these 2 derivations will be built:
  /nix/store/3zxvrfm1wxggk5m3k0pf4mr5sqp98sff-ironstar-effect-run-context.drv
  /nix/store/kiizgcs0apa31v0281yddiqa5r79ag0r-effect-run-context-check.drv
this path will be fetched (0.0 KiB download, 7.5 MiB unpacked):
  /nix/store/r83d7wxqa7h3jjiflsn83h3f621jm3ga-ShellCheck-0.11.0
building '/nix/store/3zxvrfm1wxggk5m3k0pf4mr5sqp98sff-ironstar-effect-run-context.drv'
ironstar-effect-run-context> structuredAttrs is enabled
building '/nix/store/kiizgcs0apa31v0281yddiqa5r79ag0r-effect-run-context-check.drv'
effect-run-context-check> case 1: no id token, push to the default branch
effect-run-context-check>     IRONSTAR_RUN_CONTEXT_SOURCE=branch-name
effect-run-context-check>     IRONSTAR_EVENT=push
effect-run-context-check>     IRONSTAR_PR_NUMBER=''
effect-run-context-check>     IRONSTAR_IS_PRODUCTION=true
effect-run-context-check>     IRONSTAR_BRANCH=main
effect-run-context-check>     IRONSTAR_PREVIEW_SLUG=main
effect-run-context-check>   ok   source = branch-name
effect-run-context-check>   ok   event = push
effect-run-context-check>   ok   production = true
effect-run-context-check>   ok   slug = main
effect-run-context-check> case 2: no id token, pull request as the current service reports it
effect-run-context-check>     IRONSTAR_RUN_CONTEXT_SOURCE=branch-name
effect-run-context-check>     IRONSTAR_EVENT=pull_request
effect-run-context-check>     IRONSTAR_PR_NUMBER=42
effect-run-context-check>     IRONSTAR_IS_PRODUCTION=false
effect-run-context-check>     IRONSTAR_BRANCH=refs/pull/42/merge
effect-run-context-check>     IRONSTAR_PREVIEW_SLUG=refs/pull/42/merge
effect-run-context-check>   ok   source = branch-name
effect-run-context-check>   ok   event = pull_request
effect-run-context-check>   ok   pr-number = 42
effect-run-context-check>   ok   production = false
effect-run-context-check>   ok   slug = refs/pull/42/merge
effect-run-context-check> case 3: no id token, tag push (no branch)
effect-run-context-check>     IRONSTAR_RUN_CONTEXT_SOURCE=branch-name
effect-run-context-check>     IRONSTAR_EVENT=push
effect-run-context-check>     IRONSTAR_PR_NUMBER=''
effect-run-context-check>     IRONSTAR_IS_PRODUCTION=false
effect-run-context-check>     IRONSTAR_BRANCH=''
effect-run-context-check>     IRONSTAR_PREVIEW_SLUG=abc1234
effect-run-context-check>   ok   event = push
effect-run-context-check>   ok   production = false
effect-run-context-check>   ok   slug = abc1234
effect-run-context-check> case 4: id token, push to the default branch
effect-run-context-check>     IRONSTAR_RUN_CONTEXT_SOURCE=id-token
effect-run-context-check>     IRONSTAR_EVENT=push
effect-run-context-check>     IRONSTAR_PR_NUMBER=''
effect-run-context-check>     IRONSTAR_IS_PRODUCTION=true
effect-run-context-check>     IRONSTAR_BRANCH=main
effect-run-context-check>     IRONSTAR_PREVIEW_SLUG=main
effect-run-context-check>   ok   source = id-token
effect-run-context-check>   ok   event = push
effect-run-context-check>   ok   production = true
effect-run-context-check>   ok   branch = main
effect-run-context-check>   ok   slug = main
effect-run-context-check> case 5: id token, pull request targeting the default branch
effect-run-context-check>         (the eval-time branch is 'main' here: that is the defect)
effect-run-context-check>     IRONSTAR_RUN_CONTEXT_SOURCE=id-token
effect-run-context-check>     IRONSTAR_EVENT=pull_request
effect-run-context-check>     IRONSTAR_PR_NUMBER=42
effect-run-context-check>     IRONSTAR_IS_PRODUCTION=false
effect-run-context-check>     IRONSTAR_BRANCH=''
effect-run-context-check>     IRONSTAR_PREVIEW_SLUG=pr-42
effect-run-context-check>   ok   source = id-token
effect-run-context-check>   ok   event = pull_request
effect-run-context-check>   ok   pr-number = 42
effect-run-context-check>   ok   production = false
effect-run-context-check>   ok   branch = 
effect-run-context-check>   ok   slug = pr-42
effect-run-context-check> case 6: id token, push to a non-default branch
effect-run-context-check>     IRONSTAR_RUN_CONTEXT_SOURCE=id-token
effect-run-context-check>     IRONSTAR_EVENT=push
effect-run-context-check>     IRONSTAR_PR_NUMBER=''
effect-run-context-check>     IRONSTAR_IS_PRODUCTION=false
effect-run-context-check>     IRONSTAR_BRANCH=topic
effect-run-context-check>     IRONSTAR_PREVIEW_SLUG=topic
effect-run-context-check>   ok   event = push
effect-run-context-check>   ok   production = false
effect-run-context-check>   ok   slug = topic
effect-run-context-check> case 7: id token, scheduled run (no ref claim)
effect-run-context-check>     IRONSTAR_RUN_CONTEXT_SOURCE=id-token
effect-run-context-check>     IRONSTAR_EVENT=schedule
effect-run-context-check>     IRONSTAR_PR_NUMBER=''
effect-run-context-check>     IRONSTAR_IS_PRODUCTION=false
effect-run-context-check>     IRONSTAR_BRANCH=''
effect-run-context-check>     IRONSTAR_PREVIEW_SLUG=main
effect-run-context-check>   ok   event = schedule
effect-run-context-check>   ok   production = false
effect-run-context-check> case 8: id token requested but refused: fail closed, never fall back
effect-run-context-check> curl: (22) The requested URL returned error: 401
effect-run-context-check> ----------------------------------------
effect-run-context-check> Exception occurred during processing of request from ('127.0.0.1', 51406)
effect-run-context-check> run-context: id-token request to http://127.0.0.1:45529/api/v1/id-token failed
effect-run-context-check>   ok   refused token request aborted the effect

upload niks3: ok