ci/github-script/prepare: avoid running CI when targeting channel branches

This moves the no-channel-base check into the prepare script to exit
early and prevent all of CI to run against those branches. We also
provide better output by posting a "Changes Requested" review, using the
existing infrastructure from the old cherry-picks check.

The review will be dismissed automatically once the branch has been
corrected, because the commits check will run and do it.

.github/workflows/check.yml

@@ -28,20 +28,6 @@ defaults:
     shell: bash
 
 jobs:
-  no-channel-base:
-    name: no channel base
-    if: contains(fromJSON(inputs.baseBranch).type, 'channel')
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - run: |
-          cat <<EOF
-          The nixos-* and nixpkgs-* branches are pushed to by the channel
-          release script and should not be merged into directly.
-
-          Please target the equivalent release-* branch or master instead.
-          EOF
-          exit 1
-
   commits:
     permissions:
       pull-requests: write

.github/workflows/pr.yml

@@ -23,6 +23,9 @@ permissions: {}
 jobs:
   prepare:
     runs-on: ubuntu-24.04-arm
+    permissions:
+      # wrong branch review comment
+      pull-requests: write
     outputs:
       baseBranch: ${{ steps.prepare.outputs.base }}
       headBranch: ${{ steps.prepare.outputs.head }}
@@ -44,6 +47,7 @@ jobs:
               github,
               context,
               core,
+              dry: context.eventName == 'pull_request',
             })
 
   check:

ci/github-script/prepare.js

@@ -1,6 +1,7 @@
 const { classify } = require('../supportedBranches.js')
+const { postReview } = require('./reviews.js')
 
-module.exports = async ({ github, context, core }) => {
+module.exports = async ({ github, context, core, dry }) => {
   const pull_number = context.payload.pull_request.number
 
   for (const retryInterval of [5, 10, 20, 40, 80]) {
@@ -24,6 +25,32 @@ module.exports = async ({ github, context, core }) => {
 
     const { base, head } = prInfo
 
+    const baseClassification = classify(base.ref)
+    core.setOutput('base', baseClassification)
+    console.log('base classification:', baseClassification)
+
+    const headClassification =
+      base.repo.full_name === head.repo.full_name
+        ? classify(head.ref)
+        : // PRs from forks are always considered WIP.
+          { type: ['wip'] }
+    core.setOutput('head', headClassification)
+    console.log('head classification:', headClassification)
+
+    if (baseClassification.type.includes('channel')) {
+      const { stable, version } = baseClassification
+      const correctBranch = stable ? `release-${version}` : 'master'
+      const body = [
+        'The `nixos-*` and `nixpkgs-*` branches are pushed to by the channel release script and should not be merged into directly.',
+        '',
+        `Please target \`${correctBranch}\` instead.`,
+      ].join('\n')
+
+      await postReview({ github, context, core, dry, body })
+
+      throw new Error('The PR targets a channel branch.')
+    }
+
     let mergedSha, targetSha
 
     if (prInfo.mergeable) {
@@ -56,18 +83,6 @@ module.exports = async ({ github, context, core }) => {
 
     core.setOutput('systems', require('../supportedSystems.json'))
 
-    const baseClassification = classify(base.ref)
-    core.setOutput('base', baseClassification)
-    console.log('base classification:', baseClassification)
-
-    const headClassification =
-      base.repo.full_name === head.repo.full_name
-        ? classify(head.ref)
-        : // PRs from forks are always considered WIP.
-          { type: ['wip'] }
-    core.setOutput('head', headClassification)
-    console.log('head classification:', headClassification)
-
     const files = (
       await github.paginate(github.rest.pulls.listFiles, {
         ...context.repo,

ci/supportedBranches.js

@@ -26,6 +26,7 @@ function classify(branch) {
   return {
     stable: (version ?? 'unstable') !== 'unstable',
     type: typeConfig[prefix] ?? ['wip'],
+    version: version ?? 'unstable',
   }
 }