+-
+-		state, err := backend.WaitStep(ctx, step, taskUUID)
+-		require.NoError(t, err)
+-		assert.True(t, state.Exited)
+-		assert.Equal(t, 1, state.ExitCode)
+-	})
+-
+-	t.Run("WaitStep", func(t *testing.T) {
+-		t.Run("step not found", func(t *testing.T) {
+-			step := &types.Step{
+-				UUID: "nonexistent-step",
+-				Name: "missing",
+-			}
+-
+-			_, err = backend.WaitStep(ctx, step, taskUUID)
+-			assert.Error(t, err)
+-			assert.Contains(t, err.Error(), "not found")
+-		})
+-	})
+-
+-	t.Run("type plugin", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID:        "step-plugin-1",
+-			Name:        "test-plugin",
+-			Type:        types.StepTypePlugin,
+-			Image:       "echo", // Use a binary that exists
+-			Environment: map[string]string{},
+-		}
+-
+-		t.Run("start", func(t *testing.T) {
+-			err = backend.StartStep(ctx, step, taskUUID)
+-			require.NoError(t, err)
+-
+-			// Verify command was started
+-			state, err := backend.getStepState(taskUUID, step.UUID)
+-			require.NoError(t, err)
+-			assert.NotEqualf(t, 0, state.cmd.Process.Pid, "expect an pid of the process")
+-		})
+-	})
+-
+-	t.Run("type unsupported", func(t *testing.T) {
+-		step := &types.Step{
+-			UUID: "step-unsupported",
+-			Name: "test-unsupported",
+-			Type: "unsupported-type",
+-		}
+-
+-		t.Run("start", func(t *testing.T) {
+-			err = backend.StartStep(ctx, step, taskUUID)
+-			assert.ErrorIs(t, err, ErrUnsupportedStepType)
+-		})
+-	})
+-
+-	// Cleanup
+-	assert.NoError(t, backend.DestroyWorkflow(ctx, &types.Config{}, taskUUID))
+-}
+-
++//
++//func TestRunStep(t *testing.T) {
++//	if runtime.GOOS != "linux" {
++//		t.Skip("skipping on non linux due to shell availability and symlink capability")
++//	}
++//
++//	// we lookup shell tools we use first and create the PATH var based on that
++//	shBinary, err := exec.LookPath("sh")
++//	require.NoError(t, err)
++//	path := []string{filepath.Dir(shBinary)}
++//	echoBinary, err := exec.LookPath("echo")
++//	require.NoError(t, err)
++//	if echoPath := filepath.Dir(echoBinary); !slices.Contains(path, echoPath) {
++//		path = append(path, echoPath)
++//	}
++//	// we make a symlinc to have a posix but non default shell
++//	altShellDir := t.TempDir()
++//	altShellPath := filepath.Join(altShellDir, "altsh")
++//	require.NoError(t, os.Symlink(shBinary, altShellPath))
++//	path = append(path, altShellDir)
++//
++//	prepairEnv(t)
++//	//nolint:usetesting // reason: we use prepairEnv()
++//	os.Setenv("PATH", strings.Join(path, ":"))
++//
++//	backend, _ := New().(*local)
++//	backend.tempDir = t.TempDir()
++//	backend.isolatedHome = true
++//	ctx := t.Context()
++//	taskUUID := "test-run-tasks"
++//
++//	// Setup workflow
++//	require.NoError(t, backend.SetupWorkflow(ctx, &types.Config{}, taskUUID))
++//
++//	t.Run("type commands", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID:     "step-1",
++//			Name:     "test-step",
++//			Type:     types.StepTypeCommands,
++//			Image:    "sh",
++//			Commands: []string{"echo hello", "env"},
++//			Environment: map[string]string{
++//				"TEST_VAR": "test_value",
++//			},
++//		}
++//
++//		t.Run("start successful", func(t *testing.T) {
++//			err = backend.StartStep(ctx, step, taskUUID)
++//			require.NoError(t, err)
++//
++//			// Verify command was started
++//			state, err := backend.getWorkflowState(taskUUID)
++//			require.NoError(t, err)
++//			stepStateWraped, contains := state.stepState.Load(step.UUID)
++//			assert.True(t, contains)
++//			stepState, _ := stepStateWraped.(*stepState)
++//			assert.NotNil(t, stepState.cmd)
++//
++//			var outputData []byte
++//			outputDataMutex := sync.Mutex{}
++//			go t.Run("TailStep", func(t *testing.T) {
++//				outputDataMutex.Lock()
++//				go outputDataMutex.Unlock()
++//				output, err := backend.TailStep(ctx, step, taskUUID)
++//				require.NoError(t, err)
++//				assert.NotNil(t, output)
++//
++//				// Read output
++//				outputData, err = io.ReadAll(output)
++//				require.NoError(t, err)
++//			})
++//
++//			// Wait for step to finish
++//			t.Run("TestWaitStep", func(t *testing.T) {
++//				time.Sleep(time.Second / 5) // needed to prevent race condition on outputData
++//				state, err := backend.WaitStep(ctx, step, taskUUID)
++//				require.NoError(t, err)
++//				assert.True(t, state.Exited)
++//				assert.Equal(t, 0, state.ExitCode)
++//			})
++//
++//			// Verify output
++//			outputDataMutex.Lock()
++//			go outputDataMutex.Unlock()
++//			outputLines := strings.Split(strings.TrimSpace(string(outputData)), "\n")
++//			require.Truef(t, len(outputLines) > 3, "output of lines must be bigger than 3 at least but we got: %#v", outputLines)
++//			// we first test output without environments
++//			wantBeforeEnvs := []string{
++//				"+ echo hello",
++//				"hello",
++//				"+ env",
++//			}
++//			gotBeforeEnvs := outputLines[:len(wantBeforeEnvs)]
++//			assert.Equal(t, wantBeforeEnvs, gotBeforeEnvs)
++//			// we filter out nixos specific stuff catched up in env output
++//			gotEnvs := slices.DeleteFunc(outputLines[len(wantBeforeEnvs):], func(s string) bool {
++//				return strings.HasPrefix(s, "_=") || strings.HasPrefix(s, "SHLVL=")
++//			})
++//			assert.ElementsMatch(t, []string{
++//				"PWD=" + state.baseDir + "/workspace",
++//				"USERPROFILE=" + state.baseDir + "/home",
++//				"TEST_VAR=test_value",
++//				"HOME=" + state.baseDir + "/home",
++//				"CI_WORKSPACE=" + state.baseDir + "/workspace",
++//				"PATH=" + strings.Join(path, ":"),
++//			}, gotEnvs)
++//
++//			t.Run("TestDestroyStep", func(t *testing.T) {
++//				err := backend.DestroyStep(ctx, step, taskUUID)
++//				require.NoError(t, err)
++//			})
++//		})
++//	})
++//
++//	t.Run("run command in alternate unix shell", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID:     "step-altshell",
++//			Name:     "altshell",
++//			Type:     types.StepTypeCommands,
++//			Image:    "altsh",
++//			Commands: []string{"echo success"},
++//		}
++//
++//		err = backend.StartStep(ctx, step, taskUUID)
++//		require.NoError(t, err)
++//
++//		state, err := backend.WaitStep(ctx, step, taskUUID)
++//		require.NoError(t, err)
++//		assert.True(t, state.Exited)
++//		assert.Equal(t, 0, state.ExitCode)
++//	})
++//
++//	t.Run("command should fail", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID:     "step-fail",
++//			Name:     "fail-step",
++//			Type:     types.StepTypeCommands,
++//			Image:    "sh",
++//			Commands: []string{"exit 1"},
++//		}
++//
++//		err = backend.StartStep(ctx, step, taskUUID)
++//		require.NoError(t, err)
++//
++//		state, err := backend.WaitStep(ctx, step, taskUUID)
++//		require.NoError(t, err)
++//		assert.True(t, state.Exited)
++//		assert.Equal(t, 1, state.ExitCode)
++//	})
++//
++//	t.Run("WaitStep", func(t *testing.T) {
++//		t.Run("step not found", func(t *testing.T) {
++//			step := &types.Step{
++//				UUID: "nonexistent-step",
++//				Name: "missing",
++//			}
++//
++//			_, err = backend.WaitStep(ctx, step, taskUUID)
++//			assert.Error(t, err)
++//			assert.Contains(t, err.Error(), "not found")
++//		})
++//	})
++//
++//	t.Run("type plugin", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID:        "step-plugin-1",
++//			Name:        "test-plugin",
++//			Type:        types.StepTypePlugin,
++//			Image:       "echo", // Use a binary that exists
++//			Environment: map[string]string{},
++//		}
++//
++//		t.Run("start", func(t *testing.T) {
++//			err = backend.StartStep(ctx, step, taskUUID)
++//			require.NoError(t, err)
++//
++//			// Verify command was started
++//			state, err := backend.getStepState(taskUUID, step.UUID)
++//			require.NoError(t, err)
++//			assert.NotEqualf(t, 0, state.cmd.Process.Pid, "expect an pid of the process")
++//		})
++//	})
++//
++//	t.Run("type unsupported", func(t *testing.T) {
++//		step := &types.Step{
++//			UUID: "step-unsupported",
++//			Name: "test-unsupported",
++//			Type: "unsupported-type",
++//		}
++//
++//		t.Run("start", func(t *testing.T) {
++//			err = backend.StartStep(ctx, step, taskUUID)
++//			assert.ErrorIs(t, err, ErrUnsupportedStepType)
++//		})
++//	})
++//
++//	// Cleanup
++//	assert.NoError(t, backend.DestroyWorkflow(ctx, &types.Config{}, taskUUID))
++//}
++//
+ func TestStateManagement(t *testing.T) {
+ 	backend, _ := New().(*local)
+ 
diff --git a/recipes/ready/sonobuoy.toml b/recipes/ready/sonobuoy.toml
new file mode 100644
index 00000000..85cc5d10
--- /dev/null
+++ b/recipes/ready/sonobuoy.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "sonobuoy"
+version = "0.57.3"
+
+[source]
+repo   = "https://github.com/vmware-tanzu/sonobuoy"
+commit = "v0.57.3"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/syncthing.toml b/recipes/ready/syncthing.toml
new file mode 100644
index 00000000..7056e35b
--- /dev/null
+++ b/recipes/ready/syncthing.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "syncthing"
+version = "2.1.0"
+
+[source]
+repo   = "https://github.com/syncthing/syncthing"
+commit = "v2.1.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/tenv.toml b/recipes/ready/tenv.toml
new file mode 100644
index 00000000..fa65b905
--- /dev/null
+++ b/recipes/ready/tenv.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "tenv"
+version = "4.14.8"
+
+[source]
+repo   = "https://github.com/tofuutils/tenv"
+commit = "v4.14.8"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/terraform-ls.toml b/recipes/ready/terraform-ls.toml
new file mode 100644
index 00000000..0d10277c
--- /dev/null
+++ b/recipes/ready/terraform-ls.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "terraform-ls"
+version = "0.38.7"
+
+[source]
+repo   = "https://github.com/hashicorp/terraform-ls"
+commit = "v0.38.7"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/terragrunt.toml b/recipes/ready/terragrunt.toml
new file mode 100644
index 00000000..75ff5026
--- /dev/null
+++ b/recipes/ready/terragrunt.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "terragrunt"
+version = "1.0.4"
+
+[source]
+repo   = "https://github.com/gruntwork-io/terragrunt"
+commit = "v1.0.4"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, mockgen
+[deps]
+build = ["go"]
diff --git a/recipes/ready/terramate.toml b/recipes/ready/terramate.toml
new file mode 100644
index 00000000..065ed1d1
--- /dev/null
+++ b/recipes/ready/terramate.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "terramate"
+version = "0.17.1"
+
+[source]
+repo   = "https://github.com/terramate-io/terramate"
+commit = "v0.17.1"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go, git
+[deps]
+build = ["go"]
diff --git a/recipes/ready/tfswitch.toml b/recipes/ready/tfswitch.toml
new file mode 100644
index 00000000..69fa1b54
--- /dev/null
+++ b/recipes/ready/tfswitch.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "tfswitch"
+version = "1.19.0"
+
+[source]
+repo   = "https://github.com/warrensbox/terraform-switcher"
+commit = "v1.19.0"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/ready/tfupdate.toml b/recipes/ready/tfupdate.toml
new file mode 100644
index 00000000..6cdfd83b
--- /dev/null
+++ b/recipes/ready/tfupdate.toml
@@ -0,0 +1,20 @@
+# Importada de nixpkgs por `hammer import-nix` (Etapa G). PUNTO DE PARTIDA, no final:
+# - el build usa el lab de hammer (zig-cc / musl estático), NO el stdenv de nix ⇒ revisá
+#   compiler/link/phases y adaptá hasta que compile.
+# - las deps van con su nombre NIX; remapealas a las recetas del corpus si difieren.
+name    = "tfupdate"
+version = "0.9.4"
+
+[source]
+repo   = "https://github.com/minamijoyo/tfupdate"
+commit = "v0.9.4"
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+# buildInputs de nix (no usados con CGO off): go
+[deps]
+build = ["go"]
diff --git a/recipes/incoming/scaleway-cli.toml b/recipes/scaleway-cli.toml
similarity index 100%
rename from recipes/incoming/scaleway-cli.toml
rename to recipes/scaleway-cli.toml
diff --git a/recipes/incoming/subjs.toml b/recipes/subjs.toml
similarity index 100%
rename from recipes/incoming/subjs.toml
rename to recipes/subjs.toml
diff --git a/recipes/incoming/tlsx.toml b/recipes/tlsx.toml
similarity index 100%
rename from recipes/incoming/tlsx.toml
rename to recipes/tlsx.toml
diff --git a/recipes/incoming/uncover.toml b/recipes/uncover.toml
similarity index 100%
rename from recipes/incoming/uncover.toml
rename to recipes/uncover.toml
diff --git a/tandas/fuel-go-12.txt b/tandas/fuel-go-12.txt
new file mode 100644
index 00000000..9f739b26
--- /dev/null
+++ b/tandas/fuel-go-12.txt
@@ -0,0 +1,23 @@
+# fuel-go-12 — ronda 12 (terraform/infra/k8s-security).
+atlantis
+chaos-client
+driftctl
+falco
+gh
+hcl2json
+helm
+kube-bench
+kubescape
+nova
+opentofu
+packer
+pluto
+rclone
+sonobuoy
+syncthing
+tenv
+terraform-ls
+terragrunt
+terramate
+tfswitch
+tfupdate