···

       
49
       
 
       
          mergedSha: ${{ inputs.mergedSha }}

     

       
50
       
 
       
          merged-as-untrusted: true

     

       
51
       
 
       


     

       
52
       
-
       
      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
53
       
 
       
        with:

     

       
54
       
 
       
          extra_nix_config: sandbox = true

     

       
55
       
 
       


     

···

       
49
       
 
       
          mergedSha: ${{ inputs.mergedSha }}

     

       
50
       
 
       
          merged-as-untrusted: true

     

       
51
       
 
       


     

       
52
       
+
       
      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
53
       
 
       
        with:

     

       
54
       
 
       
          extra_nix_config: sandbox = true

     

       
55
       
 
       


     

···

       
59
       
 
       
          merged-as-untrusted: true

     

       
60
       
 
       
          target-as-trusted: true

     

       
61
       
 
       


     

       
62
       
-
       
      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
63
       
 
       


     

       
64
       
 
       
      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16

     

       
65
       
 
       
        with:

     
···

       
107
       
 
       
    name: Request

     

       
108
       
 
       
    runs-on: ubuntu-24.04-arm

     

       
109
       
 
       
    steps:

     

       
110
       
-
       
      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
111
       
 
       


     

       
112
       
 
       
      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.

     

       
113
       
 
       
      # This is intentional, because we need to request the review of owners as declared in the base branch.

     

···

       
59
       
 
       
          merged-as-untrusted: true

     

       
60
       
 
       
          target-as-trusted: true

     

       
61
       
 
       


     

       
62
       
+
       
      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
63
       
 
       


     

       
64
       
 
       
      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16

     

       
65
       
 
       
        with:

     
···

       
107
       
 
       
    name: Request

     

       
108
       
 
       
    runs-on: ubuntu-24.04-arm

     

       
109
       
 
       
    steps:

     

       
110
       
+
       
      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
111
       
 
       


     

       
112
       
 
       
      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.

     

       
113
       
 
       
      # This is intentional, because we need to request the review of owners as declared in the base branch.

     

···

       
46
       
 
       
          path: untrusted

     

       
47
       
 
       


     

       
48
       
 
       
      - name: Install Nix

     

       
49
       
-
       
        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
50
       
 
       
        with:

     

       
51
       
 
       
          extra_nix_config: sandbox = true

     

       
52
       
 
       


     
···

       
166
       
 
       
          path: trusted

     

       
167
       
 
       


     

       
168
       
 
       
      - name: Install Nix

     

       
169
       
-
       
        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
170
       
 
       
        with:

     

       
171
       
 
       
          extra_nix_config: sandbox = true

     

       
172
       
 
       


     
···

       
243
       
 
       
          merged-as-untrusted: true

     

       
244
       
 
       


     

       
245
       
 
       
      - name: Install Nix

     

       
246
       
-
       
        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
247
       
 
       
        with:

     

       
248
       
 
       
          extra_nix_config: sandbox = true

     

       
249
       
 
       


     

···

       
46
       
 
       
          path: untrusted

     

       
47
       
 
       


     

       
48
       
 
       
      - name: Install Nix

     

       
49
       
+
       
        uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
50
       
 
       
        with:

     

       
51
       
 
       
          extra_nix_config: sandbox = true

     

       
52
       
 
       


     
···

       
166
       
 
       
          path: trusted

     

       
167
       
 
       


     

       
168
       
 
       
      - name: Install Nix

     

       
169
       
+
       
        uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
170
       
 
       
        with:

     

       
171
       
 
       
          extra_nix_config: sandbox = true

     

       
172
       
 
       


     
···

       
243
       
 
       
          merged-as-untrusted: true

     

       
244
       
 
       


     

       
245
       
 
       
      - name: Install Nix

     

       
246
       
+
       
        uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
247
       
 
       
        with:

     

       
248
       
 
       
          extra_nix_config: sandbox = true

     

       
249
       
 
       


     

···

       
29
       
 
       
          mergedSha: ${{ inputs.mergedSha }}

     

       
30
       
 
       
          merged-as-untrusted: true

     

       
31
       
 
       


     

       
32
       
-
       
      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
33
       
 
       
        with:

     

       
34
       
 
       
          extra_nix_config: sandbox = true

     

       
35
       
 
       


     
···

       
61
       
 
       
          mergedSha: ${{ inputs.mergedSha }}

     

       
62
       
 
       
          merged-as-untrusted: true

     

       
63
       
 
       


     

       
64
       
-
       
      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
65
       
 
       
        with:

     

       
66
       
 
       
          extra_nix_config: sandbox = true

     

       
67
       
 
       


     
···

       
86
       
 
       
          targetSha: ${{ inputs.targetSha }}

     

       
87
       
 
       
          target-as-trusted: true

     

       
88
       
 
       


     

       
89
       
-
       
      - uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
90
       
 
       
        with:

     

       
91
       
 
       
          extra_nix_config: sandbox = true

     

       
92
       
 
       


     

···

       
29
       
 
       
          mergedSha: ${{ inputs.mergedSha }}

     

       
30
       
 
       
          merged-as-untrusted: true

     

       
31
       
 
       


     

       
32
       
+
       
      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
33
       
 
       
        with:

     

       
34
       
 
       
          extra_nix_config: sandbox = true

     

       
35
       
 
       


     
···

       
61
       
 
       
          mergedSha: ${{ inputs.mergedSha }}

     

       
62
       
 
       
          merged-as-untrusted: true

     

       
63
       
 
       


     

       
64
       
+
       
      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
65
       
 
       
        with:

     

       
66
       
 
       
          extra_nix_config: sandbox = true

     

       
67
       
 
       


     
···

       
86
       
 
       
          targetSha: ${{ inputs.targetSha }}

     

       
87
       
 
       
          target-as-trusted: true

     

       
88
       
 
       


     

       
89
       
+
       
      - uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
90
       
 
       
        with:

     

       
91
       
 
       
          extra_nix_config: sandbox = true

     

       
92
       
 
       


     

···

       
35
       
 
       
          sparse-checkout: ci

     

       
36
       
 
       


     

       
37
       
 
       
      - name: Install Nix

     

       
38
       
-
       
        uses: cachix/install-nix-action@17fe5fb4a23ad6cbbe47d6b3f359611ad276644c # v31

     

       
39
       
 
       
        with:

     

       
40
       
 
       
          extra_nix_config: sandbox = true

     

       
41
       
 
       


     

···

       
35
       
 
       
          sparse-checkout: ci

     

       
36
       
 
       


     

       
37
       
 
       
      - name: Install Nix

     

       
38
       
+
       
        uses: cachix/install-nix-action@f0fe604f8a612776892427721526b4c7cfb23aba # v31

     

       
39
       
 
       
        with:

     

       
40
       
 
       
          extra_nix_config: sandbox = true

     

       
41