pyrox.dev
+5
-8
.github/CODEOWNERS
+5
-8
.github/CODEOWNERS
············
············
+25
-36
.github/workflows/check-by-name.yml
.github/workflows/nixpkgs-vet.yml
+25
-36
.github/workflows/check-by-name.yml
.github/workflows/nixpkgs-vet.yml
···-# When you make changes to this workflow, also update pkgs/test/check-by-name/run-local.sh adequately-# Using pull_request_target instead of pull_request avoids having to approve first time contributors-# We don't use a concurrency group here, because the action is triggered quite often (due to the PR edit-# This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases···-# Fetch the x86_64-linux-specific release artifact containing the Gzipped NAR of the pre-built tool-toolPath=$(curl -sSfL https://github.com/NixOS/nixpkgs-check-by-name/releases/download/"$toolVersion"/x86_64-linux.nar.gz \-echo "To run locally: ./maintainers/scripts/check-by-name.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
···+# Checks pkgs/by-name (see pkgs/by-name/README.md) using the `nixpkgs-vet` tool (see https://github.com/NixOS/nixpkgs-vet)+# When you make changes to this workflow, please also update `ci/nixpkgs-vet.sh` to reflect the impact of your work to the CI.+# Using pull_request_target instead of pull_request avoids having to approve first time contributors.+# This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.+# While `edited` is also triggered when the PR title/body is changed, this PR action is fairly quick, and PRs don't get edited **that** often, so it shouldn't be a problem.+# There is a feature request for adding a `base_changed` event: https://github.com/orgs/community/discussions/35058+# We don't use a concurrency group here, because the action is triggered quite often (due to the PR edit trigger), and contributors would get notified on any canceled run.+# There is a feature request for suppressing notifications on concurrency-canceled runs: https://github.com/orgs/community/discussions/13015+# This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases.+# This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.+# This step has to be in this file, because it's needed to determine which revision of the repository to fetch, and we can only use other files from the repository once it's fetched.···+# Fetch the x86_64-linux-specific release artifact containing the gzipped NAR of the pre-built tool.+toolPath=$(curl -sSfL https://github.com/NixOS/nixpkgs-vet/releases/download/"$toolVersion"/x86_64-linux.nar.gz \+# Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/+echo "To run locally: ./ci/nixpkgs-vet.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
+1
-1
.github/workflows/check-nix-format.yml
+1
-1
.github/workflows/check-nix-format.yml
+31
ci/README.md
+31
ci/README.md
···[`pinned-nixpkgs.json`](./pinned-nixpkgs.json) contains a pinned Nixpkgs version tested by Hydra.+Runs the [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) on the HEAD commit, closely matching what CI does. This can't do exactly the same as CI, because CI needs to rely on GitHub's server-side Git history to compute the mergeability of PRs before the check can be started.+In turn, when contributors are running this tool locally, we don't want to have to push commits to test them, and we can also rely on the local Git history to do the mergeability check.+- `REPOSITORY`: The repository from which to fetch the base branch. Defaults to <https://github.com/NixOS/nixpkgs.git>.+This directory contains scripts and files used and related to [`nixpkgs-vet`](https://github.com/NixOS/nixpkgs-vet/), which the CI uses to implement `pkgs/by-name` checks, along with many other Nixpkgs architecture rules.+Updates the pinned [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) in [`ci/nixpkgs-vet/pinned-version.txt`](./nixpkgs-vet/pinned-version.txt) to the latest [release](https://github.com/NixOS/nixpkgs-vet/releases).+- Because it makes the CI check very fast, since no Nix builds need to be done, even for mass rebuilds.+- Because it improves security, since we don't have to build potentially untrusted code from PRs.+The tool only needs a very minimal Nix evaluation at runtime, which can work with [readonly-mode](https://nixos.org/manual/nix/stable/command-ref/opt-common.html#opt-readonly-mode) and [restrict-eval](https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-restrict-eval).
+71
ci/nixpkgs-vet.sh
+71
ci/nixpkgs-vet.sh
···
···
+1
ci/nixpkgs-vet/pinned-version.txt
+1
ci/nixpkgs-vet/pinned-version.txt
···
···
+22
ci/nixpkgs-vet/update-pinned-tool.sh
+22
ci/nixpkgs-vet/update-pinned-tool.sh
···
···
-4
maintainers/scripts/README.md
-4
maintainers/scripts/README.md
+1
-1
maintainers/scripts/check-by-name.sh
+1
-1
maintainers/scripts/check-by-name.sh
+4
-4
pkgs/by-name/README.md
+4
-4
pkgs/by-name/README.md
···-CI performs [certain checks](https://github.com/NixOS/nixpkgs-check-by-name?tab=readme-ov-file#validity-checks) on the `pkgs/by-name` structure.-This is done using the [`nixpkgs-check-by-name` tool](https://github.com/NixOS/nixpkgs-check-by-name).
···+CI performs [certain checks](https://github.com/NixOS/nixpkgs-vet?tab=readme-ov-file#validity-checks) on the `pkgs/by-name` structure.
-31
pkgs/test/check-by-name/README.md
-31
pkgs/test/check-by-name/README.md
···-This directory contains scripts and files used and related to the CI running the `pkgs/by-name` checks in Nixpkgs.-because CI needs to rely on GitHub's server-side Git history to compute the mergeability of PRs before the check can be started.-- `REPOSITORY`: The repository to fetch the base branch from, defaults to https://github.com/NixOS/nixpkgs.git-Updates the pinned [nixpkgs-check-by-name tool](https://github.com/NixOS/nixpkgs-check-by-name) in [`./pinned-version.txt`](./pinned-version.txt) to the latest [release](https://github.com/NixOS/nixpkgs-check-by-name/releases).-- Because it makes the CI check very fast, since no Nix builds need to be done, even for mass rebuilds.-- Because it improves security, since we don't have to build potentially untrusted code from PRs.-The tool only needs a very minimal Nix evaluation at runtime, which can work with [readonly-mode](https://nixos.org/manual/nix/stable/command-ref/opt-common.html#opt-readonly-mode) and [restrict-eval](https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-restrict-eval).
···
-73
pkgs/test/check-by-name/run-local.sh
-73
pkgs/test/check-by-name/run-local.sh
···-nix-build https://github.com/NixOS/nixpkgs-check-by-name/tarball/"$toolVersion" -o "$tmp/tool" -A build
···
-22
pkgs/test/check-by-name/update-pinned-tool.sh
-22
pkgs/test/check-by-name/update-pinned-tool.sh
···
···