fix(download): stage+rename archive extracts to avoid ETXTBSY races

Concurrent prek invocations of the same hook (oxlint, shellcheck, hadolint,
etc.) used to share a single extraction target inside the cache dir. While
one wrapper was still writing the binary via tar -xzf, another's exec on the
same path returned 'Text file busy' (ETXTBSY) and the hook failed with
exit 126 on aarch64 CI runners.

Extract into mktemp -d staging instead, chmod there, and atomic-rename the
single binary into bin_path. The rename is a directory-entry swap, so any
process mid-exec on the old inode is unaffected and no writer ever holds
bin_path open.

Author: Goldziher

CHANGELOG.md

@@ -17,6 +17,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   matching files across parallel `uv run mypy` invocations. The parallel mode
   raced on the local-package install/build step and surfaced as
   `INTERNAL ERROR -- Please try using mypy master on GitHub` in CI.
+- `download_tool_from_archive`: extract archives to a per-invocation staging
+  directory and atomically rename the binary into place. Direct extraction
+  into the cache directory let concurrent prek invocations of the same hook
+  race on the binary, surfacing as `Text file busy` (ETXTBSY) when one
+  wrapper tried to exec a partially-written file. Affects every archive-based
+  hook (oxlint, shellcheck, hadolint, golangci-lint, kubeconform, helm-lint,
+  air-format/check, etc.).
 
 ### Added
 

lib/download.sh

@@ -167,23 +167,35 @@ download_tool_from_archive() {
     return 1
   fi
 
-  # Extract the named binary from the archive.
+  # Extract to a per-invocation staging dir so the bin_path is published via
+  # atomic rename. Concurrent invocations of the same hook (e.g. when prek
+  # splits files across parallel processes) used to race on the extracted
+  # binary and surface as ETXTBSY ("Text file busy") when one wrapper tried
+  # to exec a partially-written file. Staging + rename eliminates the race.
+  local stage
+  stage="$(mktemp -d "${dest_dir}/.stage.XXXXXX")"
   case "${asset_name}" in
   *.tar.gz | *.tgz)
-    tar -xzf "${tmp}" -C "${dest_dir}" "${binary_in_archive}"
+    tar -xzf "${tmp}" -C "${stage}" "${binary_in_archive}"
     ;;
   *.zip)
-    unzip -q -o "${tmp}" "${binary_in_archive}" -d "${dest_dir}"
+    unzip -q -o "${tmp}" "${binary_in_archive}" -d "${stage}"
     ;;
   *)
+    rm -rf "${stage}"
     rm -f "${tmp}"
     printf 'unsupported archive format for %s (expected .tar.gz/.tgz/.zip)\n' "${asset_name}" >&2
     return 1
     ;;
   esac
 
   rm -f "${tmp}"
-  chmod 0755 "${bin_path}"
+  chmod 0755 "${stage}/${binary_in_archive}"
+  # Atomic publish. If a concurrent process beat us to it, the rename still
+  # succeeds (overwriting an identical, fully-written file) — bin_path keeps
+  # the same inode contents either way.
+  mv "${stage}/${binary_in_archive}" "${bin_path}"
+  rm -rf "${stage}"
   : >"${sentinel}"
   printf '%s\n' "${bin_path}"
 }