fix(download): use staging + atomic rename in extract_archive_atomic

v1.0.6 serialised concurrent tar extractions via an mkdir-based lock,
but the polling loop's early-exit on \`[[ -x bin_path ]]\` observed the
file the moment tar created the inode with its archived perms — well
before tar finished writing it. The early-exiting process then went on
to \`exec\` the partially-written binary, surfacing as
\`Text file busy\` (ETXTBSY) in CI logs.

Replace the lock with the same pattern \`download_tool_from_archive\`
already uses: extract into a per-invocation staging dir on the same
filesystem, then atomically rename the top-level entry into place.
Parallel callers now see the binary as either fully-absent or
fully-present — never mid-write.

Author: Goldziher

CHANGELOG.md

@@ -30,8 +30,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `mkdir -p` + `tar -x` in the run script, which raced when prek dispatched
   the hook with `concurrency > 1` — multiple processes saw a missing
   `bin_path`, both ran `tar`, and the second one died with
-  `tar: <path>: Cannot open: File exists`. The shared helper serialises
-  extraction via an atomic mkdir-based lock.
+  `tar: <path>: Cannot open: File exists`. The shared helper publishes the
+  extracted tree via tar-to-staging + atomic `rename(2)`, so parallel callers
+  observe the binary as either fully-absent or fully-present — never the
+  in-progress mid-write state that surfaces as ETXTBSY on `exec`.
 
 ### Added
 

lib/download.sh

@@ -201,28 +201,49 @@ download_tool_from_archive() {
 }
 
 # extract_archive_atomic <archive_path> <extract_dir> <bin_path> <tar_flags...>
-# Extract an archive into ${extract_dir}, serializing concurrent callers via an
-# atomic mkdir-based lock so prek's parallel hook execution does not race on
-# overlapping `tar -x` calls (manifests as "tar: …: Cannot open: File exists"
-# when two procs touch the same files). Idempotent: returns immediately if the
-# expected binary is already present.
+# Extract an archive into ${extract_dir} concurrency-safely:
+#
+#   1. tar into a per-invocation staging dir under ${extract_dir} (so the
+#      eventual `mv` stays on the same filesystem and `rename(2)` is atomic).
+#   2. atomically `mv` the relevant subtree into place. If another concurrent
+#      caller beat us to it, the target already exists and we drop our staged
+#      copy. The published binary therefore goes from "doesn't exist" → "fully
+#      written" in a single rename, so `exec ${bin_path}` from a parallel
+#      caller cannot observe a partially-written file (no ETXTBSY).
+#
+# bin_path is expected to live one directory under extract_dir (most upstream
+# tarballs ship as `tool-vX/<binary>`); for archives that drop the binary
+# directly at the top level, pass extract_dir == dirname(bin_path) and the
+# helper still does the right thing.
 extract_archive_atomic() {
   local archive_path="$1" extract_dir="$2" bin_path="$3"
   shift 3
   if [[ -x "${bin_path}" ]]; then
     return 0
   fi
   mkdir -p "${extract_dir}"
-  local lock="${extract_dir}/.extract.lock"
-  while ! mkdir "${lock}" 2>/dev/null; do
-    if [[ -x "${bin_path}" ]]; then
-      return 0
-    fi
-    sleep 0.1
-  done
-  if [[ ! -x "${bin_path}" ]]; then
-    tar "$@" -f "${archive_path}" -C "${extract_dir}"
-    chmod +x "${bin_path}"
+  local stage
+  stage="$(mktemp -d "${extract_dir}/.stage.XXXXXX")"
+  tar "$@" -f "${archive_path}" -C "${stage}"
+  # Recompute bin_path within stage by swapping the extract_dir prefix. This
+  # works whether the archive ships a subdir wrapper or drops the binary at
+  # the top level.
+  local rel="${bin_path#"${extract_dir}/"}"
+  local staged_bin="${stage}/${rel}"
+  if [[ ! -e "${staged_bin}" ]]; then
+    rm -rf "${stage}"
+    printf 'extract_archive_atomic: expected %s inside archive %s, not found after extraction\n' \
+      "${rel}" "${archive_path}" >&2
+    return 1
+  fi
+  chmod 0755 "${staged_bin}"
+  # Compute the top-level entry inside stage that we need to promote into
+  # extract_dir. For a nested layout (`shellcheck-vX/shellcheck`), this is
+  # `shellcheck-vX`. For a flat layout (`kubeconform`), this is the binary
+  # itself. Either way `rename(2)` is atomic when the target doesn't exist.
+  local top="${rel%%/*}"
+  if [[ ! -e "${extract_dir}/${top}" ]]; then
+    mv "${stage}/${top}" "${extract_dir}/${top}" 2>/dev/null || true
   fi
-  rmdir "${lock}"
+  rm -rf "${stage}"
 }