···

       
11
       
 
       


     

       
12
       
 
       
<!-- A clear and concise description of what the bug is. -->

     

       
13
       
 
       


     

       
14
       
-
       
## Steps To Reproduce

     

       
15
       
 
       


     

       
16
       
 
       
Steps to reproduce the behavior:

     

       
17
       
 
       


     

···

       
11
       
 
       


     

       
12
       
 
       
<!-- A clear and concise description of what the bug is. -->

     

       
13
       
 
       


     

       
14
       
+
       
## Steps to reproduce

     

       
15
       
 
       


     

       
16
       
 
       
Steps to reproduce the behavior:

     

       
17
       
 
       


     

···

       
7
       
 
       


     

       
8
       
 
       
---

     

       
9
       
 
       


     

       
10
       
-
       
## Steps To Reproduce

     

       
11
       
 
       


     

       
12
       
 
       
Steps to reproduce the behavior:

     

       
13
       
 
       


     

···

       
7
       
 
       


     

       
8
       
 
       
---

     

       
9
       
 
       


     

       
10
       
+
       
## Steps to reproduce

     

       
11
       
 
       


     

       
12
       
 
       
Steps to reproduce the behavior:

     

       
13
       
 
       


     

···

       
7
       
 
       


     

       
8
       
 
       
---

     

       
9
       
 
       


     

       
10
       
-
       
## Package Information

     

       
11
       
 
       


     

       
12
       
 
       
<!-- Search for the package here: https://search.nixos.org/packages?channel=unstable -->

     

       
13
       
 
       


     

···

       
7
       
 
       


     

       
8
       
 
       
---

     

       
9
       
 
       


     

       
10
       
+
       
## Package information

     

       
11
       
 
       


     

       
12
       
 
       
<!-- Search for the package here: https://search.nixos.org/packages?channel=unstable -->

     

       
13
       
 
       


     

···

       
31
       
 
       
avoiding hard-to-reproduce bugs, making content-addressed storage more effective

     

       
32
       
 
       
and reducing rebuilds in such systems.

     

       
33
       
 
       


     

       
34
       
-
       
## Steps To Reproduce

     

       
35
       
 
       


     

       
36
       
 
       
In the following steps, replace `<package>` with the canonical name of the

     

       
37
       
 
       
package.

     

···

       
31
       
 
       
avoiding hard-to-reproduce bugs, making content-addressed storage more effective

     

       
32
       
 
       
and reducing rebuilds in such systems.

     

       
33
       
 
       


     

       
34
       
+
       
## Steps to reproduce

     

       
35
       
 
       


     

       
36
       
 
       
In the following steps, replace `<package>` with the canonical name of the

     

       
37
       
 
       
package.

     

···

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

···

       
1
       
+
       
# GitHub Actions Workflows

     

       
2
       
+
       


     

       
3
       
+
       
Some architectural notes about key decisions and concepts in our workflows:

     

       
4
       
+
       


     

       
5
       
+
       
- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows. This has the advantage that those workflows will run without prior approval for external contributors.

     

       
6
       
+
       


     

       
7
       
+
       
- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches. **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible. Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.

     

       
8
       
+
       


     

       
9
       
+
       
- By definition `pull_request_target` runs in the context of the **base** of the pull request. This means, that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default. To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.

     

       
10
       
+
       


     

       
11
       
+
       
- To test the pull request's contents, we checkout the "test merge commit". This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?". The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore). This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout. Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.

     

       
12
       
+
       


     

       
13
       
+
       
- Various workflows need to make comparisons against the base branch. In this case, we checkout the parent of the "test merge commit" for best results. Note, that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.

     

       
14
       
+
       


     

       
15
       
+
       
## Terminology

     

       
16
       
+
       


     

       
17
       
+
       
- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions. Same as `github.event.pull_request.base.sha`.

     

       
18
       
+
       
- **head commit**: The HEAD commit in the pull request's branch. Same as `github.event.pull_request.head.sha`.

     

       
19
       
+
       
- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request. Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.

     

       
20
       
+
       
- **target commit**: The base branch's parent of the "test merge commit" to compare against.

     

···

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
1
       
 
       
name: Backport

     

       
0
       
 
       

     

       
2
       
 
       
on:

     

       
3
       
 
       
  pull_request_target:

     

       
4
       
 
       
    types: [closed, labeled]

     

       
5
       
-
       


     

       
6
       
-
       
# WARNING:

     

       
7
       
-
       
# When extending this action, be aware that $GITHUB_TOKEN allows write access to

     

       
8
       
-
       
# the GitHub repository. This means that it should not evaluate user input in a

     

       
9
       
-
       
# way that allows code injection.

     

       
10
       
 
       


     

       
11
       
 
       
permissions: {}

     

       
12
       
 
       


     
···

       
23
       
 
       
        with:

     

       
24
       
 
       
          app-id: ${{ vars.BACKPORT_APP_ID }}

     

       
25
       
 
       
          private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}

     

       
0
       
 
       

     

       
26
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
27
       
 
       
        with:

     

       
28
       
 
       
          ref: ${{ github.event.pull_request.head.sha }}

     

       
29
       
 
       
          token: ${{ steps.app-token.outputs.token }}

     

       
0
       
 
       

     

       
30
       
 
       
      - name: Create backport PRs

     

       
31
       
 
       
        uses: korthout/backport-action@be567af183754f6a5d831ae90f648954763f17f5 # v3.1.0

     

       
32
       
 
       
        with:

     

···

       
1
       
+
       
# WARNING:

     

       
2
       
+
       
# When extending this action, be aware that $GITHUB_TOKEN allows write access to

     

       
3
       
+
       
# the GitHub repository. This means that it should not evaluate user input in a

     

       
4
       
+
       
# way that allows code injection.

     

       
5
       
+
       


     

       
6
       
 
       
name: Backport

     

       
7
       
+
       


     

       
8
       
 
       
on:

     

       
9
       
 
       
  pull_request_target:

     

       
10
       
 
       
    types: [closed, labeled]

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
11
       
 
       


     

       
12
       
 
       
permissions: {}

     

       
13
       
 
       


     
···

       
24
       
 
       
        with:

     

       
25
       
 
       
          app-id: ${{ vars.BACKPORT_APP_ID }}

     

       
26
       
 
       
          private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}

     

       
27
       
+
       


     

       
28
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
29
       
 
       
        with:

     

       
30
       
 
       
          ref: ${{ github.event.pull_request.head.sha }}

     

       
31
       
 
       
          token: ${{ steps.app-token.outputs.token }}

     

       
32
       
+
       


     

       
33
       
 
       
      - name: Create backport PRs

     

       
34
       
 
       
        uses: korthout/backport-action@be567af183754f6a5d831ae90f648954763f17f5 # v3.1.0

     

       
35
       
 
       
        with:

     

···

       
1
       
-
       
name: Basic evaluation checks

     

       
2
       
-
       


     

       
3
       
-
       
on:

     

       
4
       
-
       
  workflow_dispatch

     

       
5
       
-
       
  # pull_request:

     

       
6
       
-
       
  #   branches:

     

       
7
       
-
       
  #    - master

     

       
8
       
-
       
  #    - release-**

     

       
9
       
-
       
  # push:

     

       
10
       
-
       
  #   branches:

     

       
11
       
-
       
  #    - master

     

       
12
       
-
       
  #    - release-**

     

       
13
       
-
       
permissions:

     

       
14
       
-
       
  contents: read

     

       
15
       
-
       


     

       
16
       
-
       
jobs:

     

       
17
       
-
       
  tests:

     

       
18
       
-
       
    name: basic-eval-checks

     

       
19
       
-
       
    runs-on: ubuntu-24.04

     

       
20
       
-
       
    # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback

     

       
21
       
-
       
    steps:

     

       
22
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
23
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
24
       
-
       
    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
25
       
-
       
      with:

     

       
26
       
-
       
        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
27
       
-
       
        name: nixpkgs-ci

     

       
28
       
-
       
        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'

     

       
29
       
-
       
    - run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build

     

       
30
       
-
       
    # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset

     

       
31
       
-
       
    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'

     

···

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

···

       
1
       
 
       
name: "Check cherry-picks"

     

       
0
       
 
       

     

       
2
       
 
       
on:

     

       
3
       
 
       
  pull_request_target:

     

       
4
       
 
       
    branches:

     

       
5
       
-
       
     - 'release-**'

     

       
6
       
-
       
     - 'staging-**'

     

       
7
       
-
       
     - '!staging-next'

     

       
8
       
 
       


     

       
9
       
 
       
permissions: {}

     

       
10
       
 
       


     
···

       
14
       
 
       
    runs-on: ubuntu-24.04

     

       
15
       
 
       
    if: github.repository_owner == 'NixOS'

     

       
16
       
 
       
    steps:

     

       
17
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
18
       
-
       
      with:

     

       
19
       
-
       
        fetch-depth: 0

     

       
20
       
-
       
        filter: blob:none

     

       
21
       
-
       
    - name: Check cherry-picks

     

       
22
       
-
       
      env:

     

       
23
       
-
       
        BASE_SHA: ${{ github.event.pull_request.base.sha }}

     

       
24
       
-
       
        HEAD_SHA: ${{ github.event.pull_request.head.sha }}

     

       
25
       
-
       
      run: |

     

       
26
       
-
       
        ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

     

       
0
       
 
       

     

···

       
1
       
 
       
name: "Check cherry-picks"

     

       
2
       
+
       


     

       
3
       
 
       
on:

     

       
4
       
 
       
  pull_request_target:

     

       
5
       
 
       
    branches:

     

       
6
       
+
       
      - 'release-**'

     

       
7
       
+
       
      - 'staging-**'

     

       
8
       
+
       
      - '!staging-next'

     

       
9
       
 
       


     

       
10
       
 
       
permissions: {}

     

       
11
       
 
       


     
···

       
15
       
 
       
    runs-on: ubuntu-24.04

     

       
16
       
 
       
    if: github.repository_owner == 'NixOS'

     

       
17
       
 
       
    steps:

     

       
18
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
19
       
+
       
        with:

     

       
20
       
+
       
          fetch-depth: 0

     

       
21
       
+
       
          filter: blob:none

     

       
22
       
+
       


     

       
23
       
+
       
      - name: Check cherry-picks

     

       
24
       
+
       
        env:

     

       
25
       
+
       
          BASE_SHA: ${{ github.event.pull_request.base.sha }}

     

       
26
       
+
       
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}

     

       
27
       
+
       
        run: |

     

       
28
       
+
       
          ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

     

···

       
4
       
 
       
  pull_request_target:

     

       
5
       
 
       
    paths:

     

       
6
       
 
       
      - 'maintainers/maintainer-list.nix'

     

       
7
       
-
       
permissions:

     

       
8
       
-
       
  contents: read

     

       
9
       
 
       


     

       
10
       
 
       
jobs:

     

       
11
       
 
       
  nixos:

     

       
12
       
 
       
    name: maintainer-list-check

     

       
13
       
 
       
    runs-on: ubuntu-24.04

     

       
14
       
-
       
    if: github.repository_owner == 'NixOS'

     

       
15
       
 
       
    steps:

     

       
16
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
17
       
 
       
        with:

     

       
18
       
-
       
          # pull_request_target checks out the base branch by default

     

       
19
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
20
       
 
       
          # Only these directories to perform the check

     

       
21
       
 
       
          sparse-checkout: |

     

       
22
       
 
       
            lib

     

       
23
       
 
       
            maintainers

     

       
0
       
 
       

     

       
24
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
25
       
 
       
        with:

     

       
26
       
-
       
          # explicitly enable sandbox

     

       
27
       
 
       
          extra_nix_config: sandbox = true

     

       
0
       
 
       

     

       
28
       
 
       
      - name: Check that maintainer-list.nix is sorted

     

       
29
       
 
       
        run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix

     

···

       
4
       
 
       
  pull_request_target:

     

       
5
       
 
       
    paths:

     

       
6
       
 
       
      - 'maintainers/maintainer-list.nix'

     

       
7
       
+
       


     

       
8
       
+
       
permissions: {}

     

       
9
       
 
       


     

       
10
       
 
       
jobs:

     

       
11
       
 
       
  nixos:

     

       
12
       
 
       
    name: maintainer-list-check

     

       
13
       
 
       
    runs-on: ubuntu-24.04

     

       
0
       
 
       

     

       
14
       
 
       
    steps:

     

       
15
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
16
       
 
       
        with:

     

       
0
       
 
       

     

       
17
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
18
       
 
       
          # Only these directories to perform the check

     

       
19
       
 
       
          sparse-checkout: |

     

       
20
       
 
       
            lib

     

       
21
       
 
       
            maintainers

     

       
22
       
+
       


     

       
23
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
24
       
 
       
        with:

     

       
0
       
 
       

     

       
25
       
 
       
          extra_nix_config: sandbox = true

     

       
26
       
+
       


     

       
27
       
 
       
      - name: Check that maintainer-list.nix is sorted

     

       
28
       
 
       
        run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix

     

···

       
3
       
 
       
# https://github.com/NixOS/rfcs/pull/166.

     

       
4
       
 
       
# Because of this, this action is not yet enabled for all files -- only for

     

       
5
       
 
       
# those who have opted in.

     

       
0
       
 
       

     

       
6
       
 
       
name: Check that Nix files are formatted

     

       
7
       
 
       


     

       
8
       
 
       
on:

     

       
9
       
 
       
  pull_request_target:

     

       
10
       
-
       
    # See the comment at the same location in ./nixpkgs-vet.yml

     

       
11
       
 
       
    types: [opened, synchronize, reopened, edited]

     

       
12
       
-
       
permissions:

     

       
13
       
-
       
  contents: read

     

       
14
       
 
       


     

       
15
       
 
       
jobs:

     

       
16
       
 
       
  get-merge-commit:

     
···

       
24
       
 
       
    steps:

     

       
25
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
26
       
 
       
        with:

     

       
27
       
-
       
          # pull_request_target checks out the base branch by default

     

       
28
       
 
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
29
       
 
       
          # Fetches the merge commit and its parents

     

       
30
       
 
       
          fetch-depth: 2

     

       
31
       
-
       
      - name: Checking out base branch

     

       
0
       
 
       

     

       
32
       
 
       
        run: |

     

       
33
       
-
       
          base=$(mktemp -d)

     

       
34
       
-
       
          baseRev=$(git rev-parse HEAD^1)

     

       
35
       
-
       
          git worktree add "$base" "$baseRev"

     

       
36
       
-
       
          echo "baseRev=$baseRev" >> "$GITHUB_ENV"

     

       
37
       
-
       
          echo "base=$base" >> "$GITHUB_ENV"

     

       
0
       
 
       

     

       
38
       
 
       
      - name: Get Nixpkgs revision for nixfmt

     

       
39
       
 
       
        run: |

     

       
40
       
 
       
          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt

     
···

       
42
       
 
       
          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!

     

       
43
       
 
       
          rev=$(jq -r .rev ci/pinned-nixpkgs.json)

     

       
44
       
 
       
          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"

     

       
0
       
 
       

     

       
45
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
46
       
 
       
        with:

     

       
47
       
-
       
          # explicitly enable sandbox

     

       
48
       
 
       
          extra_nix_config: sandbox = true

     

       
49
       
 
       
          nix_path: nixpkgs=${{ env.url }}

     

       
0
       
 
       

     

       
50
       
 
       
      - name: Install nixfmt

     

       
51
       
 
       
        run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"

     

       
0
       
 
       

     

       
52
       
 
       
      - name: Check that Nix files are formatted according to the RFC style

     

       
53
       
 
       
        run: |

     

       
54
       
 
       
          unformattedFiles=()

     
···

       
78
       
 
       
            esac

     

       
79
       
 
       


     

       
80
       
 
       
            # Ignore files that weren't already formatted

     

       
81
       
-
       
            if [[ -n "$source" ]] && ! nixfmt --check ${{ env.base }}/"$source" 2>/dev/null; then

     

       
82
       
-
       
              echo "Ignoring file $file because it's not formatted in the base commit"

     

       
83
       
 
       
            elif ! nixfmt --check "$dest"; then

     

       
84
       
 
       
              unformattedFiles+=("$dest")

     

       
85
       
 
       
            fi

     

       
86
       
-
       
          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')

     

       
87
       
 
       


     

       
88
       
 
       
          if (( "${#unformattedFiles[@]}" > 0 )); then

     

       
89
       
 
       
            echo "Some new/changed Nix files are not properly formatted"

     

···

       
3
       
 
       
# https://github.com/NixOS/rfcs/pull/166.

     

       
4
       
 
       
# Because of this, this action is not yet enabled for all files -- only for

     

       
5
       
 
       
# those who have opted in.

     

       
6
       
+
       


     

       
7
       
 
       
name: Check that Nix files are formatted

     

       
8
       
 
       


     

       
9
       
 
       
on:

     

       
10
       
 
       
  pull_request_target:

     

       
0
       
 
       

     

       
11
       
 
       
    types: [opened, synchronize, reopened, edited]

     

       
12
       
+
       


     

       
13
       
+
       
permissions: {}

     

       
14
       
 
       


     

       
15
       
 
       
jobs:

     

       
16
       
 
       
  get-merge-commit:

     
···

       
24
       
 
       
    steps:

     

       
25
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
26
       
 
       
        with:

     

       
0
       
 
       

     

       
27
       
 
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
28
       
 
       
          # Fetches the merge commit and its parents

     

       
29
       
 
       
          fetch-depth: 2

     

       
30
       
+
       


     

       
31
       
+
       
      - name: Checking out target branch

     

       
32
       
 
       
        run: |

     

       
33
       
+
       
          target=$(mktemp -d)

     

       
34
       
+
       
          targetRev=$(git rev-parse HEAD^1)

     

       
35
       
+
       
          git worktree add "$target" "$targetRev"

     

       
36
       
+
       
          echo "targetRev=$targetRev" >> "$GITHUB_ENV"

     

       
37
       
+
       
          echo "target=$target" >> "$GITHUB_ENV"

     

       
38
       
+
       


     

       
39
       
 
       
      - name: Get Nixpkgs revision for nixfmt

     

       
40
       
 
       
        run: |

     

       
41
       
 
       
          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt

     
···

       
43
       
 
       
          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!

     

       
44
       
 
       
          rev=$(jq -r .rev ci/pinned-nixpkgs.json)

     

       
45
       
 
       
          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"

     

       
46
       
+
       


     

       
47
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
48
       
 
       
        with:

     

       
0
       
 
       

     

       
49
       
 
       
          extra_nix_config: sandbox = true

     

       
50
       
 
       
          nix_path: nixpkgs=${{ env.url }}

     

       
51
       
+
       


     

       
52
       
 
       
      - name: Install nixfmt

     

       
53
       
 
       
        run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"

     

       
54
       
+
       


     

       
55
       
 
       
      - name: Check that Nix files are formatted according to the RFC style

     

       
56
       
 
       
        run: |

     

       
57
       
 
       
          unformattedFiles=()

     
···

       
81
       
 
       
            esac

     

       
82
       
 
       


     

       
83
       
 
       
            # Ignore files that weren't already formatted

     

       
84
       
+
       
            if [[ -n "$source" ]] && ! nixfmt --check ${{ env.target }}/"$source" 2>/dev/null; then

     

       
85
       
+
       
              echo "Ignoring file $file because it's not formatted in the target commit"

     

       
86
       
 
       
            elif ! nixfmt --check "$dest"; then

     

       
87
       
 
       
              unformattedFiles+=("$dest")

     

       
88
       
 
       
            fi

     

       
89
       
+
       
          done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')

     

       
90
       
 
       


     

       
91
       
 
       
          if (( "${#unformattedFiles[@]}" > 0 )); then

     

       
92
       
 
       
            echo "Some new/changed Nix files are not properly formatted"

     

···

       
3
       
 
       
on:

     

       
4
       
 
       
  pull_request_target:

     

       
5
       
 
       
    types: [opened, synchronize, reopened, edited]

     

       
6
       
-
       
permissions:

     

       
7
       
-
       
  contents: read

     

       
8
       
 
       


     

       
9
       
 
       
jobs:

     

       
10
       
 
       
  nixos:

     
···

       
14
       
 
       
    steps:

     

       
15
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
16
       
 
       
        with:

     

       
17
       
-
       
          # pull_request_target checks out the base branch by default

     

       
18
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
19
       
 
       
          # Fetches the merge commit and its parents

     

       
20
       
 
       
          fetch-depth: 2

     

       
21
       
-
       
      - name: Checking out base branch

     

       
0
       
 
       

     

       
22
       
 
       
        run: |

     

       
23
       
-
       
          base=$(mktemp -d)

     

       
24
       
-
       
          baseRev=$(git rev-parse HEAD^1)

     

       
25
       
-
       
          git worktree add "$base" "$baseRev"

     

       
26
       
-
       
          echo "baseRev=$baseRev" >> "$GITHUB_ENV"

     

       
27
       
-
       
          echo "base=$base" >> "$GITHUB_ENV"

     

       
0
       
 
       

     

       
28
       
 
       
      - name: Get Nixpkgs revision for nixf

     

       
29
       
 
       
        run: |

     

       
30
       
 
       
          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf

     
···

       
32
       
 
       
          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!

     

       
33
       
 
       
          rev=$(jq -r .rev ci/pinned-nixpkgs.json)

     

       
34
       
 
       
          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"

     

       
0
       
 
       

     

       
35
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
36
       
 
       
        with:

     

       
37
       
-
       
          # explicitly enable sandbox

     

       
38
       
 
       
          extra_nix_config: sandbox = true

     

       
39
       
 
       
          nix_path: nixpkgs=${{ env.url }}

     

       
0
       
 
       

     

       
40
       
 
       
      - name: Install nixf and jq

     

       
41
       
 
       
        # provided jq is incompatible with our expression

     

       
42
       
 
       
        run: "nix-env -f '<nixpkgs>' -iAP nixf jq"

     

       
0
       
 
       

     

       
43
       
 
       
      - name: Check that Nix files pass nixf-tidy

     

       
44
       
 
       
        run: |

     

       
45
       
 
       
          # Filtering error messages we don't like

     
···

       
85
       
 
       
                continue

     

       
86
       
 
       
            esac

     

       
87
       
 
       


     

       
88
       
-
       
            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.base }}/"$source")" != '[]' ]] 2>/dev/null; then

     

       
89
       
-
       
              echo "Ignoring file $file because it doesn't pass nixf-tidy in the base commit"

     

       
90
       
 
       
              echo # insert blank line

     

       
91
       
 
       
            else

     

       
92
       
 
       
              nixf_report="$(nixf_wrapper "$dest")"

     
···

       
113
       
 
       
                failedFiles+=("$dest")

     

       
114
       
 
       
              fi

     

       
115
       
 
       
            fi

     

       
116
       
-
       
          done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')

     

       
117
       
 
       


     

       
118
       
 
       
          if [[ -n "$DONT_REPORT_ERROR" ]]; then

     

       
119
       
 
       
            echo "Edited the PR but didn't change the base branch, only the description/title."

     

···

       
3
       
 
       
on:

     

       
4
       
 
       
  pull_request_target:

     

       
5
       
 
       
    types: [opened, synchronize, reopened, edited]

     

       
6
       
+
       


     

       
7
       
+
       
permissions: {}

     

       
8
       
 
       


     

       
9
       
 
       
jobs:

     

       
10
       
 
       
  nixos:

     
···

       
14
       
 
       
    steps:

     

       
15
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
16
       
 
       
        with:

     

       
0
       
 
       

     

       
17
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
18
       
 
       
          # Fetches the merge commit and its parents

     

       
19
       
 
       
          fetch-depth: 2

     

       
20
       
+
       


     

       
21
       
+
       
      - name: Checking out target branch

     

       
22
       
 
       
        run: |

     

       
23
       
+
       
          target=$(mktemp -d)

     

       
24
       
+
       
          targetRev=$(git rev-parse HEAD^1)

     

       
25
       
+
       
          git worktree add "$target" "$targetRev"

     

       
26
       
+
       
          echo "targetRev=$targetRev" >> "$GITHUB_ENV"

     

       
27
       
+
       
          echo "target=$target" >> "$GITHUB_ENV"

     

       
28
       
+
       


     

       
29
       
 
       
      - name: Get Nixpkgs revision for nixf

     

       
30
       
 
       
        run: |

     

       
31
       
 
       
          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf

     
···

       
33
       
 
       
          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!

     

       
34
       
 
       
          rev=$(jq -r .rev ci/pinned-nixpkgs.json)

     

       
35
       
 
       
          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"

     

       
36
       
+
       


     

       
37
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
38
       
 
       
        with:

     

       
0
       
 
       

     

       
39
       
 
       
          extra_nix_config: sandbox = true

     

       
40
       
 
       
          nix_path: nixpkgs=${{ env.url }}

     

       
41
       
+
       


     

       
42
       
 
       
      - name: Install nixf and jq

     

       
43
       
 
       
        # provided jq is incompatible with our expression

     

       
44
       
 
       
        run: "nix-env -f '<nixpkgs>' -iAP nixf jq"

     

       
45
       
+
       


     

       
46
       
 
       
      - name: Check that Nix files pass nixf-tidy

     

       
47
       
 
       
        run: |

     

       
48
       
 
       
          # Filtering error messages we don't like

     
···

       
88
       
 
       
                continue

     

       
89
       
 
       
            esac

     

       
90
       
 
       


     

       
91
       
+
       
            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.target }}/"$source")" != '[]' ]] 2>/dev/null; then

     

       
92
       
+
       
              echo "Ignoring file $file because it doesn't pass nixf-tidy in the target commit"

     

       
93
       
 
       
              echo # insert blank line

     

       
94
       
 
       
            else

     

       
95
       
 
       
              nixf_report="$(nixf_wrapper "$dest")"

     
···

       
116
       
 
       
                failedFiles+=("$dest")

     

       
117
       
 
       
              fi

     

       
118
       
 
       
            fi

     

       
119
       
+
       
          done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')

     

       
120
       
 
       


     

       
121
       
 
       
          if [[ -n "$DONT_REPORT_ERROR" ]]; then

     

       
122
       
 
       
            echo "Edited the PR but didn't change the base branch, only the description/title."

     

···

       
9
       
 
       
permissions: {}

     

       
10
       
 
       


     

       
11
       
 
       
jobs:

     

       
12
       
-
       
  x86_64-linux:

     

       
13
       
-
       
    name: shell-check-x86_64-linux

     

       
14
       
-
       
    runs-on: ubuntu-24.04

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
15
       
 
       
    steps:

     

       
16
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
17
       
 
       
        with:

     

       
18
       
-
       
          # pull_request_target checks out the base branch by default

     

       
19
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
20
       
-
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
21
       
-
       
      - name: Build shell

     

       
22
       
-
       
        run: nix-build shell.nix

     

       
23
       
 
       


     

       
24
       
-
       
  aarch64-darwin:

     

       
25
       
-
       
    name: shell-check-aarch64-darwin

     

       
26
       
-
       
    runs-on: macos-14

     

       
27
       
-
       
    steps:

     

       
28
       
-
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
29
       
-
       
        with:

     

       
30
       
-
       
          # pull_request_target checks out the base branch by default

     

       
31
       
-
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
32
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
0
       
 
       

     

       
33
       
 
       
      - name: Build shell

     

       
34
       
 
       
        run: nix-build shell.nix

     

···

       
9
       
 
       
permissions: {}

     

       
10
       
 
       


     

       
11
       
 
       
jobs:

     

       
12
       
+
       
  shell-check:

     

       
13
       
+
       
    strategy:

     

       
14
       
+
       
      fail-fast: false

     

       
15
       
+
       
      matrix:

     

       
16
       
+
       
        include:

     

       
17
       
+
       
          - runner: ubuntu-24.04

     

       
18
       
+
       
            system: x86_64-linux

     

       
19
       
+
       
          - runner: macos-14

     

       
20
       
+
       
            system: aarch64-darwin

     

       
21
       
+
       


     

       
22
       
+
       
    name: shell-check-${{ matrix.system }}

     

       
23
       
+
       
    runs-on: ${{ matrix.runner }}

     

       
24
       
+
       


     

       
25
       
 
       
    steps:

     

       
26
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
27
       
 
       
        with:

     

       
0
       
 
       

     

       
28
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
29
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
30
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
31
       
+
       


     

       
32
       
 
       
      - name: Build shell

     

       
33
       
 
       
        run: nix-build shell.nix

     

···

       
1
       
-
       
name: Codeowners v2

     

       
2
       
-
       


     

       
3
       
 
       
# This workflow depends on two GitHub Apps with the following permissions:

     

       
4
       
 
       
# - For checking code owners:

     

       
5
       
 
       
#   - Permissions:

     
···

       
21
       
 
       
# while requesting code owners requires PR write access, and those shouldn't be mixed.

     

       
22
       
 
       
#

     

       
23
       
 
       
# Note that the latter is also used for ./eval.yml requesting reviewers.

     

       
0
       
 
       

     

       
0
       
 
       

     

       
24
       
 
       


     

       
25
       
 
       
on:

     

       
26
       
 
       
  pull_request_target:

     

       
27
       
 
       
    types: [opened, ready_for_review, synchronize, reopened, edited]

     

       
28
       
 
       


     

       
29
       
-
       
# We don't need any default GitHub token

     

       
30
       
 
       
permissions: {}

     

       
31
       
 
       


     

       
32
       
 
       
env:

     
···

       
45
       
 
       
    needs: get-merge-commit

     

       
46
       
 
       
    if: needs.get-merge-commit.outputs.mergedSha

     

       
47
       
 
       
    steps:

     

       
48
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
49
       
 
       


     

       
50
       
-
       
    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
51
       
-
       
      if: github.repository_owner == 'NixOS'

     

       
52
       
-
       
      with:

     

       
53
       
-
       
        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
54
       
-
       
        name: nixpkgs-ci

     

       
55
       
-
       
        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
56
       
 
       


     

       
57
       
-
       
    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.

     

       
58
       
-
       
    # We later build and run code from the base branch with access to secrets,

     

       
59
       
-
       
    # so it's important this is not the PRs code.

     

       
60
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
61
       
-
       
      with:

     

       
62
       
-
       
        path: base

     

       
63
       
 
       


     

       
64
       
-
       
    - name: Build codeowners validator

     

       
65
       
-
       
      run: nix-build base/ci -A codeownersValidator

     

       
66
       
 
       


     

       
67
       
-
       
    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1

     

       
68
       
-
       
      id: app-token

     

       
69
       
-
       
      with:

     

       
70
       
-
       
        app-id: ${{ vars.OWNER_RO_APP_ID }}

     

       
71
       
-
       
        private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}

     

       
72
       
 
       


     

       
73
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
74
       
-
       
      with:

     

       
75
       
-
       
        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
76
       
-
       
        path: pr

     

       
77
       
 
       


     

       
78
       
-
       
    - name: Validate codeowners

     

       
79
       
-
       
      run: result/bin/codeowners-validator

     

       
80
       
-
       
      env:

     

       
81
       
-
       
        OWNERS_FILE: pr/${{ env.OWNERS_FILE }}

     

       
82
       
-
       
        GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}

     

       
83
       
-
       
        REPOSITORY_PATH: pr

     

       
84
       
-
       
        OWNER_CHECKER_REPOSITORY: ${{ github.repository }}

     

       
85
       
-
       
        # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody

     

       
86
       
-
       
        EXPERIMENTAL_CHECKS: "avoid-shadowing"

     

       
87
       
 
       


     

       
88
       
 
       
  # Request reviews from code owners

     

       
89
       
 
       
  request:

     

       
90
       
 
       
    name: Request

     

       
91
       
 
       
    runs-on: ubuntu-24.04

     

       
92
       
 
       
    steps:

     

       
93
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
94
       
 
       


     

       
95
       
-
       
    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.

     

       
96
       
-
       
    # This is intentional, because we need to request the review of owners as declared in the base branch.

     

       
97
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
98
       
 
       


     

       
99
       
-
       
    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1

     

       
100
       
-
       
      id: app-token

     

       
101
       
-
       
      with:

     

       
102
       
-
       
        app-id: ${{ vars.OWNER_APP_ID }}

     

       
103
       
-
       
        private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}

     

       
104
       
 
       


     

       
105
       
-
       
    - name: Build review request package

     

       
106
       
-
       
      run: nix-build ci -A requestReviews

     

       
107
       
 
       


     

       
108
       
-
       
    - name: Request reviews

     

       
109
       
-
       
      run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"

     

       
110
       
-
       
      env:

     

       
111
       
-
       
        GH_TOKEN: ${{ steps.app-token.outputs.token }}

     

···

       
0
       
 
       

     

       
0
       
 
       

     

       
1
       
 
       
# This workflow depends on two GitHub Apps with the following permissions:

     

       
2
       
 
       
# - For checking code owners:

     

       
3
       
 
       
#   - Permissions:

     
···

       
19
       
 
       
# while requesting code owners requires PR write access, and those shouldn't be mixed.

     

       
20
       
 
       
#

     

       
21
       
 
       
# Note that the latter is also used for ./eval.yml requesting reviewers.

     

       
22
       
+
       


     

       
23
       
+
       
name: Codeowners v2

     

       
24
       
 
       


     

       
25
       
 
       
on:

     

       
26
       
 
       
  pull_request_target:

     

       
27
       
 
       
    types: [opened, ready_for_review, synchronize, reopened, edited]

     

       
28
       
 
       


     

       
0
       
 
       

     

       
29
       
 
       
permissions: {}

     

       
30
       
 
       


     

       
31
       
 
       
env:

     
···

       
44
       
 
       
    needs: get-merge-commit

     

       
45
       
 
       
    if: needs.get-merge-commit.outputs.mergedSha

     

       
46
       
 
       
    steps:

     

       
47
       
+
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
48
       
 
       


     

       
49
       
+
       
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
50
       
+
       
        if: github.repository_owner == 'NixOS'

     

       
51
       
+
       
        with:

     

       
52
       
+
       
          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
53
       
+
       
          name: nixpkgs-ci

     

       
54
       
+
       
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
55
       
 
       


     

       
56
       
+
       
      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.

     

       
57
       
+
       
      # We later build and run code from the base branch with access to secrets,

     

       
58
       
+
       
      # so it's important this is not the PRs code.

     

       
59
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
60
       
+
       
        with:

     

       
61
       
+
       
          path: base

     

       
62
       
 
       


     

       
63
       
+
       
      - name: Build codeowners validator

     

       
64
       
+
       
        run: nix-build base/ci -A codeownersValidator

     

       
65
       
 
       


     

       
66
       
+
       
      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1

     

       
67
       
+
       
        id: app-token

     

       
68
       
+
       
        with:

     

       
69
       
+
       
          app-id: ${{ vars.OWNER_RO_APP_ID }}

     

       
70
       
+
       
          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}

     

       
71
       
 
       


     

       
72
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
73
       
+
       
        with:

     

       
74
       
+
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
75
       
+
       
          path: pr

     

       
76
       
 
       


     

       
77
       
+
       
      - name: Validate codeowners

     

       
78
       
+
       
        run: result/bin/codeowners-validator

     

       
79
       
+
       
        env:

     

       
80
       
+
       
          OWNERS_FILE: pr/${{ env.OWNERS_FILE }}

     

       
81
       
+
       
          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}

     

       
82
       
+
       
          REPOSITORY_PATH: pr

     

       
83
       
+
       
          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}

     

       
84
       
+
       
          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody

     

       
85
       
+
       
          EXPERIMENTAL_CHECKS: "avoid-shadowing"

     

       
86
       
 
       


     

       
87
       
 
       
  # Request reviews from code owners

     

       
88
       
 
       
  request:

     

       
89
       
 
       
    name: Request

     

       
90
       
 
       
    runs-on: ubuntu-24.04

     

       
91
       
 
       
    steps:

     

       
92
       
+
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
93
       
 
       


     

       
94
       
+
       
      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.

     

       
95
       
+
       
      # This is intentional, because we need to request the review of owners as declared in the base branch.

     

       
96
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
97
       
 
       


     

       
98
       
+
       
      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1

     

       
99
       
+
       
        id: app-token

     

       
100
       
+
       
        with:

     

       
101
       
+
       
          app-id: ${{ vars.OWNER_APP_ID }}

     

       
102
       
+
       
          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}

     

       
103
       
 
       


     

       
104
       
+
       
      - name: Build review request package

     

       
105
       
+
       
        run: nix-build ci -A requestReviews

     

       
106
       
 
       


     

       
107
       
+
       
      - name: Request reviews

     

       
108
       
+
       
        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"

     

       
109
       
+
       
        env:

     

       
110
       
+
       
          GH_TOKEN: ${{ steps.app-token.outputs.token }}

     

···

       
1
       
 
       
name: "Checking EditorConfig v2"

     

       
2
       
 
       


     

       
3
       
-
       
permissions:

     

       
4
       
-
       
  pull-requests: read

     

       
5
       
-
       
  contents: read

     

       
6
       
-
       


     

       
7
       
 
       
on:

     

       
8
       
-
       
  # avoids approving first time contributors

     

       
9
       
 
       
  pull_request_target:

     

       
10
       
-
       
    branches-ignore:

     

       
11
       
-
       
      - 'release-**'

     

       
12
       
 
       


     

       
13
       
 
       
jobs:

     

       
14
       
 
       
  get-merge-commit:

     
···

       
18
       
 
       
    name: editorconfig-check

     

       
19
       
 
       
    runs-on: ubuntu-24.04

     

       
20
       
 
       
    needs: get-merge-commit

     

       
21
       
-
       
    if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
22
       
 
       
    steps:

     

       
23
       
-
       
    - name: Get list of changed files from PR

     

       
24
       
-
       
      env:

     

       
25
       
-
       
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

     

       
26
       
-
       
      run: |

     

       
27
       
-
       
        gh api \

     

       
28
       
-
       
          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \

     

       
29
       
-
       
          | jq '.[] | select(.status != "removed") | .filename' \

     

       
30
       
-
       
          > "$HOME/changed_files"

     

       
31
       
-
       
    - name: print list of changed files

     

       
32
       
-
       
      run: |

     

       
33
       
-
       
        cat "$HOME/changed_files"

     

       
34
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
35
       
-
       
      with:

     

       
36
       
-
       
        # pull_request_target checks out the base branch by default

     

       
37
       
-
       
        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
38
       
-
       
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
39
       
-
       
      with:

     

       
40
       
-
       
        # nixpkgs commit is pinned so that it doesn't break

     

       
41
       
-
       
        # editorconfig-checker 2.4.0

     

       
42
       
-
       
        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz

     

       
43
       
-
       
    - name: Checking EditorConfig

     

       
44
       
-
       
      run: |

     

       
45
       
-
       
        < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'

     

       
46
       
-
       
    - if: ${{ failure() }}

     

       
47
       
-
       
      run: |

     

       
48
       
-
       
        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

···

       
1
       
 
       
name: "Checking EditorConfig v2"

     

       
2
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
3
       
 
       
on:

     

       
0
       
 
       

     

       
4
       
 
       
  pull_request_target:

     

       
5
       
+
       


     

       
6
       
+
       
permissions: {}

     

       
7
       
 
       


     

       
8
       
 
       
jobs:

     

       
9
       
 
       
  get-merge-commit:

     
···

       
13
       
 
       
    name: editorconfig-check

     

       
14
       
 
       
    runs-on: ubuntu-24.04

     

       
15
       
 
       
    needs: get-merge-commit

     

       
16
       
+
       
    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
17
       
 
       
    steps:

     

       
18
       
+
       
      - name: Get list of changed files from PR

     

       
19
       
+
       
        env:

     

       
20
       
+
       
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

     

       
21
       
+
       
        run: |

     

       
22
       
+
       
          gh api \

     

       
23
       
+
       
            repos/${{ github.repository }}/pulls/${{ github.event.number }}/files --paginate \

     

       
24
       
+
       
            | jq '.[] | select(.status != "removed") | .filename' \

     

       
25
       
+
       
            > "$HOME/changed_files"

     

       
26
       
+
       


     

       
27
       
+
       
      - name: print list of changed files

     

       
28
       
+
       
        run: |

     

       
29
       
+
       
          cat "$HOME/changed_files"

     

       
30
       
+
       


     

       
31
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
32
       
+
       
        with:

     

       
33
       
+
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
34
       
+
       


     

       
35
       
+
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
36
       
+
       
        with:

     

       
37
       
+
       
          # nixpkgs commit is pinned so that it doesn't break

     

       
38
       
+
       
          # editorconfig-checker 2.4.0

     

       
39
       
+
       
          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz

     

       
40
       
+
       


     

       
41
       
+
       
      - name: Checking EditorConfig

     

       
42
       
+
       
        run: |

     

       
43
       
+
       
          < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'

     

       
44
       
+
       


     

       
45
       
+
       
      - if: ${{ failure() }}

     

       
46
       
+
       
        run: |

     

       
47
       
+
       
          echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

     

···

       
1
       
 
       
name: "Building Nixpkgs lib-tests"

     

       
2
       
 
       


     

       
3
       
-
       
permissions:

     

       
4
       
-
       
  contents: read

     

       
5
       
-
       


     

       
6
       
 
       
on:

     

       
7
       
 
       
  pull_request_target:

     

       
8
       
 
       
    paths:

     

       
9
       
 
       
      - 'lib/**'

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
10
       
 
       
jobs:

     

       
11
       
 
       
  get-merge-commit:

     

       
12
       
 
       
    uses: ./.github/workflows/get-merge-commit.yml

     
···

       
19
       
 
       
    steps:

     

       
20
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
21
       
 
       
        with:

     

       
22
       
-
       
          # pull_request_target checks out the base branch by default

     

       
23
       
 
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
0
       
 
       

     

       
24
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
25
       
 
       
        with:

     

       
26
       
-
       
          # explicitly enable sandbox

     

       
27
       
 
       
          extra_nix_config: sandbox = true

     

       
0
       
 
       

     

       
28
       
 
       
      - name: Building Nixpkgs lib-tests

     

       
29
       
 
       
        run: |

     

       
30
       
 
       
          nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix

     

···

       
1
       
 
       
name: "Building Nixpkgs lib-tests"

     

       
2
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
3
       
 
       
on:

     

       
4
       
 
       
  pull_request_target:

     

       
5
       
 
       
    paths:

     

       
6
       
 
       
      - 'lib/**'

     

       
7
       
+
       


     

       
8
       
+
       
permissions: {}

     

       
9
       
+
       


     

       
10
       
 
       
jobs:

     

       
11
       
 
       
  get-merge-commit:

     

       
12
       
 
       
    uses: ./.github/workflows/get-merge-commit.yml

     
···

       
19
       
 
       
    steps:

     

       
20
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
21
       
 
       
        with:

     

       
0
       
 
       

     

       
22
       
 
       
          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

     

       
23
       
+
       


     

       
24
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
25
       
 
       
        with:

     

       
0
       
 
       

     

       
26
       
 
       
          extra_nix_config: sandbox = true

     

       
27
       
+
       


     

       
28
       
 
       
      - name: Building Nixpkgs lib-tests

     

       
29
       
 
       
        run: |

     

       
30
       
 
       
          nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix

     

···

       
12
       
 
       
      - haskell-updates

     

       
13
       
 
       
      - python-updates

     

       
14
       
 
       


     

       
15
       
-
       
permissions:

     

       
16
       
-
       
  contents: read

     

       
17
       
 
       


     

       
18
       
 
       
jobs:

     

       
19
       
 
       
  get-merge-commit:

     
···

       
23
       
 
       
    name: Attributes

     

       
24
       
 
       
    runs-on: ubuntu-24.04

     

       
25
       
 
       
    needs: get-merge-commit

     

       
26
       
-
       
    # Skip this and dependent steps if the PR can't be merged

     

       
27
       
 
       
    if: needs.get-merge-commit.outputs.mergedSha

     

       
28
       
 
       
    outputs:

     

       
29
       
-
       
      baseSha: ${{ steps.baseSha.outputs.baseSha }}

     

       
30
       
 
       
      systems: ${{ steps.systems.outputs.systems }}

     

       
31
       
 
       
    steps:

     

       
32
       
 
       
      - name: Check out the PR at the test merge commit

     
···

       
36
       
 
       
          fetch-depth: 2

     

       
37
       
 
       
          path: nixpkgs

     

       
38
       
 
       


     

       
39
       
-
       
      - name: Determine base commit

     

       
40
       
 
       
        if: github.event_name == 'pull_request_target'

     

       
41
       
-
       
        id: baseSha

     

       
42
       
 
       
        run: |

     

       
43
       
-
       
          baseSha=$(git -C nixpkgs rev-parse HEAD^1)

     

       
44
       
-
       
          echo "baseSha=$baseSha" >> "$GITHUB_OUTPUT"

     

       
45
       
 
       


     

       
46
       
 
       
      - name: Install Nix

     

       
47
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
0
       
 
       

     

       
0
       
 
       

     

       
48
       
 
       


     

       
49
       
 
       
      - name: Evaluate the list of all attributes and get the systems matrix

     

       
50
       
 
       
        id: systems

     
···

       
61
       
 
       
  eval-aliases:

     

       
62
       
 
       
    name: Eval nixpkgs with aliases enabled

     

       
63
       
 
       
    runs-on: ubuntu-24.04

     

       
64
       
-
       
    needs: [ attrs, get-merge-commit ]

     

       
65
       
 
       
    steps:

     

       
66
       
 
       
      - name: Check out the PR at the test merge commit

     

       
67
       
 
       
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     
···

       
71
       
 
       


     

       
72
       
 
       
      - name: Install Nix

     

       
73
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
0
       
 
       

     

       
0
       
 
       

     

       
74
       
 
       


     

       
75
       
 
       
      - name: Query nixpkgs with aliases enabled to check for basic syntax errors

     

       
76
       
 
       
        run: |

     
···

       
106
       
 
       


     

       
107
       
 
       
      - name: Install Nix

     

       
108
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
0
       
 
       

     

       
0
       
 
       

     

       
109
       
 
       


     

       
110
       
 
       
      - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes

     

       
111
       
 
       
        env:

     
···

       
128
       
 
       
    runs-on: ubuntu-24.04

     

       
129
       
 
       
    needs: [ outpaths, attrs, get-merge-commit ]

     

       
130
       
 
       
    outputs:

     

       
131
       
-
       
      baseRunId: ${{ steps.baseRunId.outputs.baseRunId }}

     

       
132
       
 
       
    steps:

     

       
133
       
 
       
      - name: Download output paths and eval stats for all systems

     

       
134
       
 
       
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

     
···

       
145
       
 
       


     

       
146
       
 
       
      - name: Install Nix

     

       
147
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
0
       
 
       

     

       
0
       
 
       

     

       
148
       
 
       


     

       
149
       
 
       
      - name: Combine all output paths and eval stats

     

       
150
       
 
       
        run: |

     
···

       
158
       
 
       
          name: result

     

       
159
       
 
       
          path: prResult/*

     

       
160
       
 
       


     

       
161
       
-
       
      - name: Get base run id

     

       
162
       
-
       
        if: needs.attrs.outputs.baseSha

     

       
163
       
-
       
        id: baseRunId

     

       
164
       
 
       
        run: |

     

       
165
       
-
       
          # Get the latest eval.yml workflow run for the PR's base commit

     

       
166
       
 
       
          if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \

     

       
167
       
 
       
            -f head_sha="$BASE_SHA" -f event=push \

     

       
168
       
 
       
            --jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \

     
···

       
185
       
 
       
            exit 0

     

       
186
       
 
       
          fi

     

       
187
       
 
       


     

       
188
       
-
       
          echo "baseRunId=$runId" >> "$GITHUB_OUTPUT"

     

       
189
       
 
       
        env:

     

       
190
       
 
       
          REPOSITORY: ${{ github.repository }}

     

       
191
       
-
       
          BASE_SHA: ${{ needs.attrs.outputs.baseSha }}

     

       
192
       
 
       
          GH_TOKEN: ${{ github.token }}

     

       
193
       
 
       


     

       
194
       
 
       
      - uses: actions/download-artifact@v4

     

       
195
       
-
       
        if: steps.baseRunId.outputs.baseRunId

     

       
196
       
 
       
        with:

     

       
197
       
 
       
          name: result

     

       
198
       
-
       
          path: baseResult

     

       
199
       
 
       
          github-token: ${{ github.token }}

     

       
200
       
-
       
          run-id: ${{ steps.baseRunId.outputs.baseRunId }}

     

       
201
       
 
       


     

       
202
       
-
       
      - name: Compare against the base branch

     

       
203
       
-
       
        if: steps.baseRunId.outputs.baseRunId

     

       
204
       
 
       
        run: |

     

       
205
       
-
       
          git -C nixpkgs worktree add ../base ${{ needs.attrs.outputs.baseSha }}

     

       
206
       
-
       
          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.baseSha }} ${{ needs.attrs.outputs.mergedSha }} \

     

       
207
       
 
       
            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json

     

       
208
       
 
       


     

       
209
       
-
       
          # Use the base branch to get accurate maintainer info

     

       
210
       
-
       
          nix-build base/ci -A eval.compare \

     

       
211
       
-
       
            --arg beforeResultDir ./baseResult \

     

       
212
       
 
       
            --arg afterResultDir ./prResult \

     

       
213
       
 
       
            --arg touchedFilesJson ./touched-files.json \

     

       
214
       
 
       
            -o comparison

     
···

       
216
       
 
       
          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"

     

       
217
       
 
       


     

       
218
       
 
       
      - name: Upload the combined results

     

       
219
       
-
       
        if: steps.baseRunId.outputs.baseRunId

     

       
220
       
 
       
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0

     

       
221
       
 
       
        with:

     

       
222
       
 
       
          name: comparison

     
···

       
227
       
 
       
    name: Tag

     

       
228
       
 
       
    runs-on: ubuntu-24.04

     

       
229
       
 
       
    needs: [ attrs, process ]

     

       
230
       
-
       
    if: needs.process.outputs.baseRunId

     

       
231
       
 
       
    permissions:

     

       
232
       
 
       
      pull-requests: write

     

       
233
       
 
       
      statuses: write

     
···

       
254
       
 
       
      - name: Check out Nixpkgs at the base commit

     

       
255
       
 
       
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
256
       
 
       
        with:

     

       
257
       
-
       
          ref: ${{ needs.attrs.outputs.baseSha }}

     

       
258
       
 
       
          path: base

     

       
259
       
 
       
          sparse-checkout: ci

     

       
260
       
 
       


     

···

       
12
       
 
       
      - haskell-updates

     

       
13
       
 
       
      - python-updates

     

       
14
       
 
       


     

       
15
       
+
       
permissions: {}

     

       
0
       
 
       

     

       
16
       
 
       


     

       
17
       
 
       
jobs:

     

       
18
       
 
       
  get-merge-commit:

     
···

       
22
       
 
       
    name: Attributes

     

       
23
       
 
       
    runs-on: ubuntu-24.04

     

       
24
       
 
       
    needs: get-merge-commit

     

       
0
       
 
       

     

       
25
       
 
       
    if: needs.get-merge-commit.outputs.mergedSha

     

       
26
       
 
       
    outputs:

     

       
27
       
+
       
      targetSha: ${{ steps.targetSha.outputs.targetSha }}

     

       
28
       
 
       
      systems: ${{ steps.systems.outputs.systems }}

     

       
29
       
 
       
    steps:

     

       
30
       
 
       
      - name: Check out the PR at the test merge commit

     
···

       
34
       
 
       
          fetch-depth: 2

     

       
35
       
 
       
          path: nixpkgs

     

       
36
       
 
       


     

       
37
       
+
       
      - name: Determine target commit

     

       
38
       
 
       
        if: github.event_name == 'pull_request_target'

     

       
39
       
+
       
        id: targetSha

     

       
40
       
 
       
        run: |

     

       
41
       
+
       
          targetSha=$(git -C nixpkgs rev-parse HEAD^1)

     

       
42
       
+
       
          echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"

     

       
43
       
 
       


     

       
44
       
 
       
      - name: Install Nix

     

       
45
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
46
       
+
       
        with:

     

       
47
       
+
       
          extra_nix_config: sandbox = true

     

       
48
       
 
       


     

       
49
       
 
       
      - name: Evaluate the list of all attributes and get the systems matrix

     

       
50
       
 
       
        id: systems

     
···

       
61
       
 
       
  eval-aliases:

     

       
62
       
 
       
    name: Eval nixpkgs with aliases enabled

     

       
63
       
 
       
    runs-on: ubuntu-24.04

     

       
64
       
+
       
    needs: [ get-merge-commit ]

     

       
65
       
 
       
    steps:

     

       
66
       
 
       
      - name: Check out the PR at the test merge commit

     

       
67
       
 
       
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     
···

       
71
       
 
       


     

       
72
       
 
       
      - name: Install Nix

     

       
73
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
74
       
+
       
        with:

     

       
75
       
+
       
          extra_nix_config: sandbox = true

     

       
76
       
 
       


     

       
77
       
 
       
      - name: Query nixpkgs with aliases enabled to check for basic syntax errors

     

       
78
       
 
       
        run: |

     
···

       
108
       
 
       


     

       
109
       
 
       
      - name: Install Nix

     

       
110
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
111
       
+
       
        with:

     

       
112
       
+
       
          extra_nix_config: sandbox = true

     

       
113
       
 
       


     

       
114
       
 
       
      - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes

     

       
115
       
 
       
        env:

     
···

       
132
       
 
       
    runs-on: ubuntu-24.04

     

       
133
       
 
       
    needs: [ outpaths, attrs, get-merge-commit ]

     

       
134
       
 
       
    outputs:

     

       
135
       
+
       
      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}

     

       
136
       
 
       
    steps:

     

       
137
       
 
       
      - name: Download output paths and eval stats for all systems

     

       
138
       
 
       
        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

     
···

       
149
       
 
       


     

       
150
       
 
       
      - name: Install Nix

     

       
151
       
 
       
        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
152
       
+
       
        with:

     

       
153
       
+
       
          extra_nix_config: sandbox = true

     

       
154
       
 
       


     

       
155
       
 
       
      - name: Combine all output paths and eval stats

     

       
156
       
 
       
        run: |

     
···

       
164
       
 
       
          name: result

     

       
165
       
 
       
          path: prResult/*

     

       
166
       
 
       


     

       
167
       
+
       
      - name: Get target run id

     

       
168
       
+
       
        if: needs.attrs.outputs.targetSha

     

       
169
       
+
       
        id: targetRunId

     

       
170
       
 
       
        run: |

     

       
171
       
+
       
          # Get the latest eval.yml workflow run for the PR's target commit

     

       
172
       
 
       
          if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \

     

       
173
       
 
       
            -f head_sha="$BASE_SHA" -f event=push \

     

       
174
       
 
       
            --jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \

     
···

       
191
       
 
       
            exit 0

     

       
192
       
 
       
          fi

     

       
193
       
 
       


     

       
194
       
+
       
          echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"

     

       
195
       
 
       
        env:

     

       
196
       
 
       
          REPOSITORY: ${{ github.repository }}

     

       
197
       
+
       
          BASE_SHA: ${{ needs.attrs.outputs.targetSha }}

     

       
198
       
 
       
          GH_TOKEN: ${{ github.token }}

     

       
199
       
 
       


     

       
200
       
 
       
      - uses: actions/download-artifact@v4

     

       
201
       
+
       
        if: steps.targetRunId.outputs.targetRunId

     

       
202
       
 
       
        with:

     

       
203
       
 
       
          name: result

     

       
204
       
+
       
          path: targetResult

     

       
205
       
 
       
          github-token: ${{ github.token }}

     

       
206
       
+
       
          run-id: ${{ steps.targetRunId.outputs.targetRunId }}

     

       
207
       
 
       


     

       
208
       
+
       
      - name: Compare against the target branch

     

       
209
       
+
       
        if: steps.targetRunId.outputs.targetRunId

     

       
210
       
 
       
        run: |

     

       
211
       
+
       
          git -C nixpkgs worktree add ../target ${{ needs.attrs.outputs.targetSha }}

     

       
212
       
+
       
          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.targetSha }} \

     

       
213
       
 
       
            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json

     

       
214
       
 
       


     

       
215
       
+
       
          # Use the target branch to get accurate maintainer info

     

       
216
       
+
       
          nix-build target/ci -A eval.compare \

     

       
217
       
+
       
            --arg beforeResultDir ./targetResult \

     

       
218
       
 
       
            --arg afterResultDir ./prResult \

     

       
219
       
 
       
            --arg touchedFilesJson ./touched-files.json \

     

       
220
       
 
       
            -o comparison

     
···

       
222
       
 
       
          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"

     

       
223
       
 
       


     

       
224
       
 
       
      - name: Upload the combined results

     

       
225
       
+
       
        if: steps.targetRunId.outputs.targetRunId

     

       
226
       
 
       
        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0

     

       
227
       
 
       
        with:

     

       
228
       
 
       
          name: comparison

     
···

       
233
       
 
       
    name: Tag

     

       
234
       
 
       
    runs-on: ubuntu-24.04

     

       
235
       
 
       
    needs: [ attrs, process ]

     

       
236
       
+
       
    if: needs.process.outputs.targetRunId

     

       
237
       
 
       
    permissions:

     

       
238
       
 
       
      pull-requests: write

     

       
239
       
 
       
      statuses: write

     
···

       
260
       
 
       
      - name: Check out Nixpkgs at the base commit

     

       
261
       
 
       
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
262
       
 
       
        with:

     

       
263
       
+
       
          ref: ${{ needs.attrs.outputs.targetSha }}

     

       
264
       
 
       
          path: base

     

       
265
       
 
       
          sparse-checkout: ci

     

       
266
       
 
       


     

···

       
7
       
 
       
        description: "The merge commit SHA"

     

       
8
       
 
       
        value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}

     

       
9
       
 
       


     

       
10
       
-
       
# We need a token to query the API, but it doesn't need any special permissions

     

       
11
       
 
       
permissions: {}

     

       
12
       
 
       


     

       
13
       
 
       
jobs:

     
···

       
16
       
 
       
    outputs:

     

       
17
       
 
       
      mergedSha: ${{ steps.merged.outputs.mergedSha }}

     

       
18
       
 
       
    steps:

     

       
19
       
-
       
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
20
       
-
       
      with:

     

       
21
       
-
       
        path: base

     

       
22
       
-
       
        sparse-checkout: ci

     

       
23
       
-
       
    - name: Check if the PR can be merged and get the test merge commit

     

       
24
       
-
       
      id: merged

     

       
25
       
-
       
      env:

     

       
26
       
-
       
        GH_TOKEN: ${{ github.token }}

     

       
27
       
-
       
        GH_EVENT: ${{ github.event_name }}

     

       
28
       
-
       
      run: |

     

       
29
       
-
       
        case "$GH_EVENT" in

     

       
30
       
-
       
          push)

     

       
31
       
-
       
            echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"

     

       
32
       
-
       
            ;;

     

       
33
       
-
       
          pull_request_target)

     

       
34
       
-
       
            if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then

     

       
35
       
-
       
              echo "Checking the merge commit $mergedSha"

     

       
36
       
-
       
              echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"

     

       
37
       
-
       
            else

     

       
38
       
-
       
              # Skipping so that no notifications are sent

     

       
39
       
-
       
              echo "Skipping the rest..."

     

       
40
       
-
       
            fi

     

       
41
       
-
       
            ;;

     

       
42
       
-
       
        esac

     

       
43
       
-
       
        rm -rf base

     

       
0
       
 
       

     

···

       
7
       
 
       
        description: "The merge commit SHA"

     

       
8
       
 
       
        value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}

     

       
9
       
 
       


     

       
0
       
 
       

     

       
10
       
 
       
permissions: {}

     

       
11
       
 
       


     

       
12
       
 
       
jobs:

     
···

       
15
       
 
       
    outputs:

     

       
16
       
 
       
      mergedSha: ${{ steps.merged.outputs.mergedSha }}

     

       
17
       
 
       
    steps:

     

       
18
       
+
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
19
       
+
       
        with:

     

       
20
       
+
       
          path: base

     

       
21
       
+
       
          sparse-checkout: ci

     

       
22
       
+
       


     

       
23
       
+
       
      - name: Check if the PR can be merged and get the test merge commit

     

       
24
       
+
       
        id: merged

     

       
25
       
+
       
        env:

     

       
26
       
+
       
          GH_TOKEN: ${{ github.token }}

     

       
27
       
+
       
          GH_EVENT: ${{ github.event_name }}

     

       
28
       
+
       
        run: |

     

       
29
       
+
       
          case "$GH_EVENT" in

     

       
30
       
+
       
            push)

     

       
31
       
+
       
              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"

     

       
32
       
+
       
              ;;

     

       
33
       
+
       
            pull_request_target)

     

       
34
       
+
       
              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then

     

       
35
       
+
       
                echo "Checking the merge commit $mergedSha"

     

       
36
       
+
       
                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"

     

       
37
       
+
       
              else

     

       
38
       
+
       
                # Skipping so that no notifications are sent

     

       
39
       
+
       
                echo "Skipping the rest..."

     

       
40
       
+
       
              fi

     

       
41
       
+
       
              ;;

     

       
42
       
+
       
          esac

     

       
43
       
+
       
          rm -rf base

     

···

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
1
       
 
       
name: "Label PR"

     

       
2
       
 
       


     

       
3
       
 
       
on:

     

       
4
       
 
       
  pull_request_target:

     

       
5
       
 
       
    types: [edited, opened, synchronize, reopened]

     

       
6
       
 
       


     

       
7
       
-
       
# WARNING:

     

       
8
       
-
       
# When extending this action, be aware that $GITHUB_TOKEN allows some write

     

       
9
       
-
       
# access to the GitHub API. This means that it should not evaluate user input in

     

       
10
       
-
       
# a way that allows code injection.

     

       
11
       
-
       


     

       
12
       
 
       
permissions:

     

       
13
       
 
       
  contents: read

     

       
14
       
 
       
  pull-requests: write

     
···

       
19
       
 
       
    runs-on: ubuntu-24.04

     

       
20
       
 
       
    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
21
       
 
       
    steps:

     

       
22
       
-
       
    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0

     

       
23
       
-
       
      with:

     

       
24
       
-
       
        repo-token: ${{ secrets.GITHUB_TOKEN }}

     

       
25
       
-
       
        sync-labels: true

     

···

       
1
       
+
       
# WARNING:

     

       
2
       
+
       
# When extending this action, be aware that $GITHUB_TOKEN allows some write

     

       
3
       
+
       
# access to the GitHub API. This means that it should not evaluate user input in

     

       
4
       
+
       
# a way that allows code injection.

     

       
5
       
+
       


     

       
6
       
 
       
name: "Label PR"

     

       
7
       
 
       


     

       
8
       
 
       
on:

     

       
9
       
 
       
  pull_request_target:

     

       
10
       
 
       
    types: [edited, opened, synchronize, reopened]

     

       
11
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
12
       
 
       
permissions:

     

       
13
       
 
       
  contents: read

     

       
14
       
 
       
  pull-requests: write

     
···

       
19
       
 
       
    runs-on: ubuntu-24.04

     

       
20
       
 
       
    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"

     

       
21
       
 
       
    steps:

     

       
22
       
+
       
      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0

     

       
23
       
+
       
        with:

     

       
24
       
+
       
          repo-token: ${{ secrets.GITHUB_TOKEN }}

     

       
25
       
+
       
          sync-labels: true

     

···

       
1
       
 
       
name: "Build NixOS manual v2"

     

       
2
       
 
       


     

       
3
       
-
       
permissions:

     

       
4
       
-
       
  contents: read

     

       
5
       
-
       


     

       
6
       
 
       
on:

     

       
7
       
 
       
  pull_request_target:

     

       
8
       
 
       
    branches:

     
···

       
10
       
 
       
    paths:

     

       
11
       
 
       
      - 'nixos/**'

     

       
12
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
13
       
 
       
jobs:

     

       
14
       
 
       
  nixos:

     

       
15
       
 
       
    name: nixos-manual-build

     

       
16
       
 
       
    runs-on: ubuntu-24.04

     

       
17
       
-
       
    if: github.repository_owner == 'NixOS'

     

       
18
       
 
       
    steps:

     

       
19
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
20
       
 
       
        with:

     

       
21
       
-
       
          # pull_request_target checks out the base branch by default

     

       
22
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
0
       
 
       

     

       
23
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
24
       
 
       
        with:

     

       
25
       
-
       
          # explicitly enable sandbox

     

       
26
       
 
       
          extra_nix_config: sandbox = true

     

       
0
       
 
       

     

       
27
       
 
       
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
0
       
 
       

     

       
28
       
 
       
        with:

     

       
29
       
 
       
          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
30
       
 
       
          name: nixpkgs-ci

     

       
31
       
 
       
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
0
       
 
       

     

       
32
       
 
       
      - name: Building NixOS manual

     

       
33
       
 
       
        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

     

···

       
1
       
 
       
name: "Build NixOS manual v2"

     

       
2
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
3
       
 
       
on:

     

       
4
       
 
       
  pull_request_target:

     

       
5
       
 
       
    branches:

     
···

       
7
       
 
       
    paths:

     

       
8
       
 
       
      - 'nixos/**'

     

       
9
       
 
       


     

       
10
       
+
       
permissions: {}

     

       
11
       
+
       


     

       
12
       
 
       
jobs:

     

       
13
       
 
       
  nixos:

     

       
14
       
 
       
    name: nixos-manual-build

     

       
15
       
 
       
    runs-on: ubuntu-24.04

     

       
0
       
 
       

     

       
16
       
 
       
    steps:

     

       
17
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
18
       
 
       
        with:

     

       
0
       
 
       

     

       
19
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
20
       
+
       


     

       
21
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
22
       
 
       
        with:

     

       
0
       
 
       

     

       
23
       
 
       
          extra_nix_config: sandbox = true

     

       
24
       
+
       


     

       
25
       
 
       
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
26
       
+
       
        if: github.repository_owner == 'NixOS'

     

       
27
       
 
       
        with:

     

       
28
       
 
       
          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
29
       
 
       
          name: nixpkgs-ci

     

       
30
       
 
       
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
31
       
+
       


     

       
32
       
 
       
      - name: Building NixOS manual

     

       
33
       
 
       
        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

     

···

       
1
       
 
       
name: "Build Nixpkgs manual v2"

     

       
2
       
 
       


     

       
3
       
-
       
permissions:

     

       
4
       
-
       
  contents: read

     

       
5
       
-
       


     

       
6
       
 
       
on:

     

       
7
       
 
       
  pull_request_target:

     

       
8
       
 
       
    branches:

     
···

       
12
       
 
       
      - 'lib/**'

     

       
13
       
 
       
      - 'pkgs/tools/nix/nixdoc/**'

     

       
14
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
15
       
 
       
jobs:

     

       
16
       
 
       
  nixpkgs:

     

       
17
       
 
       
    name: nixpkgs-manual-build

     

       
18
       
 
       
    runs-on: ubuntu-24.04

     

       
19
       
-
       
    if: github.repository_owner == 'NixOS'

     

       
20
       
 
       
    steps:

     

       
21
       
 
       
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

     

       
22
       
 
       
        with:

     

       
23
       
-
       
          # pull_request_target checks out the base branch by default

     

       
24
       
 
       
          ref: refs/pull/${{ github.event.pull_request.number }}/merge

     

       
0
       
 
       

     

       
25
       
 
       
      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

     

       
26
       
 
       
        with:

     

       
27
       
-
       
          # explicitly enable sandbox

     

       
28
       
 
       
          extra_nix_config: sandbox = true

     

       
0
       
 
       

     

       
29
       
 
       
      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

     

       
0
       
 
       

     

       
30
       
 
       
        with:

     

       
31
       
 
       
          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

     

       
32
       
 
       
          name: nixpkgs-ci

     

       
33
       
 
       
          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

     

       
0
       
 
       

     

       
34
       
 
       
      - name: Building Nixpkgs manual

     

       
35
       
 
       
        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests