opam update fails on macos

[JasonGross]

<><> Updating package repositories ><><><><><><><><><><><><><><><><><><><><> 🐫
[default] synchronised from git+https://github.com/ocaml/opam-repository.git
[ERROR] Could not update repository "default": OpamSystem.Internal_patch_error("Patch "in directory /Users/runner/.opam/repo/default" does not apply cleanly.")

https://github.com/mit-plv/fiat-crypto/actions/runs/28913346684/job/85775113022?pr=2357

[smorimoto]

I investigated the linked run and this appears to be an opam repository-update issue rather than a corrupt setup-ocaml cache.

In both macOS jobs (macOS 14 arm64 and macOS 15 x86_64), the sequence was:

1. setup-ocaml restored a separate, architecture-specific cache;
2. setup-ocaml ran opam update, which completed successfully;
3. roughly a minute later, the workflow ran opam update again;
4. that second update failed with OpamSystem.Internal_patch_error.

There were no new opam-repository commits between the two updates. The local repository therefore appears not to have matched the fetched Git ref after the first update, despite that update reporting success. The second update detected the remaining difference and failed whilst applying the generated patch. Local package pinning should not modify the default repository, so it is unlikely to be the direct cause.

This is consistent with ocaml/opam#6937. opam 2.5.1 generates a Git diff and applies it using its internal patch implementation; rename/copy-related diff output, which can also be affected by global or system Git configuration, is not handled reliably. The proposed opam fix is ocaml/opam#6992, which makes Git invocations deterministic by ignoring global and system Git configuration. The corresponding patch-library work is hannesm/patch#44. Both remain open at present, and the opam 2.5.2 changelog does not include this fix.

The immediate workaround in the affected workflow is to remove the redundant opam update: setup-ocaml already updates the repositories after restoring the cache. Other possible mitigations are to run opam with GIT_CONFIG_GLOBAL=/dev/null and GIT_CONFIG_SYSTEM=/dev/null, or to change cache-prefix to invalidate the old repository snapshot. The latter may clear the current failure, but it does not address the underlying opam bug.