also, it's a good idea to disable zinc in CI:

--no-compile-zinc-incremental

. pants already never writes a zinc incremental compile to the cache (local or remote), because those definitely can't be trusted