commit 40d8532c08ffe8ed998b6964a2a900b756907a4f · pyrox.dev/nixpkgs

+6 -19

.github/workflows/check.yml

···

       31
       31
        
           shell: bash

     

       32
       32
        
       

     

       33
       33
        
       jobs:

     

       34
       34
       -
         no-channel-base:

     

       35
       35
       -
           name: no channel base

     

       36
       36
       -
           if: contains(fromJSON(inputs.baseBranch).type, 'channel')

     

       37
       37
       -
           runs-on: ubuntu-24.04-arm

     

       38
       38
       -
           steps:

     

       39
       39
       -
             - run: |

     

       40
       40
       -
                 cat <<EOF

     

       41
       41
       -
                 The nixos-* and nixpkgs-* branches are pushed to by the channel

     

       42
       42
       -
                 release script and should not be merged into directly.

     

       43
       43
       -
       

     

       44
       44
       -
                 Please target the equivalent release-* branch or master instead.

     

       45
       45
       -
                 EOF

     

       46
       46
       -
                 exit 1

     

       47
       47
       -
       

     

       48
       48
       -
         cherry-pick:

     

       49
       49
       -
           if: |

     

       50
       50
       -
             github.event_name == 'pull_request' ||

     

       51
       51
       -
             (fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development'))

     

       34
       34
       +
         commits:

     

       52
       35
        
           permissions:

     

       53
       36
        
             pull-requests: write

     

       54
       37
        
           runs-on: ubuntu-24.04-arm

     
···

       68
       51
        
                 GH_TOKEN: ${{ github.token }}

     

       69
       52
        
               run: gh api /rate_limit | jq

     

       70
       53
        
       

     

       71
       71
       -
             - name: Check cherry-picks

     

       54
       54
       +
             - name: Check commits

     

       72
       55
        
               id: check

     

       73
       56
        
               uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

     

       57
       57
       +
               env:

     

       58
       58
       +
                 TARGETS_STABLE: ${{ fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development') }}

     

       74
       59
        
               with:

     

       75
       60
        
                 script: |

     

       61
       61
       +
                   const targetsStable = JSON.parse(process.env.TARGETS_STABLE)

     

       76
       62
        
                   require('./trusted/ci/github-script/commits.js')({

     

       77
       63
        
                     github,

     

       78
       64
        
                     context,

     

       79
       65
        
                     core,

     

       80
       66
        
                     dry: context.eventName == 'pull_request',

     

       67
       67
       +
                     cherryPicks: context.eventName == 'pull_request' || targetsStable,

     

       81
       68
        
                   })

     

       82
       69
        
       

     

       83
       70
        
             - name: Log current API rate limits

.github/workflows/pr.yml

···

       23
       23
        
       jobs:

     

       24
       24
        
         prepare:

     

       25
       25
        
           runs-on: ubuntu-24.04-arm

     

       26
       26
       +
           permissions:

     

       27
       27
       +
             # wrong branch review comment

     

       28
       28
       +
             pull-requests: write

     

       26
       29
        
           outputs:

     

       27
       30
        
             baseBranch: ${{ steps.prepare.outputs.base }}

     

       28
       31
        
             headBranch: ${{ steps.prepare.outputs.head }}

     
···

       44
       47
        
                     github,

     

       45
       48
        
                     context,

     

       46
       49
        
                     core,

     

       50
       50
       +
                     dry: context.eventName == 'pull_request',

     

       47
       51
        
                   })

     

       48
       52
        
       

     

       49
       53
        
         check:

-1

.github/workflows/push.yml

···

       2
       2
        
       

     

       3
       3
        
       on:

     

       4
       4
        
         push:

     

       5
       5
       -
           # Keep this synced with ci/request-reviews/dev-branches.txt

     

       6
       5
        
           branches:

     

       7
       6
        
             - master

     

       8
       7
        
             - staging

+18 -77

ci/github-script/commits.js

···

       1
       1
       -
       module.exports = async ({ github, context, core, dry }) => {

     

       1
       1
       +
       module.exports = async ({ github, context, core, dry, cherryPicks }) => {

     

       2
       2
        
         const { execFileSync } = require('node:child_process')

     

       3
       3
        
         const { classify } = require('../supportedBranches.js')

     

       4
       4
        
         const withRateLimit = require('./withRateLimit.js')

     

       5
       5
       +
         const { dismissReviews, postReview } = require('./reviews.js')

     

       5
       6
        
       

     

       6
       7
        
         await withRateLimit({ github, core }, async (stats) => {

     

       7
       8
        
           stats.prs = 1

     
···

       16
       17
        
                 run_id: context.runId,

     

       17
       18
        
                 per_page: 100,

     

       18
       19
        
               })

     

       19
       19
       -
             ).find(({ name }) => name.endsWith('Check / cherry-pick')).html_url +

     

       20
       20
       +
             ).find(({ name }) => name.endsWith('Check / commits')).html_url +

     

       20
       21
        
               '?pr=' +

     

       21
       22
        
               pull_number

     

       22
       23
        
       

     
···

       137
       138
        
             }

     

       138
       139
        
           }

     

       139
       140
        
       

     

       140
       140
       -
           const commits = await github.paginate(github.rest.pulls.listCommits, {

     

       141
       141
       -
             ...context.repo,

     

       142
       142
       -
             pull_number,

     

       143
       143
       -
           })

     

       141
       141
       +
           // For now we short-circuit the list of commits when cherryPicks should not be checked.

     

       142
       142
       +
           // This will not run any checks, but still trigger the "dismiss reviews" part below.

     

       143
       143
       +
           const commits = !cherryPicks

     

       144
       144
       +
             ? []

     

       145
       145
       +
             : await github.paginate(github.rest.pulls.listCommits, {

     

       146
       146
       +
                 ...context.repo,

     

       147
       147
       +
                 pull_number,

     

       148
       148
       +
               })

     

       144
       149
        
       

     

       145
       150
        
           const extracted = await Promise.all(commits.map(extract))

     

       146
       151
        
       

     
···

       185
       190
        
       

     

       186
       191
        
           // Only create step summary below in case of warnings or errors.

     

       187
       192
        
           // Also clean up older reviews, when all checks are good now.

     

       193
       193
       +
           // An empty results array will always trigger this condition, which is helpful

     

       194
       194
       +
           // to clean up reviews created by the prepare step when on the wrong branch.

     

       188
       195
        
           if (results.every(({ severity }) => severity === 'info')) {

     

       189
       189
       -
             if (!dry) {

     

       190
       190
       -
               await Promise.all(

     

       191
       191
       -
                 (

     

       192
       192
       -
                   await github.paginate(github.rest.pulls.listReviews, {

     

       193
       193
       -
                     ...context.repo,

     

       194
       194
       -
                     pull_number,

     

       195
       195
       -
                   })

     

       196
       196
       -
                 )

     

       197
       197
       -
                   .filter((review) => review.user.login === 'github-actions[bot]')

     

       198
       198
       -
                   .map(async (review) => {

     

       199
       199
       -
                     if (review.state === 'CHANGES_REQUESTED') {

     

       200
       200
       -
                       await github.rest.pulls.dismissReview({

     

       201
       201
       -
                         ...context.repo,

     

       202
       202
       -
                         pull_number,

     

       203
       203
       -
                         review_id: review.id,

     

       204
       204
       -
                         message: 'All cherry-picks are good now, thank you!',

     

       205
       205
       -
                       })

     

       206
       206
       -
                     }

     

       207
       207
       -
                     await github.graphql(

     

       208
       208
       -
                       `mutation($node_id:ID!) {

     

       209
       209
       -
                         minimizeComment(input: {

     

       210
       210
       -
                           classifier: RESOLVED,

     

       211
       211
       -
                           subjectId: $node_id

     

       212
       212
       -
                         })

     

       213
       213
       -
                         { clientMutationId }

     

       214
       214
       -
                       }`,

     

       215
       215
       -
                       { node_id: review.node_id },

     

       216
       216
       -
                     )

     

       217
       217
       -
                   }),

     

       218
       218
       -
               )

     

       219
       219
       -
             }

     

       196
       196
       +
             await dismissReviews({ github, context, dry })

     

       220
       197
        
             return

     

       221
       198
        
           }

     

       222
       199
        
       

     
···

       336
       313
        
           const body = core.summary.stringify()

     

       337
       314
        
           core.summary.write()

     

       338
       315
        
       

     

       339
       339
       -
           const pendingReview = (

     

       340
       340
       -
             await github.paginate(github.rest.pulls.listReviews, {

     

       341
       341
       -
               ...context.repo,

     

       342
       342
       -
               pull_number,

     

       343
       343
       -
             })

     

       344
       344
       -
           ).find(

     

       345
       345
       -
             (review) =>

     

       346
       346
       -
               review.user.login === 'github-actions[bot]' &&

     

       347
       347
       -
               // If a review is still pending, we can just update this instead

     

       348
       348
       -
               // of posting a new one.

     

       349
       349
       -
               (review.state === 'CHANGES_REQUESTED' ||

     

       350
       350
       -
                 // No need to post a new review, if an older one with the exact

     

       351
       351
       -
                 // same content had already been dismissed.

     

       352
       352
       -
                 review.body === body),

     

       353
       353
       -
           )

     

       354
       354
       -
       

     

       355
       355
       -
           if (dry) {

     

       356
       356
       -
             if (pendingReview)

     

       357
       357
       -
               core.info(`pending review found: ${pendingReview.html_url}`)

     

       358
       358
       -
             else core.info('no pending review found')

     

       359
       359
       -
           } else {

     

       360
       360
       -
             // Either of those two requests could fail for very long comments. This can only happen

     

       361
       361
       -
             // with multiple commits all hitting the truncation limit for the diff. If you ever hit

     

       362
       362
       -
             // this case, consider just splitting up those commits into multiple PRs.

     

       363
       363
       -
             if (pendingReview) {

     

       364
       364
       -
               await github.rest.pulls.updateReview({

     

       365
       365
       -
                 ...context.repo,

     

       366
       366
       -
                 pull_number,

     

       367
       367
       -
                 review_id: pendingReview.id,

     

       368
       368
       -
                 body,

     

       369
       369
       -
               })

     

       370
       370
       -
             } else {

     

       371
       371
       -
               await github.rest.pulls.createReview({

     

       372
       372
       -
                 ...context.repo,

     

       373
       373
       -
                 pull_number,

     

       374
       374
       -
                 event: 'REQUEST_CHANGES',

     

       375
       375
       -
                 body,

     

       376
       376
       -
               })

     

       377
       377
       -
             }

     

       378
       378
       -
           }

     

       316
       316
       +
           // Posting a review could fail for very long comments. This can only happen with

     

       317
       317
       +
           // multiple commits all hitting the truncation limit for the diff. If you ever hit

     

       318
       318
       +
           // this case, consider just splitting up those commits into multiple PRs.

     

       319
       319
       +
           await postReview({ github, context, core, dry, body })

     

       379
       320
        
         })

     

       380
       321
        
       }

+157 -14

ci/github-script/prepare.js

···

       1
       1
        
       const { classify } = require('../supportedBranches.js')

     

       2
       2
       +
       const { postReview } = require('./reviews.js')

     

       2
       3
        
       

     

       3
       3
       -
       module.exports = async ({ github, context, core }) => {

     

       4
       4
       +
       module.exports = async ({ github, context, core, dry }) => {

     

       4
       5
        
         const pull_number = context.payload.pull_request.number

     

       5
       6
        
       

     

       6
       7
        
         for (const retryInterval of [5, 10, 20, 40, 80]) {

     
···

       24
       25
        
       

     

       25
       26
        
           const { base, head } = prInfo

     

       26
       27
        
       

     

       28
       28
       +
           const baseClassification = classify(base.ref)

     

       29
       29
       +
           core.setOutput('base', baseClassification)

     

       30
       30
       +
           console.log('base classification:', baseClassification)

     

       31
       31
       +
       

     

       32
       32
       +
           const headClassification =

     

       33
       33
       +
             base.repo.full_name === head.repo.full_name

     

       34
       34
       +
               ? classify(head.ref)

     

       35
       35
       +
               : // PRs from forks are always considered WIP.

     

       36
       36
       +
                 { type: ['wip'] }

     

       37
       37
       +
           core.setOutput('head', headClassification)

     

       38
       38
       +
           console.log('head classification:', headClassification)

     

       39
       39
       +
       

     

       40
       40
       +
           if (baseClassification.type.includes('channel')) {

     

       41
       41
       +
             const { stable, version } = baseClassification

     

       42
       42
       +
             const correctBranch = stable ? `release-${version}` : 'master'

     

       43
       43
       +
             const body = [

     

       44
       44
       +
               'The `nixos-*` and `nixpkgs-*` branches are pushed to by the channel release script and should not be merged into directly.',

     

       45
       45
       +
               '',

     

       46
       46
       +
               `Please target \`${correctBranch}\` instead.`,

     

       47
       47
       +
             ].join('\n')

     

       48
       48
       +
       

     

       49
       49
       +
             await postReview({ github, context, core, dry, body })

     

       50
       50
       +
       

     

       51
       51
       +
             throw new Error('The PR targets a channel branch.')

     

       52
       52
       +
           }

     

       53
       53
       +
       

     

       54
       54
       +
           if (headClassification.type.includes('wip')) {

     

       55
       55
       +
             // In the following, we look at the git history to determine the base branch that

     

       56
       56
       +
             // this Pull Request branched off of. This is *supposed* to be the branch that it

     

       57
       57
       +
             // merges into, but humans make mistakes. Once that happens we want to error out as

     

       58
       58
       +
             // early as possible.

     

       59
       59
       +
       

     

       60
       60
       +
             // To determine the "real base", we are looking at the merge-base of primary development

     

       61
       61
       +
             // branches and the head of the PR. The merge-base which results in the least number of

     

       62
       62
       +
             // commits between that base and head is the real base. We can query for this via GitHub's

     

       63
       63
       +
             // REST API. There can be multiple candidates for the real base with the same number of

     

       64
       64
       +
             // commits. In this case we pick the "best" candidate by a fixed ordering of branches,

     

       65
       65
       +
             // as defined in ci/supportedBranches.js.

     

       66
       66
       +
             //

     

       67
       67
       +
             // These requests take a while, when comparing against the wrong release - they need

     

       68
       68
       +
             // to look at way more than 10k commits in that case. Thus, we try to minimize the

     

       69
       69
       +
             // number of requests across releases:

     

       70
       70
       +
             // - First, we look at the primary development branches only: master and release-xx.yy.

     

       71
       71
       +
             //   The branch with the fewest commits gives us the release this PR belongs to.

     

       72
       72
       +
             // - We then compare this number against the relevant staging branches for this release

     

       73
       73
       +
             //   to find the exact branch that this belongs to.

     

       74
       74
       +
       

     

       75
       75
       +
             // All potential development branches

     

       76
       76
       +
             const branches = (

     

       77
       77
       +
               await github.paginate(github.rest.repos.listBranches, {

     

       78
       78
       +
                 ...context.repo,

     

       79
       79
       +
                 per_page: 100,

     

       80
       80
       +
               })

     

       81
       81
       +
             ).map(({ name }) => classify(name))

     

       82
       82
       +
       

     

       83
       83
       +
             // All stable primary development branches from latest to oldest.

     

       84
       84
       +
             const releases = branches

     

       85
       85
       +
               .filter(({ stable, type }) => type.includes('primary') && stable)

     

       86
       86
       +
               .sort((a, b) => b.version.localeCompare(a.version))

     

       87
       87
       +
       

     

       88
       88
       +
             async function mergeBase({ branch, order, version }) {

     

       89
       89
       +
               const { data } = await github.rest.repos.compareCommitsWithBasehead({

     

       90
       90
       +
                 ...context.repo,

     

       91
       91
       +
                 basehead: `${branch}...${head.sha}`,

     

       92
       92
       +
                 // Pagination for this endpoint is about the commits listed, which we don't care about.

     

       93
       93
       +
                 per_page: 1,

     

       94
       94
       +
                 // Taking the second page skips the list of files of this changeset.

     

       95
       95
       +
                 page: 2,

     

       96
       96
       +
               })

     

       97
       97
       +
               return {

     

       98
       98
       +
                 branch,

     

       99
       99
       +
                 order,

     

       100
       100
       +
                 version,

     

       101
       101
       +
                 commits: data.total_commits,

     

       102
       102
       +
                 sha: data.merge_base_commit.sha,

     

       103
       103
       +
               }

     

       104
       104
       +
             }

     

       105
       105
       +
       

     

       106
       106
       +
             // Multiple branches can be OK at the same time, if the PR was created of a merge-base,

     

       107
       107
       +
             // thus storing as array.

     

       108
       108
       +
             let candidates = [await mergeBase(classify('master'))]

     

       109
       109
       +
             for (const release of releases) {

     

       110
       110
       +
               const nextCandidate = await mergeBase(release)

     

       111
       111
       +
               if (candidates[0].commits === nextCandidate.commits)

     

       112
       112
       +
                 candidates.push(nextCandidate)

     

       113
       113
       +
               if (candidates[0].commits > nextCandidate.commits)

     

       114
       114
       +
                 candidates = [nextCandidate]

     

       115
       115
       +
               // The number 10000 is principally arbitrary, but the GitHub API returns this value

     

       116
       116
       +
               // when the number of commits exceeds it in reality. The difference between two stable releases

     

       117
       117
       +
               // is certainly more than 10k commits, thus this works for us as well: If we're targeting

     

       118
       118
       +
               // a wrong release, the number *will* be 10000.

     

       119
       119
       +
               if (candidates[0].commits < 10000) break

     

       120
       120
       +
             }

     

       121
       121
       +
       

     

       122
       122
       +
             core.info(`This PR is for NixOS ${candidates[0].version}.`)

     

       123
       123
       +
       

     

       124
       124
       +
             // Secondary development branches for the selected version only.

     

       125
       125
       +
             const secondary = branches.filter(

     

       126
       126
       +
               ({ branch, type, version }) =>

     

       127
       127
       +
                 type.includes('secondary') && version === candidates[0].version,

     

       128
       128
       +
             )

     

       129
       129
       +
       

     

       130
       130
       +
             // Make sure that we always check the current target as well, even if its a WIP branch.

     

       131
       131
       +
             // If it's not a WIP branch, it was already included in either releases or secondary.

     

       132
       132
       +
             if (classify(base.ref).type.includes('wip')) {

     

       133
       133
       +
               secondary.push(classify(base.ref))

     

       134
       134
       +
             }

     

       135
       135
       +
       

     

       136
       136
       +
             for (const branch of secondary) {

     

       137
       137
       +
               const nextCandidate = await mergeBase(branch)

     

       138
       138
       +
               if (candidates[0].commits === nextCandidate.commits)

     

       139
       139
       +
                 candidates.push(nextCandidate)

     

       140
       140
       +
               if (candidates[0].commits > nextCandidate.commits)

     

       141
       141
       +
                 candidates = [nextCandidate]

     

       142
       142
       +
             }

     

       143
       143
       +
       

     

       144
       144
       +
             // If the current branch is among the candidates, this is always better than any other,

     

       145
       145
       +
             // thus sorting at -1.

     

       146
       146
       +
             candidates = candidates

     

       147
       147
       +
               .map((candidate) =>

     

       148
       148
       +
                 candidate.branch === base.ref

     

       149
       149
       +
                   ? { ...candidate, order: -1 }

     

       150
       150
       +
                   : candidate,

     

       151
       151
       +
               )

     

       152
       152
       +
               .sort((a, b) => a.order - b.order)

     

       153
       153
       +
       

     

       154
       154
       +
             const best = candidates.at(0)

     

       155
       155
       +
       

     

       156
       156
       +
             core.info('The base branches for this PR are:')

     

       157
       157
       +
             core.info(`github: ${base.ref}`)

     

       158
       158
       +
             core.info(

     

       159
       159
       +
               `candidates: ${candidates.map(({ branch }) => branch).join(',')}`,

     

       160
       160
       +
             )

     

       161
       161
       +
             core.info(`best candidate: ${best.branch}`)

     

       162
       162
       +
       

     

       163
       163
       +
             if (best.branch !== base.ref) {

     

       164
       164
       +
               const current = await mergeBase(classify(base.ref))

     

       165
       165
       +
               const body = [

     

       166
       166
       +
                 `The PR's base branch is set to \`${current.branch}\`, but ${current.commits === 10000 ? 'at least 10000' : current.commits - best.commits} commits from the \`${best.branch}\` branch are included. Make sure you know the [right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions), then:`,

     

       167
       167
       +
                 `- If the changes should go to the \`${best.branch}\` branch, [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request).`,

     

       168
       168
       +
                 `- If the changes should go to the \`${current.branch}\` branch, rebase your PR onto the correct merge-base:`,

     

       169
       169
       +
                 '  ```bash',

     

       170
       170
       +
                 `  # git rebase --onto $(git merge-base upstream/${current.branch} HEAD) $(git merge-base upstream/${best.branch} HEAD)`,

     

       171
       171
       +
                 `  git rebase --onto ${current.sha} ${best.sha}`,

     

       172
       172
       +
                 `  git push --force-with-lease`,

     

       173
       173
       +
                 '  ```',

     

       174
       174
       +
               ].join('\n')

     

       175
       175
       +
       

     

       176
       176
       +
               await postReview({ github, context, core, dry, body })

     

       177
       177
       +
       

     

       178
       178
       +
               throw new Error(`The PR contains commits from a different base.`)

     

       179
       179
       +
             }

     

       180
       180
       +
           }

     

       181
       181
       +
       

     

       27
       182
        
           let mergedSha, targetSha

     

       28
       183
        
       

     

       29
       184
        
           if (prInfo.mergeable) {

     
···

       39
       194
        
           } else {

     

       40
       195
        
             core.warning('The PR has a merge conflict.')

     

       41
       196
        
       

     

       42
       42
       -
             mergedSha = prInfo.head.sha

     

       197
       197
       +
             mergedSha = head.sha

     

       43
       198
        
             targetSha = (

     

       44
       199
        
               await github.rest.repos.compareCommitsWithBasehead({

     

       45
       200
        
                 ...context.repo,

     
···

       55
       210
        
           core.setOutput('targetSha', targetSha)

     

       56
       211
        
       

     

       57
       212
        
           core.setOutput('systems', require('../supportedSystems.json'))

     

       58
       58
       -
       

     

       59
       59
       -
           const baseClassification = classify(base.ref)

     

       60
       60
       -
           core.setOutput('base', baseClassification)

     

       61
       61
       -
           console.log('base classification:', baseClassification)

     

       62
       62
       -
       

     

       63
       63
       -
           const headClassification =

     

       64
       64
       -
             base.repo.full_name === head.repo.full_name

     

       65
       65
       -
               ? classify(head.ref)

     

       66
       66
       -
               : // PRs from forks are always considered WIP.

     

       67
       67
       -
                 { type: ['wip'] }

     

       68
       68
       -
           core.setOutput('head', headClassification)

     

       69
       69
       -
           console.log('head classification:', headClassification)

     

       70
       213
        
       

     

       71
       214
        
           const files = (

     

       72
       215
        
             await github.paginate(github.rest.pulls.listFiles, {

+85

ci/github-script/reviews.js

···

       1
       1
       +
       async function dismissReviews({ github, context, dry }) {

     

       2
       2
       +
         const pull_number = context.payload.pull_request.number

     

       3
       3
       +
       

     

       4
       4
       +
         if (dry) {

     

       5
       5
       +
           return

     

       6
       6
       +
         }

     

       7
       7
       +
       

     

       8
       8
       +
         await Promise.all(

     

       9
       9
       +
           (

     

       10
       10
       +
             await github.paginate(github.rest.pulls.listReviews, {

     

       11
       11
       +
               ...context.repo,

     

       12
       12
       +
               pull_number,

     

       13
       13
       +
             })

     

       14
       14
       +
           )

     

       15
       15
       +
             .filter((review) => review.user.login === 'github-actions[bot]')

     

       16
       16
       +
             .map(async (review) => {

     

       17
       17
       +
               if (review.state === 'CHANGES_REQUESTED') {

     

       18
       18
       +
                 await github.rest.pulls.dismissReview({

     

       19
       19
       +
                   ...context.repo,

     

       20
       20
       +
                   pull_number,

     

       21
       21
       +
                   review_id: review.id,

     

       22
       22
       +
                   message: 'All good now, thank you!',

     

       23
       23
       +
                 })

     

       24
       24
       +
               }

     

       25
       25
       +
               await github.graphql(

     

       26
       26
       +
                 `mutation($node_id:ID!) {

     

       27
       27
       +
                   minimizeComment(input: {

     

       28
       28
       +
                     classifier: RESOLVED,

     

       29
       29
       +
                     subjectId: $node_id

     

       30
       30
       +
                   })

     

       31
       31
       +
                   { clientMutationId }

     

       32
       32
       +
                 }`,

     

       33
       33
       +
                 { node_id: review.node_id },

     

       34
       34
       +
               )

     

       35
       35
       +
             }),

     

       36
       36
       +
         )

     

       37
       37
       +
       }

     

       38
       38
       +
       

     

       39
       39
       +
       async function postReview({ github, context, core, dry, body }) {

     

       40
       40
       +
         const pull_number = context.payload.pull_request.number

     

       41
       41
       +
       

     

       42
       42
       +
         const pendingReview = (

     

       43
       43
       +
           await github.paginate(github.rest.pulls.listReviews, {

     

       44
       44
       +
             ...context.repo,

     

       45
       45
       +
             pull_number,

     

       46
       46
       +
           })

     

       47
       47
       +
         ).find(

     

       48
       48
       +
           (review) =>

     

       49
       49
       +
             review.user.login === 'github-actions[bot]' &&

     

       50
       50
       +
             // If a review is still pending, we can just update this instead

     

       51
       51
       +
             // of posting a new one.

     

       52
       52
       +
             (review.state === 'CHANGES_REQUESTED' ||

     

       53
       53
       +
               // No need to post a new review, if an older one with the exact

     

       54
       54
       +
               // same content had already been dismissed.

     

       55
       55
       +
               review.body === body),

     

       56
       56
       +
         )

     

       57
       57
       +
       

     

       58
       58
       +
         if (dry) {

     

       59
       59
       +
           if (pendingReview)

     

       60
       60
       +
             core.info(`pending review found: ${pendingReview.html_url}`)

     

       61
       61
       +
           else core.info('no pending review found')

     

       62
       62
       +
           core.info(body)

     

       63
       63
       +
         } else {

     

       64
       64
       +
           if (pendingReview) {

     

       65
       65
       +
             await github.rest.pulls.updateReview({

     

       66
       66
       +
               ...context.repo,

     

       67
       67
       +
               pull_number,

     

       68
       68
       +
               review_id: pendingReview.id,

     

       69
       69
       +
               body,

     

       70
       70
       +
             })

     

       71
       71
       +
           } else {

     

       72
       72
       +
             await github.rest.pulls.createReview({

     

       73
       73
       +
               ...context.repo,

     

       74
       74
       +
               pull_number,

     

       75
       75
       +
               event: 'REQUEST_CHANGES',

     

       76
       76
       +
               body,

     

       77
       77
       +
             })

     

       78
       78
       +
           }

     

       79
       79
       +
         }

     

       80
       80
       +
       }

     

       81
       81
       +
       

     

       82
       82
       +
       module.exports = {

     

       83
       83
       +
         dismissReviews,

     

       84
       84
       +
         postReview,

     

       85
       85
       +
       }

+10 -7

ci/github-script/run

···

       7
       7
        
       import * as core from '@actions/core'

     

       8
       8
        
       import { getOctokit } from '@actions/github'

     

       9
       9
        
       

     

       10
       10
       -
       async function run(action, owner, repo, pull_number, dry = true) {

     

       10
       10
       +
       async function run(action, owner, repo, pull_number, options = {}) {

     

       11
       11
        
         const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()

     

       12
       12
        
       

     

       13
       13
        
         const github = getOctokit(token)

     
···

       35
       35
        
             },

     

       36
       36
        
           },

     

       37
       37
        
           core,

     

       38
       38
       -
           dry,

     

       38
       38
       +
           dry: true,

     

       39
       39
       +
           ...options,

     

       39
       40
        
         })

     

       40
       41
        
       }

     

       41
       42
        
       

     
···

       45
       46
        
         .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')

     

       46
       47
        
         .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')

     

       47
       48
        
         .argument('<pr>', 'Number of the Pull Request to check')

     

       48
       48
       -
         .action(async (owner, repo, pr) => {

     

       49
       49
       +
         .option('--no-dry', 'Make actual modifications')

     

       50
       50
       +
         .action(async (owner, repo, pr, options) => {

     

       49
       51
        
           const prepare = (await import('./prepare.js')).default

     

       50
       50
       -
           run(prepare, owner, repo, pr)

     

       52
       52
       +
           run(prepare, owner, repo, pr, options)

     

       51
       53
        
         })

     

       52
       54
        
       

     

       53
       55
        
       program

     
···

       56
       58
        
         .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')

     

       57
       59
        
         .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')

     

       58
       60
        
         .argument('<pr>', 'Number of the Pull Request to check')

     

       59
       59
       -
         .action(async (owner, repo, pr) => {

     

       61
       61
       +
         .option('--no-cherry-picks', 'Do not expect cherry-picks.')

     

       62
       62
       +
         .action(async (owner, repo, pr, options) => {

     

       60
       63
        
           const commits = (await import('./commits.js')).default

     

       61
       61
       -
           run(commits, owner, repo, pr)

     

       64
       64
       +
           run(commits, owner, repo, pr, options)

     

       62
       65
        
         })

     

       63
       66
        
       

     

       64
       67
        
       program

     
···

       74
       77
        
           try {

     

       75
       78
        
             process.env.GITHUB_WORKSPACE = tmp

     

       76
       79
        
             process.chdir(tmp)

     

       77
       77
       -
             run(labels, owner, repo, pr, options.dry)

     

       80
       80
       +
             run(labels, owner, repo, pr, options)

     

       78
       81
        
           } finally {

     

       79
       82
        
             rmSync(tmp, { recursive: true })

     

       80
       83
        
           }

-3

ci/request-reviews/default.nix

···

       17
       17
        
             ./get-code-owners.sh

     

       18
       18
        
             ./request-reviewers.sh

     

       19
       19
        
             ./request-code-owner-reviews.sh

     

       20
       20
       -
             ./verify-base-branch.sh

     

       21
       21
       -
             ./dev-branches.txt

     

       22
       20
        
           ];

     

       23
       21
        
         };

     

       24
       22
        
         nativeBuildInputs = [ makeWrapper ];

     

       25
       23
        
         dontBuild = true;

     

       26
       24
        
         installPhase = ''

     

       27
       25
        
           mkdir -p $out/bin

     

       28
       28
       -
           mv dev-branches.txt $out/bin

     

       29
       26
        
           for bin in *.sh; do

     

       30
       27
        
             mv "$bin" "$out/bin"

     

       31
       28
        
             wrapProgram "$out/bin/$bin" \

-8

ci/request-reviews/dev-branches.txt

···

       1
       1
       -
       # Trusted development branches:

     

       2
       2
       -
       # These generally require PRs to update and are built by Hydra.

     

       3
       3
       -
       # Keep this synced with the branches in .github/workflows/eval.yml

     

       4
       4
       -
       master

     

       5
       5
       -
       staging

     

       6
       6
       -
       release-*

     

       7
       7
       -
       staging-*

     

       8
       8
       -
       haskell-updates

+1 -23

ci/request-reviews/request-code-owner-reviews.sh

···

       1
       1
        
       #!/usr/bin/env bash

     

       2
       2
        
       

     

       3
       3
       -
       # Requests reviews for a PR after verifying that the base branch is correct

     

       3
       3
       +
       # Requests reviews for a PR

     

       4
       4
        
       

     

       5
       5
        
       set -euo pipefail

     

       6
       6
        
       tmp=$(mktemp -d)

     
···

       9
       9
        
       

     

       10
       10
        
       log() {

     

       11
       11
        
           echo "$@" >&2

     

       12
       12
       -
       }

     

       13
       13
       -
       

     

       14
       14
       -
       effect() {

     

       15
       15
       -
           if [[ -n "${DRY_MODE:-}" ]]; then

     

       16
       16
       -
               log "Skipping in dry mode:" "${@@Q}"

     

       17
       17
       -
           else

     

       18
       18
       -
               "$@"

     

       19
       19
       -
           fi

     

       20
       12
        
       }

     

       21
       13
        
       

     

       22
       14
        
       if (( $# < 3 )); then

     
···

       62
       54
        
       

     

       63
       55
        
       git -C "$tmp/nixpkgs.git" fetch --no-tags fork "$prBranch"

     

       64
       56
        
       headRef=$(git -C "$tmp/nixpkgs.git" rev-parse refs/remotes/fork/"$prBranch")

     

       65
       65
       -
       

     

       66
       66
       -
       log "Checking correctness of the base branch"

     

       67
       67
       -
       if ! "$SCRIPT_DIR"/verify-base-branch.sh "$tmp/nixpkgs.git" "$headRef" "$baseRepo" "$baseBranch" "$prRepo" "$prBranch" | tee "$tmp/invalid-base-error" >&2; then

     

       68
       68
       -
           log "Posting error as comment"

     

       69
       69
       -
           if ! response=$(effect gh api \

     

       70
       70
       -
               --method POST \

     

       71
       71
       -
               -H "Accept: application/vnd.github+json" \

     

       72
       72
       -
               -H "X-GitHub-Api-Version: 2022-11-28" \

     

       73
       73
       -
               "/repos/$baseRepo/issues/$prNumber/comments" \

     

       74
       74
       -
               -F "body=@$tmp/invalid-base-error"); then

     

       75
       75
       -
               log "Failed to post the comment: $response"

     

       76
       76
       -
           fi

     

       77
       77
       -
           exit 1

     

       78
       78
       -
       fi

     

       79
       57
        
       

     

       80
       58
        
       log "Requesting reviews from code owners"

     

       81
       59
        
       "$SCRIPT_DIR"/get-code-owners.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseBranch" "$headRef" | \

-104

ci/request-reviews/verify-base-branch.sh

···

       1
       1
       -
       #!/usr/bin/env bash

     

       2
       2
       -
       

     

       3
       3
       -
       # Check that a PR doesn't include commits from other development branches.

     

       4
       4
       -
       # Fails with next steps if it does

     

       5
       5
       -
       

     

       6
       6
       -
       set -euo pipefail

     

       7
       7
       -
       tmp=$(mktemp -d)

     

       8
       8
       -
       trap 'rm -rf "$tmp"' exit

     

       9
       9
       -
       SCRIPT_DIR=$(dirname "$0")

     

       10
       10
       -
       

     

       11
       11
       -
       log() {

     

       12
       12
       -
           echo "$@" >&2

     

       13
       13
       -
       }

     

       14
       14
       -
       

     

       15
       15
       -
       # Small helper to check whether an element is in a list

     

       16
       16
       -
       # Usage: `elementIn foo "${list[@]}"`

     

       17
       17
       -
       elementIn() {

     

       18
       18
       -
           local e match=$1

     

       19
       19
       -
           shift

     

       20
       20
       -
           for e; do

     

       21
       21
       -
               if [[ "$e" == "$match" ]]; then

     

       22
       22
       -
                   return 0

     

       23
       23
       -
               fi

     

       24
       24
       -
           done

     

       25
       25
       -
           return 1

     

       26
       26
       -
       }

     

       27
       27
       -
       

     

       28
       28
       -
       if (( $# < 6 )); then

     

       29
       29
       -
           log "Usage: $0 LOCAL_REPO HEAD_REF BASE_REPO BASE_BRANCH PR_REPO PR_BRANCH"

     

       30
       30
       -
           exit 1

     

       31
       31
       -
       fi

     

       32
       32
       -
       localRepo=$1

     

       33
       33
       -
       headRef=$2

     

       34
       34
       -
       baseRepo=$3

     

       35
       35
       -
       baseBranch=$4

     

       36
       36
       -
       prRepo=$5

     

       37
       37
       -
       prBranch=$6

     

       38
       38
       -
       

     

       39
       39
       -
       # All development branches

     

       40
       40
       -
       devBranchPatterns=()

     

       41
       41
       -
       while read -r pattern; do

     

       42
       42
       -
           if [[ "$pattern" != '#'* ]]; then

     

       43
       43
       -
               devBranchPatterns+=("$pattern")

     

       44
       44
       -
           fi

     

       45
       45
       -
       done < "$SCRIPT_DIR/dev-branches.txt"

     

       46
       46
       -
       

     

       47
       47
       -
       git -C "$localRepo" branch --list --format "%(refname:short)" "${devBranchPatterns[@]}" > "$tmp/dev-branches"

     

       48
       48
       -
       readarray -t devBranches < "$tmp/dev-branches"

     

       49
       49
       -
       

     

       50
       50
       -
       if [[ "$baseRepo" == "$prRepo" ]] && elementIn "$prBranch" "${devBranches[@]}"; then

     

       51
       51
       -
           log "This PR merges $prBranch into $baseBranch, no commit check necessary"

     

       52
       52
       -
           exit 0

     

       53
       53
       -
       fi

     

       54
       54
       -
       

     

       55
       55
       -
       # The current merge base of the PR

     

       56
       56
       -
       prMergeBase=$(git -C "$localRepo" merge-base "$baseBranch" "$headRef")

     

       57
       57
       -
       log "The PR's merge base with the base branch $baseBranch is $prMergeBase"

     

       58
       58
       -
       

     

       59
       59
       -
       # This is purely for debugging

     

       60
       60
       -
       git -C "$localRepo" rev-list --reverse "$baseBranch".."$headRef" > "$tmp/pr-commits"

     

       61
       61
       -
       log "The PR includes these $(wc -l < "$tmp/pr-commits") commits:"

     

       62
       62
       -
       cat <"$tmp/pr-commits" >&2

     

       63
       63
       -
       

     

       64
       64
       -
       for testBranch in "${devBranches[@]}"; do

     

       65
       65
       -
       

     

       66
       66
       -
           if [[ -z "$(git -C "$localRepo" rev-list -1 --since="1 month ago" "$testBranch")" ]]; then

     

       67
       67
       -
               log "Not checking $testBranch, was inactive for the last month"

     

       68
       68
       -
               continue

     

       69
       69
       -
           fi

     

       70
       70
       -
           log "Checking if commits from $testBranch are included in the PR"

     

       71
       71
       -
       

     

       72
       72
       -
           # We need to check for any commits that are in the PR which are also in the test branch.

     

       73
       73
       -
           # We could check each commit from the PR individually, but that's unnecessarily slow.

     

       74
       74
       -
           #

     

       75
       75
       -
           # This does _almost_ what we want: `git rev-list --count headRef testBranch ^baseBranch`,

     

       76
       76
       -
           # except that it includes commits that are reachable from _either_ headRef or testBranch,

     

       77
       77
       -
           # instead of restricting it to ones reachable by both

     

       78
       78
       -
       

     

       79
       79
       -
           # Easily fixable though, because we can use `git merge-base testBranch headRef`

     

       80
       80
       -
           # to get the least common ancestor (aka merge base) commit reachable by both.

     

       81
       81
       -
           # If the branch being tested is indeed the right base branch,

     

       82
       82
       -
           # this is then also the commit from that branch that the PR is based on top of.

     

       83
       83
       -
           testMergeBase=$(git -C "$localRepo" merge-base "$testBranch" "$headRef")

     

       84
       84
       -
       

     

       85
       85
       -
           # And then use the `git rev-list --count`, but replacing the non-working

     

       86
       86
       -
           # `headRef testBranch` with the merge base of the two.

     

       87
       87
       -
           extraCommits=$(git -C "$localRepo" rev-list --count "$testMergeBase" ^"$baseBranch")

     

       88
       88
       -
       

     

       89
       89
       -
           if (( extraCommits != 0 )); then

     

       90
       90
       -
               log -e "\e[33m"

     

       91
       91
       -
               echo "The PR's base branch is set to $baseBranch, but $extraCommits commits from the $testBranch branch are included. Make sure you know the [right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions), then:"

     

       92
       92
       -
               echo "- If the changes should go to the $testBranch branch, [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to $testBranch"

     

       93
       93
       -
               echo "- If the changes should go to the $baseBranch branch, rebase your PR onto the merge base with the $baseBranch branch:"

     

       94
       94
       -
               echo "  \`\`\`bash"

     

       95
       95
       -
               echo "  # git rebase --onto \$(git merge-base upstream/$baseBranch HEAD) \$(git merge-base upstream/$testBranch HEAD)"

     

       96
       96
       -
               echo "  git rebase --onto $prMergeBase $testMergeBase"

     

       97
       97
       -
               echo "  git push --force-with-lease"

     

       98
       98
       -
               echo "  \`\`\`"

     

       99
       99
       -
               log -e "\e[m"

     

       100
       100
       -
               exit 1

     

       101
       101
       -
           fi

     

       102
       102
       -
       done

     

       103
       103
       -
       

     

       104
       104
       -
       log "Base branch is correct, no commits from development branches are included"

+15

ci/supportedBranches.js

···

       13
       13
        
         nixpkgs: ['channel'],

     

       14
       14
        
       }

     

       15
       15
        
       

     

       16
       16
       +
       // "order" ranks the development branches by how likely they are the intended base branch

     

       17
       17
       +
       // when they are an otherwise equally good fit according to ci/github-script/prepare.js.

     

       18
       18
       +
       const orderConfig = {

     

       19
       19
       +
         master: 0,

     

       20
       20
       +
         release: 1,

     

       21
       21
       +
         staging: 2,

     

       22
       22
       +
         'haskell-updates': 3,

     

       23
       23
       +
         'staging-next': 4,

     

       24
       24
       +
       }

     

       25
       25
       +
       

     

       16
       26
        
       function split(branch) {

     

       17
       27
        
         return {

     

       18
       28
        
           ...branch.match(

     
···

       24
       34
        
       function classify(branch) {

     

       25
       35
        
         const { prefix, version } = split(branch)

     

       26
       36
        
         return {

     

       37
       37
       +
           branch,

     

       38
       38
       +
           order: orderConfig[prefix] ?? Infinity,

     

       27
       39
        
           stable: (version ?? 'unstable') !== 'unstable',

     

       28
       40
        
           type: typeConfig[prefix] ?? ['wip'],

     

       41
       41
       +
           version: version ?? 'unstable',

     

       29
       42
        
         }

     

       30
       43
        
       }

     

       31
       44
        
       

     
···

       39
       52
        
         }

     

       40
       53
        
         testSplit('master')

     

       41
       54
        
         testSplit('release-25.05')

     

       55
       55
       +
         testSplit('staging')

     

       42
       56
        
         testSplit('staging-next')

     

       43
       57
        
         testSplit('staging-25.05')

     

       44
       58
        
         testSplit('staging-next-25.05')

     
···

       55
       69
        
         }

     

       56
       70
        
         testClassify('master')

     

       57
       71
        
         testClassify('release-25.05')

     

       72
       72
       +
         testClassify('staging')

     

       58
       73
        
         testClassify('staging-next')

     

       59
       74
        
         testClassify('staging-25.05')

     

       60
       75
        
         testClassify('staging-next-25.05')