···

       
11
       
11
       
 
       


     

       
12
       
12
       
 
       
<!-- A clear and concise description of what the bug is. -->

     

       
13
       
13
       
 
       


     

       
14
       
14
       
-
       
## Steps To Reproduce

     

       
14
       
14
       
+
       
## Steps to reproduce

     

       
15
       
15
       
 
       


     

       
16
       
16
       
 
       
Steps to reproduce the behavior:

     

       
17
       
17
       
 
       


     

···

       
7
       
7
       
 
       


     

       
8
       
8
       
 
       
---

     

       
9
       
9
       
 
       


     

       
10
       
10
       
-
       
## Steps To Reproduce

     

       
10
       
10
       
+
       
## Steps to reproduce

     

       
11
       
11
       
 
       


     

       
12
       
12
       
 
       
Steps to reproduce the behavior:

     

       
13
       
13
       
 
       


     

···

       
7
       
7
       
 
       


     

       
8
       
8
       
 
       
---

     

       
9
       
9
       
 
       


     

       
10
       
10
       
-
       
## Package Information

     

       
10
       
10
       
+
       
## Package information

     

       
11
       
11
       
 
       


     

       
12
       
12
       
 
       
<!-- Search for the package here: https://search.nixos.org/packages?channel=unstable -->

     

       
13
       
13
       
 
       


     

···

       
31
       
31
       
 
       
avoiding hard-to-reproduce bugs, making content-addressed storage more effective

     

       
32
       
32
       
 
       
and reducing rebuilds in such systems.

     

       
33
       
33
       
 
       


     

       
34
       
34
       
-
       
## Steps To Reproduce

     

       
34
       
34
       
+
       
## Steps to reproduce

     

       
35
       
35
       
 
       


     

       
36
       
36
       
 
       
In the following steps, replace `<package>` with the canonical name of the

     

       
37
       
37
       
 
       
package.

     

···

       
1
       
1
       
+
       
# GitHub Actions Workflows

     

       
2
       
2
       
+
       


     

       
3
       
3
       
+
       
Some architectural notes about key decisions and concepts in our workflows:

     

       
4
       
4
       
+
       


     

       
5
       
5
       
+
       
- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows. This has the advantage that those workflows will run without prior approval for external contributors.

     

       
6
       
6
       
+
       


     

       
7
       
7
       
+
       
- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches. **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible. Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.

     

       
8
       
8
       
+
       


     

       
9
       
9
       
+
       
- By definition `pull_request_target` runs in the context of the **base** of the pull request. This means, that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default. To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.

     

       
10
       
10
       
+
       


     

       
11
       
11
       
+
       
- To test the pull request's contents, we checkout the "test merge commit". This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?". The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore). This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout. Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.

     

       
12
       
12
       
+
       


     

       
13
       
13
       
+
       
- Various workflows need to make comparisons against the base branch. In this case, we checkout the parent of the "test merge commit" for best results. Note, that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.

     

       
14
       
14
       
+
       


     

       
15
       
15
       
+
       
## Terminology

     

       
16
       
16
       
+
       


     

       
17
       
17
       
+
       
- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions. Same as `github.event.pull_request.base.sha`.

     

       
18
       
18
       
+
       
- **head commit**: The HEAD commit in the pull request's branch. Same as `github.event.pull_request.head.sha`.

     

       
19
       
19
       
+
       
- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request. Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.

     

       
20
       
20
       
+
       
- **target commit**: The base branch's parent of the "test merge commit" to compare against.

     

···

       
1
       
1
       
+
       
# WARNING:

     

       
2
       
2
       
+
       
# When extending this action, be aware that $GITHUB_TOKEN allows write access to

     

       
3
       
3
       
+
       
# the GitHub repository. This means that it should not evaluate user input in a

     

       
4
       
4
       
+
       
# way that allows code injection.

     

       
5
       
5
       
+
       


     

       
1
       
6
       
 
       
name: Backport

     

       
7
       
7
       
+
       


     

       
2
       
8
       
 
       
on:

     

       
3
       
9
       
 
       
  pull_request_target:

     

       
4
       
10
       
 
       
    types: [closed, labeled]

     

       
5
       
5
       
-
       


     

       
6
       
6
       
-
       
# WARNING:

     

       
7
       
7
       
-
       
# When extending this action, be aware that $GITHUB_TOKEN allows write access to

     

       
8
       
8
       
-
       
# the GitHub repository. This means that it should not evaluate user input in a

     

       
9
       
9
       
-
       
# way that allows code injection.

     

       
10
       
11
       
 
       


     

       
11
       
12
       
 
       
permissions: {}

     

       
12
       
13
       
 
       


     
···

       
23
       
24
       
 
       
        with:

     

       
24
       
25
       
 
       
          app-id: ${{ vars.BACKPORT_APP_ID }}

     

       
25
       
26
       
 
       
          private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}

     

       
27
       
27
       
+
       


     

       
26
       
28
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
27
       
29
       
 
       
        with:

     

       
28
       
30
       
 
       
          ref: ${{ github.event.pull_request.head.sha }}

     

       
29
       
31
       
 
       
          token: ${{ steps.app-token.outputs.token }}

     

       
32
       
32
       
+
       


     

       
30
       
33
       
 
       
      - name: Create backport PRs

     

       
31
       
34
       
 
       
        uses: korthout/backport-action@be567af183754f6a5d831ae90f648954763f17f5 # v3.1.0

     

       
32
       
35
       
 
       
        with:

     

···

       
1
       
1
       
-
       
name: Basic evaluation checks

     

       
2
       
2
       
-
       


     

       
3
       
3
       
-
       
on:

     

       
4
       
4
       
-
       
  workflow_dispatch

     

       
5
       
5
       
-
       
  # pull_request:

     

       
6
       
6
       
-
       
  #   branches:

     

       
7
       
7
       
-
       
  #    - master

     

       
8
       
8
       
-
       
  #    - release-**

     

       
9
       
9
       
-
       
  # push:

     

       
10
       
10
       
-
       
  #   branches:

     

       
11
       
11
       
-
       
  #    - master

     

       
12
       
12
       
-
       
  #    - release-**

     

       
13
       
13
       
-
       
permissions:

     

       
14
       
14
       
-
       
  contents: read

     

       
15
       
15
       
-
       


     

       
16
       
16
       
-
       
jobs:

     

       
17
       
17
       
-
       
  tests:

     

       
18
       
18
       
-
       
    name: basic-eval-checks

     

       
19
       
19
       
-
       
    runs-on: ubuntu-24.04

     

       
20
       
20
       
-
       
    # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback

     

       
21
       
21
       
-
       
    steps:

     

       
22
       
22
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
23
       
23
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
24
       
24
       
-
       
    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
25
       
25
       
-
       
      with:

     

       
26
       
26
       
-
       
        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
27
       
27
       
-
       
        name: nixpkgs-ci

     

       
28
       
28
       
-
       
        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'

     

       
29
       
29
       
-
       
    - run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build

     

       
30
       
30
       
-
       
    # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset

     

       
31
       
31
       
-
       
    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'

     

···

       
1
       
1
       
 
       
name: "Check cherry-picks"

     

       
2
       
2
       
+
       


     

       
2
       
3
       
 
       
on:

     

       
3
       
4
       
 
       
  pull_request_target:

     

       
4
       
5
       
 
       
    branches:

     

       
5
       
5
       
-
       
     - 'release-**'

     

       
6
       
6
       
-
       
     - 'staging-**'

     

       
7
       
7
       
-
       
     - '!staging-next'

     

       
6
       
6
       
+
       
      - 'release-**'

     

       
7
       
7
       
+
       
      - 'staging-**'

     

       
8
       
8
       
+
       
      - '!staging-next'

     

       
8
       
9
       
 
       


     

       
9
       
10
       
 
       
permissions: {}

     

       
10
       
11
       
 
       


     
···

       
14
       
15
       
 
       
    runs-on: ubuntu-24.04

     

       
15
       
16
       
 
       
    if: github.repository_owner == 'NixOS'

     

       
16
       
17
       
 
       
    steps:

     

       
17
       
17
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
18
       
18
       
-
       
      with:

     

       
19
       
19
       
-
       
        fetch-depth: 0

     

       
20
       
20
       
-
       
        filter: blob:none

     

       
21
       
21
       
-
       
    - name: Check cherry-picks

     

       
22
       
22
       
-
       
      env:

     

       
23
       
23
       
-
       
        BASE_SHA: ${{ github.event.pull_request.base.sha }}

     

       
24
       
24
       
-
       
        HEAD_SHA: ${{ github.event.pull_request.head.sha }}

     

       
25
       
25
       
-
       
      run: |

     

       
26
       
26
       
-
       
        ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

     

       
18
       
18
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
19
       
19
       
+
       
        with:

     

       
20
       
20
       
+
       
          fetch-depth: 0

     

       
21
       
21
       
+
       
          filter: blob:none

     

       
22
       
22
       
+
       


     

       
23
       
23
       
+
       
      - name: Check cherry-picks

     

       
24
       
24
       
+
       
        env:

     

       
25
       
25
       
+
       
          BASE_SHA: ${{ github.event.pull_request.base.sha }}

     

       
26
       
26
       
+
       
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

     

       
27
       
27
       
+
       
        run: |

     

       
28
       
28
       
+
       
          ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

     

···

       
4
       
4
       
 
       
  pull_request_target:

     

       
5
       
5
       
 
       
    paths:

     

       
6
       
6
       
 
       
      - 'maintainers/maintainer-list.nix'

     

       
7
       
7
       
-
       
permissions:

     

       
8
       
8
       
-
       
  contents: read

     

       
7
       
7
       
+
       


     

       
8
       
8
       
+
       
permissions: {}

     

       
9
       
9
       
 
       


     

       
10
       
10
       
 
       
jobs:

     

       
11
       
11
       
 
       
  nixos:

     

       
12
       
12
       
 
       
    name: maintainer-list-check

     

       
13
       
13
       
 
       
    runs-on: ubuntu-24.04

     

       
14
       
14
       
-
       
    if: github.repository_owner == 'NixOS'

     

       
15
       
14
       
 
       
    steps:

     

       
16
       
15
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
17
       
16
       
 
       
        with:

     

       
18
       
18
       
-
       
          # pull_request_target checks out the base branch by default

     

       
19
       
17
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
20
       
18
       
 
       
          # Only these directories to perform the check

     

       
21
       
19
       
 
       
          sparse-checkout: |

     

       
22
       
20
       
 
       
            lib

     

       
23
       
21
       
 
       
            maintainers

     

       
22
       
22
       
+
       


     

       
24
       
23
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
25
       
24
       
 
       
        with:

     

       
26
       
26
       
-
       
          # explicitly enable sandbox

     

       
27
       
25
       
 
       
          extra_nix_config: sandbox = true

     

       
26
       
26
       
+
       


     

       
28
       
27
       
 
       
      - name: Check that maintainer-list.nix is sorted

     

       
29
       
28
       
 
       
        run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix

     

···

       
3
       
3
       
 
       
# https://github.com/NixOS/rfcs/pull/166.

     

       
4
       
4
       
 
       
# Because of this, this action is not yet enabled for all files -- only for

     

       
5
       
5
       
 
       
# those who have opted in.

     

       
6
       
6
       
+
       


     

       
6
       
7
       
 
       
name: Check that Nix files are formatted

     

       
7
       
8
       
 
       


     

       
8
       
9
       
 
       
on:

     

       
9
       
10
       
 
       
  pull_request_target:

     

       
10
       
10
       
-
       
    # See the comment at the same location in ./nixpkgs-vet.yml

     

       
11
       
11
       
 
       
    types: [opened, synchronize, reopened, edited]

     

       
12
       
12
       
-
       
permissions:

     

       
13
       
13
       
-
       
  contents: read

     

       
12
       
12
       
+
       


     

       
13
       
13
       
+
       
permissions: {}

     

       
14
       
14
       
 
       


     

       
15
       
15
       
 
       
jobs:

     

       
16
       
16
       
 
       
  get-merge-commit:

     
···

       
24
       
24
       
 
       
    steps:

     

       
25
       
25
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
26
       
26
       
 
       
        with:

     

       
27
       
27
       
-
       
          # pull_request_target checks out the base branch by default

     

       
28
       
27
       
 
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
29
       
28
       
 
       
          # Fetches the merge commit and its parents

     

       
30
       
29
       
 
       
          fetch-depth: 2

     

       
31
       
31
       
-
       
      - name: Checking out base branch

     

       
30
       
30
       
+
       


     

       
31
       
31
       
+
       
      - name: Checking out target branch

     

       
32
       
32
       
 
       
        run: |

     

       
33
       
33
       
-
       
          base=$(mktemp -d)

     

       
34
       
34
       
-
       
          baseRev=$(git rev-parse HEAD^1)

     

       
35
       
35
       
-
       
          git worktree add "$base" "$baseRev"

     

       
36
       
36
       
-
       
          echo "baseRev=$baseRev" >> "$GITHUB_ENV"

     

       
37
       
37
       
-
       
          echo "base=$base" >> "$GITHUB_ENV"

     

       
33
       
33
       
+
       
          target=$(mktemp -d)

     

       
34
       
34
       
+
       
          targetRev=$(git rev-parse HEAD^1)

     

       
35
       
35
       
+
       
          git worktree add "$target" "$targetRev"

     

       
36
       
36
       
+
       
          echo "targetRev=$targetRev" >> "$GITHUB_ENV"

     

       
37
       
37
       
+
       
          echo "target=$target" >> "$GITHUB_ENV"

     

       
38
       
38
       
+
       


     

       
38
       
39
       
 
       
      - name: Get Nixpkgs revision for nixfmt

     

       
39
       
40
       
 
       
        run: |

     

       
40
       
41
       
 
       
          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt

     
···

       
42
       
43
       
 
       
          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!

     

       
43
       
44
       
 
       
          rev=$(jq -r .rev ci/pinned-nixpkgs.json)

     

       
44
       
45
       
 
       
          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"

     

       
46
       
46
       
+
       


     

       
45
       
47
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
46
       
48
       
 
       
        with:

     

       
47
       
47
       
-
       
          # explicitly enable sandbox

     

       
48
       
49
       
 
       
          extra_nix_config: sandbox = true

     

       
49
       
50
       
 
       
          nix_path: nixpkgs=${{ env.url }}

     

       
51
       
51
       
+
       


     

       
50
       
52
       
 
       
      - name: Install nixfmt

     

       
51
       
53
       
 
       
        run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"

     

       
54
       
54
       
+
       


     

       
52
       
55
       
 
       
      - name: Check that Nix files are formatted according to the RFC style

     

       
53
       
56
       
 
       
        run: |

     

       
54
       
57
       
 
       
          unformattedFiles=()

     
···

       
78
       
81
       
 
       
            esac

     

       
79
       
82
       
 
       


     

       
80
       
83
       
 
       
            # Ignore files that weren't already formatted

     

       
81
       
81
       
-
       
            if [[ -n "$source" ]] && ! nixfmt --check ${{ env.base }}/"$source" 2>/dev/null; then

     

       
82
       
82
       
-
       
              echo "Ignoring file $file because it's not formatted in the base commit"

     

       
84
       
84
       
+
       
            if [[ -n "$source" ]] && ! nixfmt --check ${{ env.target }}/"$source" 2>/dev/null; then

     

       
85
       
85
       
+
       
              echo "Ignoring file $file because it's not formatted in the target commit"

     

       
83
       
86
       
 
       
            elif ! nixfmt --check "$dest"; then

     

       
84
       
87
       
 
       
              unformattedFiles+=("$dest")

     

       
85
       
88
       
 
       
            fi

     

       
86
       
86
       
-
       
          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')

     

       
89
       
89
       
+
       
          done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')

     

       
87
       
90
       
 
       


     

       
88
       
91
       
 
       
          if (( "${#unformattedFiles[@]}" > 0 )); then

     

       
89
       
92
       
 
       
            echo "Some new/changed Nix files are not properly formatted"

     

···

       
3
       
3
       
 
       
on:

     

       
4
       
4
       
 
       
  pull_request_target:

     

       
5
       
5
       
 
       
    types: [opened, synchronize, reopened, edited]

     

       
6
       
6
       
-
       
permissions:

     

       
7
       
7
       
-
       
  contents: read

     

       
6
       
6
       
+
       


     

       
7
       
7
       
+
       
permissions: {}

     

       
8
       
8
       
 
       


     

       
9
       
9
       
 
       
jobs:

     

       
10
       
10
       
 
       
  nixos:

     
···

       
14
       
14
       
 
       
    steps:

     

       
15
       
15
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
16
       
16
       
 
       
        with:

     

       
17
       
17
       
-
       
          # pull_request_target checks out the base branch by default

     

       
18
       
17
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
19
       
18
       
 
       
          # Fetches the merge commit and its parents

     

       
20
       
19
       
 
       
          fetch-depth: 2

     

       
21
       
21
       
-
       
      - name: Checking out base branch

     

       
20
       
20
       
+
       


     

       
21
       
21
       
+
       
      - name: Checking out target branch

     

       
22
       
22
       
 
       
        run: |

     

       
23
       
23
       
-
       
          base=$(mktemp -d)

     

       
24
       
24
       
-
       
          baseRev=$(git rev-parse HEAD^1)

     

       
25
       
25
       
-
       
          git worktree add "$base" "$baseRev"

     

       
26
       
26
       
-
       
          echo "baseRev=$baseRev" >> "$GITHUB_ENV"

     

       
27
       
27
       
-
       
          echo "base=$base" >> "$GITHUB_ENV"

     

       
23
       
23
       
+
       
          target=$(mktemp -d)

     

       
24
       
24
       
+
       
          targetRev=$(git rev-parse HEAD^1)

     

       
25
       
25
       
+
       
          git worktree add "$target" "$targetRev"

     

       
26
       
26
       
+
       
          echo "targetRev=$targetRev" >> "$GITHUB_ENV"

     

       
27
       
27
       
+
       
          echo "target=$target" >> "$GITHUB_ENV"

     

       
28
       
28
       
+
       


     

       
28
       
29
       
 
       
      - name: Get Nixpkgs revision for nixf

     

       
29
       
30
       
 
       
        run: |

     

       
30
       
31
       
 
       
          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf

     
···

       
32
       
33
       
 
       
          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!

     

       
33
       
34
       
 
       
          rev=$(jq -r .rev ci/pinned-nixpkgs.json)

     

       
34
       
35
       
 
       
          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"

     

       
36
       
36
       
+
       


     

       
35
       
37
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
36
       
38
       
 
       
        with:

     

       
37
       
37
       
-
       
          # explicitly enable sandbox

     

       
38
       
39
       
 
       
          extra_nix_config: sandbox = true

     

       
39
       
40
       
 
       
          nix_path: nixpkgs=${{ env.url }}

     

       
41
       
41
       
+
       


     

       
40
       
42
       
 
       
      - name: Install nixf and jq

     

       
41
       
43
       
 
       
        # provided jq is incompatible with our expression

     

       
42
       
44
       
 
       
        run: "nix-env -f '<nixpkgs>' -iAP nixf jq"

     

       
45
       
45
       
+
       


     

       
43
       
46
       
 
       
      - name: Check that Nix files pass nixf-tidy

     

       
44
       
47
       
 
       
        run: |

     

       
45
       
48
       
 
       
          # Filtering error messages we don't like

     
···

       
85
       
88
       
 
       
                continue

     

       
86
       
89
       
 
       
            esac

     

       
87
       
90
       
 
       


     

       
88
       
88
       
-
       
            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.base }}/"$source")" != '[]' ]] 2>/dev/null; then

     

       
89
       
89
       
-
       
              echo "Ignoring file $file because it doesn't pass nixf-tidy in the base commit"

     

       
91
       
91
       
+
       
            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.target }}/"$source")" != '[]' ]] 2>/dev/null; then

     

       
92
       
92
       
+
       
              echo "Ignoring file $file because it doesn't pass nixf-tidy in the target commit"

     

       
90
       
93
       
 
       
              echo # insert blank line

     

       
91
       
94
       
 
       
            else

     

       
92
       
95
       
 
       
              nixf_report="$(nixf_wrapper "$dest")"

     
···

       
113
       
116
       
 
       
                failedFiles+=("$dest")

     

       
114
       
117
       
 
       
              fi

     

       
115
       
118
       
 
       
            fi

     

       
116
       
116
       
-
       
          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')

     

       
119
       
119
       
+
       
          done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')

     

       
117
       
120
       
 
       


     

       
118
       
121
       
 
       
          if [[ -n "$DONT_REPORT_ERROR" ]]; then

     

       
119
       
122
       
 
       
            echo "Edited the PR but didn't change the base branch, only the description/title."

     

···

       
9
       
9
       
 
       
permissions: {}

     

       
10
       
10
       
 
       


     

       
11
       
11
       
 
       
jobs:

     

       
12
       
12
       
-
       
  x86_64-linux:

     

       
13
       
13
       
-
       
    name: shell-check-x86_64-linux

     

       
14
       
14
       
-
       
    runs-on: ubuntu-24.04

     

       
12
       
12
       
+
       
  shell-check:

     

       
13
       
13
       
+
       
    strategy:

     

       
14
       
14
       
+
       
      fail-fast: false

     

       
15
       
15
       
+
       
      matrix:

     

       
16
       
16
       
+
       
        include:

     

       
17
       
17
       
+
       
          - runner: ubuntu-24.04

     

       
18
       
18
       
+
       
            system: x86_64-linux

     

       
19
       
19
       
+
       
          - runner: macos-14

     

       
20
       
20
       
+
       
            system: aarch64-darwin

     

       
21
       
21
       
+
       


     

       
22
       
22
       
+
       
    name: shell-check-${{ matrix.system }}

     

       
23
       
23
       
+
       
    runs-on: ${{ matrix.runner }}

     

       
24
       
24
       
+
       


     

       
15
       
25
       
 
       
    steps:

     

       
16
       
26
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
17
       
27
       
 
       
        with:

     

       
18
       
18
       
-
       
          # pull_request_target checks out the base branch by default

     

       
19
       
28
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
20
       
20
       
-
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
21
       
21
       
-
       
      - name: Build shell

     

       
22
       
22
       
-
       
        run: nix-build shell.nix

     

       
23
       
29
       
 
       


     

       
24
       
24
       
-
       
  aarch64-darwin:

     

       
25
       
25
       
-
       
    name: shell-check-aarch64-darwin

     

       
26
       
26
       
-
       
    runs-on: macos-14

     

       
27
       
27
       
-
       
    steps:

     

       
28
       
28
       
-
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
29
       
29
       
-
       
        with:

     

       
30
       
30
       
-
       
          # pull_request_target checks out the base branch by default

     

       
31
       
31
       
-
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
32
       
30
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
31
       
31
       
+
       


     

       
33
       
32
       
 
       
      - name: Build shell

     

       
34
       
33
       
 
       
        run: nix-build shell.nix

     

···

       
1
       
1
       
-
       
name: Codeowners v2

     

       
2
       
2
       
-
       


     

       
3
       
1
       
 
       
# This workflow depends on two GitHub Apps with the following permissions:

     

       
4
       
2
       
 
       
# - For checking code owners:

     

       
5
       
3
       
 
       
#   - Permissions:

     
···

       
21
       
19
       
 
       
# while requesting code owners requires PR write access, and those shouldn't be mixed.

     

       
22
       
20
       
 
       
#

     

       
23
       
21
       
 
       
# Note that the latter is also used for ./eval.yml requesting reviewers.

     

       
22
       
22
       
+
       


     

       
23
       
23
       
+
       
name: Codeowners v2

     

       
24
       
24
       
 
       


     

       
25
       
25
       
 
       
on:

     

       
26
       
26
       
 
       
  pull_request_target:

     

       
27
       
27
       
 
       
    types: [opened, ready_for_review, synchronize, reopened, edited]

     

       
28
       
28
       
 
       


     

       
29
       
29
       
-
       
# We don't need any default GitHub token

     

       
30
       
29
       
 
       
permissions: {}

     

       
31
       
30
       
 
       


     

       
32
       
31
       
 
       
env:

     
···

       
45
       
44
       
 
       
    needs: get-merge-commit

     

       
46
       
45
       
 
       
    if: needs.get-merge-commit.outputs.mergedSha

     

       
47
       
46
       
 
       
    steps:

     

       
48
       
48
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
47
       
47
       
+
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
49
       
48
       
 
       


     

       
50
       
50
       
-
       
    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
51
       
51
       
-
       
      if: github.repository_owner == 'NixOS'

     

       
52
       
52
       
-
       
      with:

     

       
53
       
53
       
-
       
        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
54
       
54
       
-
       
        name: nixpkgs-ci

     

       
55
       
55
       
-
       
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
49
       
49
       
+
       
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
50
       
50
       
+
       
        if: github.repository_owner == 'NixOS'

     

       
51
       
51
       
+
       
        with:

     

       
52
       
52
       
+
       
          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
53
       
53
       
+
       
          name: nixpkgs-ci

     

       
54
       
54
       
+
       
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
56
       
55
       
 
       


     

       
57
       
57
       
-
       
    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.

     

       
58
       
58
       
-
       
    # We later build and run code from the base branch with access to secrets,

     

       
59
       
59
       
-
       
    # so it's important this is not the PRs code.

     

       
60
       
60
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
61
       
61
       
-
       
      with:

     

       
62
       
62
       
-
       
        path: base

     

       
56
       
56
       
+
       
      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.

     

       
57
       
57
       
+
       
      # We later build and run code from the base branch with access to secrets,

     

       
58
       
58
       
+
       
      # so it's important this is not the PRs code.

     

       
59
       
59
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
60
       
60
       
+
       
        with:

     

       
61
       
61
       
+
       
          path: base

     

       
63
       
62
       
 
       


     

       
64
       
64
       
-
       
    - name: Build codeowners validator

     

       
65
       
65
       
-
       
      run: nix-build base/ci -A codeownersValidator

     

       
63
       
63
       
+
       
      - name: Build codeowners validator

     

       
64
       
64
       
+
       
        run: nix-build base/ci -A codeownersValidator

     

       
66
       
65
       
 
       


     

       
67
       
67
       
-
       
    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1

     

       
68
       
68
       
-
       
      id: app-token

     

       
69
       
69
       
-
       
      with:

     

       
70
       
70
       
-
       
        app-id: ${{ vars.OWNER_RO_APP_ID }}

     

       
71
       
71
       
-
       
        private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}

     

       
66
       
66
       
+
       
      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1

     

       
67
       
67
       
+
       
        id: app-token

     

       
68
       
68
       
+
       
        with:

     

       
69
       
69
       
+
       
          app-id: ${{ vars.OWNER_RO_APP_ID }}

     

       
70
       
70
       
+
       
          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}

     

       
72
       
71
       
 
       


     

       
73
       
73
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
74
       
74
       
-
       
      with:

     

       
75
       
75
       
-
       
        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
76
       
76
       
-
       
        path: pr

     

       
72
       
72
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
73
       
73
       
+
       
        with:

     

       
74
       
74
       
+
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
75
       
75
       
+
       
          path: pr

     

       
77
       
76
       
 
       


     

       
78
       
78
       
-
       
    - name: Validate codeowners

     

       
79
       
79
       
-
       
      run: result/bin/codeowners-validator

     

       
80
       
80
       
-
       
      env:

     

       
81
       
81
       
-
       
        OWNERS_FILE: pr/${{ env.OWNERS_FILE }}

     

       
82
       
82
       
-
       
        GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}

     

       
83
       
83
       
-
       
        REPOSITORY_PATH: pr

     

       
84
       
84
       
-
       
        OWNER_CHECKER_REPOSITORY: ${{ github.repository }}

     

       
85
       
85
       
-
       
        # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody

     

       
86
       
86
       
-
       
        EXPERIMENTAL_CHECKS: "avoid-shadowing"

     

       
77
       
77
       
+
       
      - name: Validate codeowners

     

       
78
       
78
       
+
       
        run: result/bin/codeowners-validator

     

       
79
       
79
       
+
       
        env:

     

       
80
       
80
       
+
       
          OWNERS_FILE: pr/${{ env.OWNERS_FILE }}

     

       
81
       
81
       
+
       
          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}

     

       
82
       
82
       
+
       
          REPOSITORY_PATH: pr

     

       
83
       
83
       
+
       
          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}

     

       
84
       
84
       
+
       
          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody

     

       
85
       
85
       
+
       
          EXPERIMENTAL_CHECKS: "avoid-shadowing"

     

       
87
       
86
       
 
       


     

       
88
       
87
       
 
       
  # Request reviews from code owners

     

       
89
       
88
       
 
       
  request:

     

       
90
       
89
       
 
       
    name: Request

     

       
91
       
90
       
 
       
    runs-on: ubuntu-24.04

     

       
92
       
91
       
 
       
    steps:

     

       
93
       
93
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
92
       
92
       
+
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
94
       
93
       
 
       


     

       
95
       
95
       
-
       
    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.

     

       
96
       
96
       
-
       
    # This is intentional, because we need to request the review of owners as declared in the base branch.

     

       
97
       
97
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
94
       
94
       
+
       
      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.

     

       
95
       
95
       
+
       
      # This is intentional, because we need to request the review of owners as declared in the base branch.

     

       
96
       
96
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
98
       
97
       
 
       


     

       
99
       
99
       
-
       
    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1

     

       
100
       
100
       
-
       
      id: app-token

     

       
101
       
101
       
-
       
      with:

     

       
102
       
102
       
-
       
        app-id: ${{ vars.OWNER_APP_ID }}

     

       
103
       
103
       
-
       
        private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}

     

       
98
       
98
       
+
       
      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1

     

       
99
       
99
       
+
       
        id: app-token

     

       
100
       
100
       
+
       
        with:

     

       
101
       
101
       
+
       
          app-id: ${{ vars.OWNER_APP_ID }}

     

       
102
       
102
       
+
       
          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}

     

       
104
       
103
       
 
       


     

       
105
       
105
       
-
       
    - name: Build review request package

     

       
106
       
106
       
-
       
      run: nix-build ci -A requestReviews

     

       
104
       
104
       
+
       
      - name: Build review request package

     

       
105
       
105
       
+
       
        run: nix-build ci -A requestReviews

     

       
107
       
106
       
 
       


     

       
108
       
108
       
-
       
    - name: Request reviews

     

       
109
       
109
       
-
       
      run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"

     

       
110
       
110
       
-
       
      env:

     

       
111
       
111
       
-
       
        GH_TOKEN: ${{ steps.app-token.outputs.token }}

     

       
107
       
107
       
+
       
      - name: Request reviews

     

       
108
       
108
       
+
       
        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"

     

       
109
       
109
       
+
       
        env:

     

       
110
       
110
       
+
       
          GH_TOKEN: ${{ steps.app-token.outputs.token }}

     

···

       
1
       
1
       
 
       
name: "Checking EditorConfig v2"

     

       
2
       
2
       
 
       


     

       
3
       
3
       
-
       
permissions:

     

       
4
       
4
       
-
       
  pull-requests: read

     

       
5
       
5
       
-
       
  contents: read

     

       
6
       
6
       
-
       


     

       
7
       
3
       
 
       
on:

     

       
8
       
8
       
-
       
  # avoids approving first time contributors

     

       
9
       
4
       
 
       
  pull_request_target:

     

       
10
       
10
       
-
       
    branches-ignore:

     

       
11
       
11
       
-
       
      - 'release-**'

     

       
5
       
5
       
+
       


     

       
6
       
6
       
+
       
permissions: {}

     

       
12
       
7
       
 
       


     

       
13
       
8
       
 
       
jobs:

     

       
14
       
9
       
 
       
  get-merge-commit:

     
···

       
18
       
13
       
 
       
    name: editorconfig-check

     

       
19
       
14
       
 
       
    runs-on: ubuntu-24.04

     

       
20
       
15
       
 
       
    needs: get-merge-commit

     

       
21
       
21
       
-
       
    if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
16
       
16
       
+
       
    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
22
       
17
       
 
       
    steps:

     

       
23
       
23
       
-
       
    - name: Get list of changed files from PR

     

       
24
       
24
       
-
       
      env:

     

       
25
       
25
       
-
       
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

     

       
26
       
26
       
-
       
      run: |

     

       
27
       
27
       
-
       
        gh api \

     

       
28
       
28
       
-
       
          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \

     

       
29
       
29
       
-
       
          | jq '.[] | select(.status != "removed") | .filename' \

     

       
30
       
30
       
-
       
          > "$HOME/changed_files"

     

       
31
       
31
       
-
       
    - name: print list of changed files

     

       
32
       
32
       
-
       
      run: |

     

       
33
       
33
       
-
       
        cat "$HOME/changed_files"

     

       
34
       
34
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
35
       
35
       
-
       
      with:

     

       
36
       
36
       
-
       
        # pull_request_target checks out the base branch by default

     

       
37
       
37
       
-
       
        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
38
       
38
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
39
       
39
       
-
       
      with:

     

       
40
       
40
       
-
       
        # nixpkgs commit is pinned so that it doesn't break

     

       
41
       
41
       
-
       
        # editorconfig-checker 2.4.0

     

       
42
       
42
       
-
       
        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz

     

       
43
       
43
       
-
       
    - name: Checking EditorConfig

     

       
44
       
44
       
-
       
      run: |

     

       
45
       
45
       
-
       
        < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'

     

       
46
       
46
       
-
       
    - if: ${{ failure() }}

     

       
47
       
47
       
-
       
      run: |

     

       
48
       
48
       
-
       
        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

     

       
18
       
18
       
+
       
      - name: Get list of changed files from PR

     

       
19
       
19
       
+
       
        env:

     

       
20
       
20
       
+
       
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

     

       
21
       
21
       
+
       
        run: |

     

       
22
       
22
       
+
       
          gh api \

     

       
23
       
23
       
+
       
            repos/${{ github.repository }}/pulls/${{ github.event.number }}/files --paginate \

     

       
24
       
24
       
+
       
            | jq '.[] | select(.status != "removed") | .filename' \

     

       
25
       
25
       
+
       
            > "$HOME/changed_files"

     

       
26
       
26
       
+
       


     

       
27
       
27
       
+
       
      - name: print list of changed files

     

       
28
       
28
       
+
       
        run: |

     

       
29
       
29
       
+
       
          cat "$HOME/changed_files"

     

       
30
       
30
       
+
       


     

       
31
       
31
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
32
       
32
       
+
       
        with:

     

       
33
       
33
       
+
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
34
       
34
       
+
       


     

       
35
       
35
       
+
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
36
       
36
       
+
       
        with:

     

       
37
       
37
       
+
       
          # nixpkgs commit is pinned so that it doesn't break

     

       
38
       
38
       
+
       
          # editorconfig-checker 2.4.0

     

       
39
       
39
       
+
       
          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz

     

       
40
       
40
       
+
       


     

       
41
       
41
       
+
       
      - name: Checking EditorConfig

     

       
42
       
42
       
+
       
        run: |

     

       
43
       
43
       
+
       
          < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'

     

       
44
       
44
       
+
       


     

       
45
       
45
       
+
       
      - if: ${{ failure() }}

     

       
46
       
46
       
+
       
        run: |

     

       
47
       
47
       
+
       
          echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

     

···

       
1
       
1
       
 
       
name: "Building Nixpkgs lib-tests"

     

       
2
       
2
       
 
       


     

       
3
       
3
       
-
       
permissions:

     

       
4
       
4
       
-
       
  contents: read

     

       
5
       
5
       
-
       


     

       
6
       
3
       
 
       
on:

     

       
7
       
4
       
 
       
  pull_request_target:

     

       
8
       
5
       
 
       
    paths:

     

       
9
       
6
       
 
       
      - 'lib/**'

     

       
7
       
7
       
+
       


     

       
8
       
8
       
+
       
permissions: {}

     

       
9
       
9
       
+
       


     

       
10
       
10
       
 
       
jobs:

     

       
11
       
11
       
 
       
  get-merge-commit:

     

       
12
       
12
       
 
       
    uses: ./.github/workflows/get-merge-commit.yml

     
···

       
19
       
19
       
 
       
    steps:

     

       
20
       
20
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
21
       
21
       
 
       
        with:

     

       
22
       
22
       
-
       
          # pull_request_target checks out the base branch by default

     

       
23
       
22
       
 
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
23
       
23
       
+
       


     

       
24
       
24
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
25
       
25
       
 
       
        with:

     

       
26
       
26
       
-
       
          # explicitly enable sandbox

     

       
27
       
26
       
 
       
          extra_nix_config: sandbox = true

     

       
27
       
27
       
+
       


     

       
28
       
28
       
 
       
      - name: Building Nixpkgs lib-tests

     

       
29
       
29
       
 
       
        run: |

     

       
30
       
30
       
 
       
          nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix

     

···

       
12
       
12
       
 
       
      - haskell-updates

     

       
13
       
13
       
 
       
      - python-updates

     

       
14
       
14
       
 
       


     

       
15
       
15
       
-
       
permissions:

     

       
16
       
16
       
-
       
  contents: read

     

       
15
       
15
       
+
       
permissions: {}

     

       
17
       
16
       
 
       


     

       
18
       
17
       
 
       
jobs:

     

       
19
       
18
       
 
       
  get-merge-commit:

     
···

       
23
       
22
       
 
       
    name: Attributes

     

       
24
       
23
       
 
       
    runs-on: ubuntu-24.04

     

       
25
       
24
       
 
       
    needs: get-merge-commit

     

       
26
       
26
       
-
       
    # Skip this and dependent steps if the PR can't be merged

     

       
27
       
25
       
 
       
    if: needs.get-merge-commit.outputs.mergedSha

     

       
28
       
26
       
 
       
    outputs:

     

       
29
       
29
       
-
       
      baseSha: ${{ steps.baseSha.outputs.baseSha }}

     

       
27
       
27
       
+
       
      targetSha: ${{ steps.targetSha.outputs.targetSha }}

     

       
30
       
28
       
 
       
      systems: ${{ steps.systems.outputs.systems }}

     

       
31
       
29
       
 
       
    steps:

     

       
32
       
30
       
 
       
      - name: Check out the PR at the test merge commit

     
···

       
36
       
34
       
 
       
          fetch-depth: 2

     

       
37
       
35
       
 
       
          path: nixpkgs

     

       
38
       
36
       
 
       


     

       
39
       
39
       
-
       
      - name: Determine base commit

     

       
37
       
37
       
+
       
      - name: Determine target commit

     

       
40
       
38
       
 
       
        if: github.event_name == 'pull_request_target'

     

       
41
       
41
       
-
       
        id: baseSha

     

       
39
       
39
       
+
       
        id: targetSha

     

       
42
       
40
       
 
       
        run: |

     

       
43
       
43
       
-
       
          baseSha=$(git -C nixpkgs rev-parse HEAD^1)

     

       
44
       
44
       
-
       
          echo "baseSha=$baseSha" >> "$GITHUB_OUTPUT"

     

       
41
       
41
       
+
       
          targetSha=$(git -C nixpkgs rev-parse HEAD^1)

     

       
42
       
42
       
+
       
          echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"

     

       
45
       
43
       
 
       


     

       
46
       
44
       
 
       
      - name: Install Nix

     

       
47
       
45
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
46
       
46
       
+
       
        with:

     

       
47
       
47
       
+
       
          extra_nix_config: sandbox = true

     

       
48
       
48
       
 
       


     

       
49
       
49
       
 
       
      - name: Evaluate the list of all attributes and get the systems matrix

     

       
50
       
50
       
 
       
        id: systems

     
···

       
61
       
61
       
 
       
  eval-aliases:

     

       
62
       
62
       
 
       
    name: Eval nixpkgs with aliases enabled

     

       
63
       
63
       
 
       
    runs-on: ubuntu-24.04

     

       
64
       
64
       
-
       
    needs: [ attrs, get-merge-commit ]

     

       
64
       
64
       
+
       
    needs: [ get-merge-commit ]

     

       
65
       
65
       
 
       
    steps:

     

       
66
       
66
       
 
       
      - name: Check out the PR at the test merge commit

     

       
67
       
67
       
 
       
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     
···

       
71
       
71
       
 
       


     

       
72
       
72
       
 
       
      - name: Install Nix

     

       
73
       
73
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
74
       
74
       
+
       
        with:

     

       
75
       
75
       
+
       
          extra_nix_config: sandbox = true

     

       
74
       
76
       
 
       


     

       
75
       
77
       
 
       
      - name: Query nixpkgs with aliases enabled to check for basic syntax errors

     

       
76
       
78
       
 
       
        run: |

     
···

       
106
       
108
       
 
       


     

       
107
       
109
       
 
       
      - name: Install Nix

     

       
108
       
110
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
111
       
111
       
+
       
        with:

     

       
112
       
112
       
+
       
          extra_nix_config: sandbox = true

     

       
109
       
113
       
 
       


     

       
110
       
114
       
 
       
      - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes

     

       
111
       
115
       
 
       
        env:

     
···

       
128
       
132
       
 
       
    runs-on: ubuntu-24.04

     

       
129
       
133
       
 
       
    needs: [ outpaths, attrs, get-merge-commit ]

     

       
130
       
134
       
 
       
    outputs:

     

       
131
       
131
       
-
       
      baseRunId: ${{ steps.baseRunId.outputs.baseRunId }}

     

       
135
       
135
       
+
       
      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}

     

       
132
       
136
       
 
       
    steps:

     

       
133
       
137
       
 
       
      - name: Download output paths and eval stats for all systems

     

       
134
       
138
       
 
       
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

     
···

       
145
       
149
       
 
       


     

       
146
       
150
       
 
       
      - name: Install Nix

     

       
147
       
151
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
152
       
152
       
+
       
        with:

     

       
153
       
153
       
+
       
          extra_nix_config: sandbox = true

     

       
148
       
154
       
 
       


     

       
149
       
155
       
 
       
      - name: Combine all output paths and eval stats

     

       
150
       
156
       
 
       
        run: |

     
···

       
158
       
164
       
 
       
          name: result

     

       
159
       
165
       
 
       
          path: prResult/*

     

       
160
       
166
       
 
       


     

       
161
       
161
       
-
       
      - name: Get base run id

     

       
162
       
162
       
-
       
        if: needs.attrs.outputs.baseSha

     

       
163
       
163
       
-
       
        id: baseRunId

     

       
167
       
167
       
+
       
      - name: Get target run id

     

       
168
       
168
       
+
       
        if: needs.attrs.outputs.targetSha

     

       
169
       
169
       
+
       
        id: targetRunId

     

       
164
       
170
       
 
       
        run: |

     

       
165
       
165
       
-
       
          # Get the latest eval.yml workflow run for the PR's base commit

     

       
171
       
171
       
+
       
          # Get the latest eval.yml workflow run for the PR's target commit

     

       
166
       
172
       
 
       
          if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \

     

       
167
       
173
       
 
       
            -f head_sha="$BASE_SHA" -f event=push \

     

       
168
       
174
       
 
       
            --jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \

     
···

       
185
       
191
       
 
       
            exit 0

     

       
186
       
192
       
 
       
          fi

     

       
187
       
193
       
 
       


     

       
188
       
188
       
-
       
          echo "baseRunId=$runId" >> "$GITHUB_OUTPUT"

     

       
194
       
194
       
+
       
          echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"

     

       
189
       
195
       
 
       
        env:

     

       
190
       
196
       
 
       
          REPOSITORY: ${{ github.repository }}

     

       
191
       
191
       
-
       
          BASE_SHA: ${{ needs.attrs.outputs.baseSha }}

     

       
197
       
197
       
+
       
          BASE_SHA: ${{ needs.attrs.outputs.targetSha }}

     

       
192
       
198
       
 
       
          GH_TOKEN: ${{ github.token }}

     

       
193
       
199
       
 
       


     

       
194
       
200
       
 
       
      - uses: actions/download-artifact@v4

     

       
195
       
195
       
-
       
        if: steps.baseRunId.outputs.baseRunId

     

       
201
       
201
       
+
       
        if: steps.targetRunId.outputs.targetRunId

     

       
196
       
202
       
 
       
        with:

     

       
197
       
203
       
 
       
          name: result

     

       
198
       
198
       
-
       
          path: baseResult

     

       
204
       
204
       
+
       
          path: targetResult

     

       
199
       
205
       
 
       
          github-token: ${{ github.token }}

     

       
200
       
200
       
-
       
          run-id: ${{ steps.baseRunId.outputs.baseRunId }}

     

       
206
       
206
       
+
       
          run-id: ${{ steps.targetRunId.outputs.targetRunId }}

     

       
201
       
207
       
 
       


     

       
202
       
202
       
-
       
      - name: Compare against the base branch

     

       
203
       
203
       
-
       
        if: steps.baseRunId.outputs.baseRunId

     

       
208
       
208
       
+
       
      - name: Compare against the target branch

     

       
209
       
209
       
+
       
        if: steps.targetRunId.outputs.targetRunId

     

       
204
       
210
       
 
       
        run: |

     

       
205
       
205
       
-
       
          git -C nixpkgs worktree add ../base ${{ needs.attrs.outputs.baseSha }}

     

       
206
       
206
       
-
       
          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.baseSha }} ${{ needs.attrs.outputs.mergedSha }} \

     

       
211
       
211
       
+
       
          git -C nixpkgs worktree add ../target ${{ needs.attrs.outputs.targetSha }}

     

       
212
       
212
       
+
       
          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.targetSha }} \

     

       
207
       
213
       
 
       
            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json

     

       
208
       
214
       
 
       


     

       
209
       
209
       
-
       
          # Use the base branch to get accurate maintainer info

     

       
210
       
210
       
-
       
          nix-build base/ci -A eval.compare \

     

       
211
       
211
       
-
       
            --arg beforeResultDir ./baseResult \

     

       
215
       
215
       
+
       
          # Use the target branch to get accurate maintainer info

     

       
216
       
216
       
+
       
          nix-build target/ci -A eval.compare \

     

       
217
       
217
       
+
       
            --arg beforeResultDir ./targetResult \

     

       
212
       
218
       
 
       
            --arg afterResultDir ./prResult \

     

       
213
       
219
       
 
       
            --arg touchedFilesJson ./touched-files.json \

     

       
214
       
220
       
 
       
            -o comparison

     
···

       
216
       
222
       
 
       
          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"

     

       
217
       
223
       
 
       


     

       
218
       
224
       
 
       
      - name: Upload the combined results

     

       
219
       
219
       
-
       
        if: steps.baseRunId.outputs.baseRunId

     

       
225
       
225
       
+
       
        if: steps.targetRunId.outputs.targetRunId

     

       
220
       
226
       
 
       
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0

     

       
221
       
227
       
 
       
        with:

     

       
222
       
228
       
 
       
          name: comparison

     
···

       
227
       
233
       
 
       
    name: Tag

     

       
228
       
234
       
 
       
    runs-on: ubuntu-24.04

     

       
229
       
235
       
 
       
    needs: [ attrs, process ]

     

       
230
       
230
       
-
       
    if: needs.process.outputs.baseRunId

     

       
236
       
236
       
+
       
    if: needs.process.outputs.targetRunId

     

       
231
       
237
       
 
       
    permissions:

     

       
232
       
238
       
 
       
      pull-requests: write

     

       
233
       
239
       
 
       
      statuses: write

     
···

       
254
       
260
       
 
       
      - name: Check out Nixpkgs at the base commit

     

       
255
       
261
       
 
       
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
256
       
262
       
 
       
        with:

     

       
257
       
257
       
-
       
          ref: ${{ needs.attrs.outputs.baseSha }}

     

       
263
       
263
       
+
       
          ref: ${{ needs.attrs.outputs.targetSha }}

     

       
258
       
264
       
 
       
          path: base

     

       
259
       
265
       
 
       
          sparse-checkout: ci

     

       
260
       
266
       
 
       


     

···

       
7
       
7
       
 
       
        description: "The merge commit SHA"

     

       
8
       
8
       
 
       
        value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}

     

       
9
       
9
       
 
       


     

       
10
       
10
       
-
       
# We need a token to query the API, but it doesn't need any special permissions

     

       
11
       
10
       
 
       
permissions: {}

     

       
12
       
11
       
 
       


     

       
13
       
12
       
 
       
jobs:

     
···

       
16
       
15
       
 
       
    outputs:

     

       
17
       
16
       
 
       
      mergedSha: ${{ steps.merged.outputs.mergedSha }}

     

       
18
       
17
       
 
       
    steps:

     

       
19
       
19
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
20
       
20
       
-
       
      with:

     

       
21
       
21
       
-
       
        path: base

     

       
22
       
22
       
-
       
        sparse-checkout: ci

     

       
23
       
23
       
-
       
    - name: Check if the PR can be merged and get the test merge commit

     

       
24
       
24
       
-
       
      id: merged

     

       
25
       
25
       
-
       
      env:

     

       
26
       
26
       
-
       
        GH_TOKEN: ${{ github.token }}

     

       
27
       
27
       
-
       
        GH_EVENT: ${{ github.event_name }}

     

       
28
       
28
       
-
       
      run: |

     

       
29
       
29
       
-
       
        case "$GH_EVENT" in

     

       
30
       
30
       
-
       
          push)

     

       
31
       
31
       
-
       
            echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"

     

       
32
       
32
       
-
       
            ;;

     

       
33
       
33
       
-
       
          pull_request_target)

     

       
34
       
34
       
-
       
            if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then

     

       
35
       
35
       
-
       
              echo "Checking the merge commit $mergedSha"

     

       
36
       
36
       
-
       
              echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"

     

       
37
       
37
       
-
       
            else

     

       
38
       
38
       
-
       
              # Skipping so that no notifications are sent

     

       
39
       
39
       
-
       
              echo "Skipping the rest..."

     

       
40
       
40
       
-
       
            fi

     

       
41
       
41
       
-
       
            ;;

     

       
42
       
42
       
-
       
        esac

     

       
43
       
43
       
-
       
        rm -rf base

     

       
18
       
18
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
19
       
19
       
+
       
        with:

     

       
20
       
20
       
+
       
          path: base

     

       
21
       
21
       
+
       
          sparse-checkout: ci

     

       
22
       
22
       
+
       


     

       
23
       
23
       
+
       
      - name: Check if the PR can be merged and get the test merge commit

     

       
24
       
24
       
+
       
        id: merged

     

       
25
       
25
       
+
       
        env:

     

       
26
       
26
       
+
       
          GH_TOKEN: ${{ github.token }}

     

       
27
       
27
       
+
       
          GH_EVENT: ${{ github.event_name }}

     

       
28
       
28
       
+
       
        run: |

     

       
29
       
29
       
+
       
          case "$GH_EVENT" in

     

       
30
       
30
       
+
       
            push)

     

       
31
       
31
       
+
       
              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"

     

       
32
       
32
       
+
       
              ;;

     

       
33
       
33
       
+
       
            pull_request_target)

     

       
34
       
34
       
+
       
              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then

     

       
35
       
35
       
+
       
                echo "Checking the merge commit $mergedSha"

     

       
36
       
36
       
+
       
                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"

     

       
37
       
37
       
+
       
              else

     

       
38
       
38
       
+
       
                # Skipping so that no notifications are sent

     

       
39
       
39
       
+
       
                echo "Skipping the rest..."

     

       
40
       
40
       
+
       
              fi

     

       
41
       
41
       
+
       
              ;;

     

       
42
       
42
       
+
       
          esac

     

       
43
       
43
       
+
       
          rm -rf base

     

···

       
1
       
1
       
+
       
# WARNING:

     

       
2
       
2
       
+
       
# When extending this action, be aware that $GITHUB_TOKEN allows some write

     

       
3
       
3
       
+
       
# access to the GitHub API. This means that it should not evaluate user input in

     

       
4
       
4
       
+
       
# a way that allows code injection.

     

       
5
       
5
       
+
       


     

       
1
       
6
       
 
       
name: "Label PR"

     

       
2
       
7
       
 
       


     

       
3
       
8
       
 
       
on:

     

       
4
       
9
       
 
       
  pull_request_target:

     

       
5
       
10
       
 
       
    types: [edited, opened, synchronize, reopened]

     

       
6
       
11
       
 
       


     

       
7
       
7
       
-
       
# WARNING:

     

       
8
       
8
       
-
       
# When extending this action, be aware that $GITHUB_TOKEN allows some write

     

       
9
       
9
       
-
       
# access to the GitHub API. This means that it should not evaluate user input in

     

       
10
       
10
       
-
       
# a way that allows code injection.

     

       
11
       
11
       
-
       


     

       
12
       
12
       
 
       
permissions:

     

       
13
       
13
       
 
       
  contents: read

     

       
14
       
14
       
 
       
  pull-requests: write

     
···

       
19
       
19
       
 
       
    runs-on: ubuntu-24.04

     

       
20
       
20
       
 
       
    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
21
       
21
       
 
       
    steps:

     

       
22
       
22
       
-
       
    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0

     

       
23
       
23
       
-
       
      with:

     

       
24
       
24
       
-
       
        repo-token: ${{ secrets.GITHUB_TOKEN }}

     

       
25
       
25
       
-
       
        sync-labels: true

     

       
22
       
22
       
+
       
      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0

     

       
23
       
23
       
+
       
        with:

     

       
24
       
24
       
+
       
          repo-token: ${{ secrets.GITHUB_TOKEN }}

     

       
25
       
25
       
+
       
          sync-labels: true

     

···

       
1
       
1
       
 
       
name: "Build NixOS manual v2"

     

       
2
       
2
       
 
       


     

       
3
       
3
       
-
       
permissions:

     

       
4
       
4
       
-
       
  contents: read

     

       
5
       
5
       
-
       


     

       
6
       
3
       
 
       
on:

     

       
7
       
4
       
 
       
  pull_request_target:

     

       
8
       
5
       
 
       
    branches:

     
···

       
10
       
7
       
 
       
    paths:

     

       
11
       
8
       
 
       
      - 'nixos/**'

     

       
12
       
9
       
 
       


     

       
10
       
10
       
+
       
permissions: {}

     

       
11
       
11
       
+
       


     

       
13
       
12
       
 
       
jobs:

     

       
14
       
13
       
 
       
  nixos:

     

       
15
       
14
       
 
       
    name: nixos-manual-build

     

       
16
       
15
       
 
       
    runs-on: ubuntu-24.04

     

       
17
       
17
       
-
       
    if: github.repository_owner == 'NixOS'

     

       
18
       
16
       
 
       
    steps:

     

       
19
       
17
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
20
       
18
       
 
       
        with:

     

       
21
       
21
       
-
       
          # pull_request_target checks out the base branch by default

     

       
22
       
19
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
20
       
20
       
+
       


     

       
23
       
21
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
24
       
22
       
 
       
        with:

     

       
25
       
25
       
-
       
          # explicitly enable sandbox

     

       
26
       
23
       
 
       
          extra_nix_config: sandbox = true

     

       
24
       
24
       
+
       


     

       
27
       
25
       
 
       
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
26
       
26
       
+
       
        if: github.repository_owner == 'NixOS'

     

       
28
       
27
       
 
       
        with:

     

       
29
       
28
       
 
       
          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
30
       
29
       
 
       
          name: nixpkgs-ci

     

       
31
       
30
       
 
       
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
31
       
31
       
+
       


     

       
32
       
32
       
 
       
      - name: Building NixOS manual

     

       
33
       
33
       
 
       
        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

     

···

       
1
       
1
       
 
       
name: "Build Nixpkgs manual v2"

     

       
2
       
2
       
 
       


     

       
3
       
3
       
-
       
permissions:

     

       
4
       
4
       
-
       
  contents: read

     

       
5
       
5
       
-
       


     

       
6
       
3
       
 
       
on:

     

       
7
       
4
       
 
       
  pull_request_target:

     

       
8
       
5
       
 
       
    branches:

     
···

       
12
       
9
       
 
       
      - 'lib/**'

     

       
13
       
10
       
 
       
      - 'pkgs/tools/nix/nixdoc/**'

     

       
14
       
11
       
 
       


     

       
12
       
12
       
+
       
permissions: {}

     

       
13
       
13
       
+
       


     

       
15
       
14
       
 
       
jobs:

     

       
16
       
15
       
 
       
  nixpkgs:

     

       
17
       
16
       
 
       
    name: nixpkgs-manual-build

     

       
18
       
17
       
 
       
    runs-on: ubuntu-24.04

     

       
19
       
19
       
-
       
    if: github.repository_owner == 'NixOS'

     

       
20
       
18
       
 
       
    steps:

     

       
21
       
19
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
22
       
20
       
 
       
        with:

     

       
23
       
23
       
-
       
          # pull_request_target checks out the base branch by default

     

       
24
       
21
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
22
       
22
       
+
       


     

       
25
       
23
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
26
       
24
       
 
       
        with:

     

       
27
       
27
       
-
       
          # explicitly enable sandbox

     

       
28
       
25
       
 
       
          extra_nix_config: sandbox = true

     

       
26
       
26
       
+
       


     

       
29
       
27
       
 
       
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
28
       
28
       
+
       
        if: github.repository_owner == 'NixOS'

     

       
30
       
29
       
 
       
        with:

     

       
31
       
30
       
 
       
          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
32
       
31
       
 
       
          name: nixpkgs-ci

     

       
33
       
32
       
 
       
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
33
       
33
       
+
       


     

       
34
       
34
       
 
       
      - name: Building Nixpkgs manual

     

       
35
       
35
       
 
       
        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests

     

···

       
1
       
1
       
 
       
name: "Check whether nix files are parseable v2"

     

       
2
       
2
       
 
       


     

       
3
       
3
       
-
       
permissions:

     

       
4
       
4
       
-
       
  pull-requests: read

     

       
5
       
5
       
-
       
  contents: read

     

       
6
       
6
       
-
       


     

       
7
       
3
       
 
       
on:

     

       
8
       
8
       
-
       
  # avoids approving first time contributors

     

       
9
       
4
       
 
       
  pull_request_target:

     

       
10
       
10
       
-
       
    branches-ignore:

     

       
11
       
11
       
-
       
      - 'release-**'

     

       
5
       
5
       
+
       


     

       
6
       
6
       
+
       
permissions: {}

     

       
12
       
7
       
 
       


     

       
13
       
8
       
 
       
jobs:

     

       
14
       
9
       
 
       
  get-merge-commit:

     
···

       
18
       
13
       
 
       
    name: nix-files-parseable-check

     

       
19
       
14
       
 
       
    runs-on: ubuntu-24.04

     

       
20
       
15
       
 
       
    needs: get-merge-commit

     

       
21
       
21
       
-
       
    if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
16
       
16
       
+
       
    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
22
       
17
       
 
       
    steps:

     

       
23
       
23
       
-
       
    - name: Get list of changed files from PR

     

       
24
       
24
       
-
       
      env:

     

       
25
       
25
       
-
       
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

     

       
26
       
26
       
-
       
      run: |

     

       
27
       
27
       
-
       
        gh api \

     

       
28
       
28
       
-
       
          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \

     

       
29
       
29
       
-
       
          | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \

     

       
30
       
30
       
-
       
          > "$HOME/changed_files"

     

       
31
       
31
       
-
       
        if [[ -s "$HOME/changed_files" ]]; then

     

       
32
       
32
       
-
       
          echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"

     

       
33
       
33
       
-
       
        fi

     

       
34
       
34
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
35
       
35
       
-
       
      with:

     

       
36
       
36
       
-
       
        # pull_request_target checks out the base branch by default

     

       
37
       
37
       
-
       
        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
38
       
38
       
-
       
      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

     

       
39
       
39
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
40
       
40
       
-
       
      with:

     

       
41
       
41
       
-
       
        nix_path: nixpkgs=channel:nixpkgs-unstable

     

       
42
       
42
       
-
       
    - name: Parse all changed or added nix files

     

       
43
       
43
       
-
       
      run: |

     

       
44
       
44
       
-
       
        ret=0

     

       
45
       
45
       
-
       
        while IFS= read -r file; do

     

       
46
       
46
       
-
       
          out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }

     

       
47
       
47
       
-
       
        done < "$HOME/changed_files"

     

       
48
       
48
       
-
       
        exit "$ret"

     

       
49
       
49
       
-
       
      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

     

       
18
       
18
       
+
       
      - name: Get list of changed files from PR

     

       
19
       
19
       
+
       
        env:

     

       
20
       
20
       
+
       
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

     

       
21
       
21
       
+
       
        run: |

     

       
22
       
22
       
+
       
          gh api \

     

       
23
       
23
       
+
       
            repos/${{ github.repository }}/pulls/${{github.event.number}}/files --paginate \

     

       
24
       
24
       
+
       
            | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \

     

       
25
       
25
       
+
       
            > "$HOME/changed_files"

     

       
26
       
26
       
+
       
          if [[ -s "$HOME/changed_files" ]]; then

     

       
27
       
27
       
+
       
            echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"

     

       
28
       
28
       
+
       
          fi

     

       
29
       
29
       
+
       


     

       
30
       
30
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
31
       
31
       
+
       
        with:

     

       
32
       
32
       
+
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
33
       
33
       
+
       
        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

     

       
34
       
34
       
+
       


     

       
35
       
35
       
+
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
36
       
36
       
+
       
        with:

     

       
37
       
37
       
+
       
          extra_nix_config: sandbox = true

     

       
38
       
38
       
+
       
          nix_path: nixpkgs=channel:nixpkgs-unstable

     

       
39
       
39
       
+
       


     

       
40
       
40
       
+
       
      - name: Parse all changed or added nix files

     

       
41
       
41
       
+
       
        run: |

     

       
42
       
42
       
+
       
          ret=0

     

       
43
       
43
       
+
       
          while IFS= read -r file; do

     

       
44
       
44
       
+
       
            out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }

     

       
45
       
45
       
+
       
          done < "$HOME/changed_files"

     

       
46
       
46
       
+
       
          exit "$ret"

     

       
47
       
47
       
+
       
        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

     

···

       
2
       
2
       
 
       
# Among other checks, it makes sure that `pkgs/by-name` (see `../../pkgs/by-name/README.md`) follows the validity rules outlined in [RFC 140](https://github.com/NixOS/rfcs/pull/140).

     

       
3
       
3
       
 
       
# When you make changes to this workflow, please also update `ci/nixpkgs-vet.sh` to reflect the impact of your work to the CI.

     

       
4
       
4
       
 
       
# See https://github.com/NixOS/nixpkgs-vet for details on the tool and its checks.

     

       
5
       
5
       
+
       


     

       
5
       
6
       
 
       
name: Vet nixpkgs

     

       
6
       
7
       
 
       


     

       
7
       
8
       
 
       
on:

     

       
8
       
8
       
-
       
  # Using pull_request_target instead of pull_request avoids having to approve first time contributors.

     

       
9
       
9
       
 
       
  pull_request_target:

     

       
10
       
10
       
 
       
    # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.

     

       
11
       
11
       
 
       
    # Instead it causes an `edited` event, so we need to add it explicitly here.

     
···

       
33
       
33
       
 
       
    steps:

     

       
34
       
34
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
35
       
35
       
 
       
        with:

     

       
36
       
36
       
-
       
          # pull_request_target checks out the base branch by default

     

       
37
       
36
       
 
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
38
       
37
       
 
       
          # Fetches the merge commit and its parents

     

       
39
       
38
       
 
       
          fetch-depth: 2

     

       
40
       
40
       
-
       
      - name: Checking out base branch

     

       
39
       
39
       
+
       


     

       
40
       
40
       
+
       
      - name: Checking out target branch

     

       
41
       
41
       
 
       
        run: |

     

       
42
       
42
       
-
       
          base=$(mktemp -d)

     

       
43
       
43
       
-
       
          git worktree add "$base" "$(git rev-parse HEAD^1)"

     

       
44
       
44
       
-
       
          echo "base=$base" >> "$GITHUB_ENV"

     

       
42
       
42
       
+
       
          target=$(mktemp -d)

     

       
43
       
43
       
+
       
          git worktree add "$target" "$(git rev-parse HEAD^1)"

     

       
44
       
44
       
+
       
          echo "target=$target" >> "$GITHUB_ENV"

     

       
45
       
45
       
+
       


     

       
45
       
46
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
47
       
47
       
+
       


     

       
46
       
48
       
 
       
      - name: Fetching the pinned tool

     

       
47
       
49
       
 
       
        # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh

     

       
48
       
50
       
 
       
        run: |

     
···

       
55
       
57
       
 
       


     

       
56
       
58
       
 
       
          # Adds a result symlink as a GC root.

     

       
57
       
59
       
 
       
          nix-store --realise "$toolPath" --add-root result

     

       
60
       
60
       
+
       


     

       
58
       
61
       
 
       
      - name: Running nixpkgs-vet

     

       
59
       
62
       
 
       
        env:

     

       
60
       
63
       
 
       
          # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/

     

       
61
       
64
       
 
       
          CLICOLOR_FORCE: 1

     

       
62
       
65
       
 
       
        run: |

     

       
63
       
63
       
-
       
          if result/bin/nixpkgs-vet --base "$base" .; then

     

       
66
       
66
       
+
       
          if result/bin/nixpkgs-vet --base "$target" .; then

     

       
64
       
67
       
 
       
            exit 0

     

       
65
       
68
       
 
       
          else

     

       
66
       
69
       
 
       
            exitCode=$?

     

···

       
15
       
15
       
 
       
    name: "This PR is is targeting a channel branch"

     

       
16
       
16
       
 
       
    runs-on: ubuntu-24.04

     

       
17
       
17
       
 
       
    steps:

     

       
18
       
18
       
-
       
    - run: |

     

       
19
       
19
       
-
       
        cat <<EOF

     

       
20
       
20
       
-
       
        The nixos-* and nixpkgs-* branches are pushed to by the channel

     

       
21
       
21
       
-
       
        release script and should not be merged into directly.

     

       
18
       
18
       
+
       
      - run: |

     

       
19
       
19
       
+
       
          cat <<EOF

     

       
20
       
20
       
+
       
          The nixos-* and nixpkgs-* branches are pushed to by the channel

     

       
21
       
21
       
+
       
          release script and should not be merged into directly.

     

       
22
       
22
       
 
       


     

       
23
       
23
       
-
       
        Please target the equivalent release-* branch or master instead.

     

       
24
       
24
       
-
       
        EOF

     

       
25
       
25
       
-
       
        exit 1

     

       
23
       
23
       
+
       
          Please target the equivalent release-* branch or master instead.

     

       
24
       
24
       
+
       
          EOF

     

       
25
       
25
       
+
       
          exit 1