gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge master into staging-next

Browse Source
This commit is contained in:
github-actions[bot]
2025-01-11 12:05:25 +00:00
committed by GitHub
parent 477a9c6eb6 037cf30dc6
commit 564dc4b926
51 changed files with 515 additions and 554 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/ISSUE_TEMPLATE/bug_report.md
+1 -1
View File
@@ -11,7 +11,7 @@ assignees: ''
<!-- A clear and concise description of what the bug is. -->
## Steps To Reproduce
## Steps to reproduce
Steps to reproduce the behavior:
.github/ISSUE_TEMPLATE/build_failure.md
+1 -1
View File
@@ -7,7 +7,7 @@ assignees: ''
---
## Steps To Reproduce
## Steps to reproduce
Steps to reproduce the behavior:
.github/ISSUE_TEMPLATE/out_of_date_package_report.md
+1 -1
View File
@@ -7,7 +7,7 @@ assignees: ''
---
## Package Information
## Package information
<!-- Search for the package here: https://search.nixos.org/packages?channel=unstable -->
.github/ISSUE_TEMPLATE/unreproducible_package.md
+1 -1
View File
@@ -31,7 +31,7 @@ Fixing bit-by-bit reproducibility also has additional advantages, such as
avoiding hard-to-reproduce bugs, making content-addressed storage more effective
and reducing rebuilds in such systems.
## Steps To Reproduce
## Steps to reproduce
In the following steps, replace `<package>` with the canonical name of the
package.
.github/workflows/README.md
+20
View File
@@ -0,0 +1,20 @@
# GitHub Actions Workflows
Some architectural notes about key decisions and concepts in our workflows:
- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows. This has the advantage that those workflows will run without prior approval for external contributors.
- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches. **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible. Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.
- By definition `pull_request_target` runs in the context of the **base** of the pull request. This means, that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default. To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.
- To test the pull request's contents, we checkout the "test merge commit". This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?". The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore). This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout. Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.
- Various workflows need to make comparisons against the base branch. In this case, we checkout the parent of the "test merge commit" for best results. Note, that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.
## Terminology
- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions. Same as `github.event.pull_request.base.sha`.
- **head commit**: The HEAD commit in the pull request's branch. Same as `github.event.pull_request.head.sha`.
- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request. Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.
- **target commit**: The base branch's parent of the "test merge commit" to compare against.
.github/workflows/backport.yml
+8 -5
View File
@@ -1,13 +1,14 @@
name: Backport
on:
pull_request_target:
types: [closed, labeled]
# WARNING:
# When extending this action, be aware that $GITHUB_TOKEN allows write access to
# the GitHub repository. This means that it should not evaluate user input in a
# way that allows code injection.
name: Backport
on:
pull_request_target:
types: [closed, labeled]
permissions: {}
jobs:
@@ -23,10 +24,12 @@ jobs:
with:
app-id: ${{ vars.BACKPORT_APP_ID }}
private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ github.event.pull_request.head.sha }}
token: ${{ steps.app-token.outputs.token }}
- name: Create backport PRs
uses: korthout/backport-action@be567af183754f6a5d831ae90f648954763f17f5 # v3.1.0
with:
.github/workflows/basic-eval.yml
-31
View File
@@ -1,31 +0,0 @@
name: Basic evaluation checks
on:
workflow_dispatch
# pull_request:
# branches:
# - master
# - release-**
# push:
# branches:
# - master
# - release-**
permissions:
contents: read
jobs:
tests:
name: basic-eval-checks
runs-on: ubuntu-24.04
# we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
with:
# This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
name: nixpkgs-ci
signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
- run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build
# explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
- run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin" ]'
.github/workflows/check-cherry-picks.yml
+15 -13
View File
@@ -1,10 +1,11 @@
name: "Check cherry-picks"
on:
pull_request_target:
branches:
- 'release-**'
- 'staging-**'
- '!staging-next'
- 'release-**'
- 'staging-**'
- '!staging-next'
permissions: {}
@@ -14,13 +15,14 @@ jobs:
runs-on: ubuntu-24.04
if: github.repository_owner == 'NixOS'
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
filter: blob:none
- name: Check cherry-picks
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
filter: blob:none
- name: Check cherry-picks
env:
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
run: |
./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
.github/workflows/check-maintainers-sorted.yaml → .github/workflows/check-maintainers-sorted.yml
+4 -5
View File
@@ -4,26 +4,25 @@ on:
pull_request_target:
paths:
- 'maintainers/maintainer-list.nix'
permissions:
contents: read
permissions: {}
jobs:
nixos:
name: maintainer-list-check
runs-on: ubuntu-24.04
if: github.repository_owner == 'NixOS'
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: refs/pull/${{ github.event.pull_request.number }}/merge
# Only these directories to perform the check
sparse-checkout: |
lib
maintainers
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
# explicitly enable sandbox
extra_nix_config: sandbox = true
- name: Check that maintainer-list.nix is sorted
run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix
.github/workflows/check-nix-format.yml
+17 -14
View File
@@ -3,14 +3,14 @@
# https://github.com/NixOS/rfcs/pull/166.
# Because of this, this action is not yet enabled for all files -- only for
# those who have opted in.
name: Check that Nix files are formatted
on:
pull_request_target:
# See the comment at the same location in ./nixpkgs-vet.yml
types: [opened, synchronize, reopened, edited]
permissions:
contents: read
permissions: {}
jobs:
get-merge-commit:
@@ -24,17 +24,18 @@ jobs:
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
# Fetches the merge commit and its parents
fetch-depth: 2
- name: Checking out base branch
- name: Checking out target branch
run: |
base=$(mktemp -d)
baseRev=$(git rev-parse HEAD^1)
git worktree add "$base" "$baseRev"
echo "baseRev=$baseRev" >> "$GITHUB_ENV"
echo "base=$base" >> "$GITHUB_ENV"
target=$(mktemp -d)
targetRev=$(git rev-parse HEAD^1)
git worktree add "$target" "$targetRev"
echo "targetRev=$targetRev" >> "$GITHUB_ENV"
echo "target=$target" >> "$GITHUB_ENV"
- name: Get Nixpkgs revision for nixfmt
run: |
# pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt
@@ -42,13 +43,15 @@ jobs:
# This should not be a URL, because it would allow PRs to run arbitrary code in CI!
rev=$(jq -r .rev ci/pinned-nixpkgs.json)
echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
# explicitly enable sandbox
extra_nix_config: sandbox = true
nix_path: nixpkgs=${{ env.url }}
- name: Install nixfmt
run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
- name: Check that Nix files are formatted according to the RFC style
run: |
unformattedFiles=()
@@ -78,12 +81,12 @@ jobs:
esac
# Ignore files that weren't already formatted
if [[ -n "$source" ]] && ! nixfmt --check ${{ env.base }}/"$source" 2>/dev/null; then
echo "Ignoring file $file because it's not formatted in the base commit"
if [[ -n "$source" ]] && ! nixfmt --check ${{ env.target }}/"$source" 2>/dev/null; then
echo "Ignoring file $file because it's not formatted in the target commit"
elif ! nixfmt --check "$dest"; then
unformattedFiles+=("$dest")
fi
done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')
done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')
if (( "${#unformattedFiles[@]}" > 0 )); then
echo "Some new/changed Nix files are not properly formatted"
.github/workflows/check-nixf-tidy.yml
+16 -13
View File
@@ -3,8 +3,8 @@ name: Check changed Nix files with nixf-tidy (experimental)
on:
pull_request_target:
types: [opened, synchronize, reopened, edited]
permissions:
contents: read
permissions: {}
jobs:
nixos:
@@ -14,17 +14,18 @@ jobs:
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: refs/pull/${{ github.event.pull_request.number }}/merge
# Fetches the merge commit and its parents
fetch-depth: 2
- name: Checking out base branch
- name: Checking out target branch
run: |
base=$(mktemp -d)
baseRev=$(git rev-parse HEAD^1)
git worktree add "$base" "$baseRev"
echo "baseRev=$baseRev" >> "$GITHUB_ENV"
echo "base=$base" >> "$GITHUB_ENV"
target=$(mktemp -d)
targetRev=$(git rev-parse HEAD^1)
git worktree add "$target" "$targetRev"
echo "targetRev=$targetRev" >> "$GITHUB_ENV"
echo "target=$target" >> "$GITHUB_ENV"
- name: Get Nixpkgs revision for nixf
run: |
# pin to a commit from nixpkgs-unstable to avoid e.g. building nixf
@@ -32,14 +33,16 @@ jobs:
# This should not be a URL, because it would allow PRs to run arbitrary code in CI!
rev=$(jq -r .rev ci/pinned-nixpkgs.json)
echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
# explicitly enable sandbox
extra_nix_config: sandbox = true
nix_path: nixpkgs=${{ env.url }}
- name: Install nixf and jq
# provided jq is incompatible with our expression
run: "nix-env -f '<nixpkgs>' -iAP nixf jq"
- name: Check that Nix files pass nixf-tidy
run: |
# Filtering error messages we don't like
@@ -85,8 +88,8 @@ jobs:
continue
esac
if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.base }}/"$source")" != '[]' ]] 2>/dev/null; then
echo "Ignoring file $file because it doesn't pass nixf-tidy in the base commit"
if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.target }}/"$source")" != '[]' ]] 2>/dev/null; then
echo "Ignoring file $file because it doesn't pass nixf-tidy in the target commit"
echo # insert blank line
else
nixf_report="$(nixf_wrapper "$dest")"
@@ -113,7 +116,7 @@ jobs:
failedFiles+=("$dest")
fi
fi
done < <(git diff -z --name-status ${{ env.baseRev }} -- '*.nix')
done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')
if [[ -n "$DONT_REPORT_ERROR" ]]; then
echo "Edited the PR but didn't change the base branch, only the description/title."
.github/workflows/check-shell.yml
+14 -15
View File
@@ -9,26 +9,25 @@ on:
permissions: {}
jobs:
x86_64-linux:
name: shell-check-x86_64-linux
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: refs/pull/${{ github.event.pull_request.number }}/merge
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
- name: Build shell
run: nix-build shell.nix
shell-check:
strategy:
fail-fast: false
matrix:
include:
- runner: ubuntu-24.04
system: x86_64-linux
- runner: macos-14
system: aarch64-darwin
name: shell-check-${{ matrix.system }}
runs-on: ${{ matrix.runner }}
aarch64-darwin:
name: shell-check-aarch64-darwin
runs-on: macos-14
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: refs/pull/${{ github.event.pull_request.number }}/merge
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
- name: Build shell
run: nix-build shell.nix
.github/workflows/codeowners-v2.yml
+50 -51
View File
@@ -1,5 +1,3 @@
name: Codeowners v2
# This workflow depends on two GitHub Apps with the following permissions:
# - For checking code owners:
# - Permissions:
@@ -22,11 +20,12 @@ name: Codeowners v2
#
# Note that the latter is also used for ./eval.yml requesting reviewers.
name: Codeowners v2
on:
pull_request_target:
types: [opened, ready_for_review, synchronize, reopened, edited]
# We don't need any default GitHub token
permissions: {}
env:
@@ -45,67 +44,67 @@ jobs:
needs: get-merge-commit
if: needs.get-merge-commit.outputs.mergedSha
steps:
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
if: github.repository_owner == 'NixOS'
with:
# This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
name: nixpkgs-ci
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
if: github.repository_owner == 'NixOS'
with:
# This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
name: nixpkgs-ci
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
# Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
# We later build and run code from the base branch with access to secrets,
# so it's important this is not the PRs code.
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: base
# Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
# We later build and run code from the base branch with access to secrets,
# so it's important this is not the PRs code.
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: base
- name: Build codeowners validator
run: nix-build base/ci -A codeownersValidator
- name: Build codeowners validator
run: nix-build base/ci -A codeownersValidator
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
id: app-token
with:
app-id: ${{ vars.OWNER_RO_APP_ID }}
private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
id: app-token
with:
app-id: ${{ vars.OWNER_RO_APP_ID }}
private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
path: pr
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
path: pr
- name: Validate codeowners
run: result/bin/codeowners-validator
env:
OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
REPOSITORY_PATH: pr
OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
# Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
EXPERIMENTAL_CHECKS: "avoid-shadowing"
- name: Validate codeowners
run: result/bin/codeowners-validator
env:
OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
REPOSITORY_PATH: pr
OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
# Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
EXPERIMENTAL_CHECKS: "avoid-shadowing"
# Request reviews from code owners
request:
name: Request
runs-on: ubuntu-24.04
steps:
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
# Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
# This is intentional, because we need to request the review of owners as declared in the base branch.
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
# Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
# This is intentional, because we need to request the review of owners as declared in the base branch.
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
id: app-token
with:
app-id: ${{ vars.OWNER_APP_ID }}
private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
- uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
id: app-token
with:
app-id: ${{ vars.OWNER_APP_ID }}
private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
- name: Build review request package
run: nix-build ci -A requestReviews
- name: Build review request package
run: nix-build ci -A requestReviews
- name: Request reviews
run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
- name: Request reviews
run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
.github/workflows/editorconfig-v2.yml
+33 -34
View File
@@ -1,14 +1,9 @@
name: "Checking EditorConfig v2"
permissions:
pull-requests: read
contents: read
on:
# avoids approving first time contributors
pull_request_target:
branches-ignore:
- 'release-**'
permissions: {}
jobs:
get-merge-commit:
@@ -18,31 +13,35 @@ jobs:
name: editorconfig-check
runs-on: ubuntu-24.04
needs: get-merge-commit
if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
steps:
- name: Get list of changed files from PR
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh api \
repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
| jq '.[] | select(.status != "removed") | .filename' \
> "$HOME/changed_files"
- name: print list of changed files
run: |
cat "$HOME/changed_files"
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
# nixpkgs commit is pinned so that it doesn't break
# editorconfig-checker 2.4.0
nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
- name: Checking EditorConfig
run: |
< "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
- if: ${{ failure() }}
run: |
echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."
- name: Get list of changed files from PR
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh api \
repos/${{ github.repository }}/pulls/${{ github.event.number }}/files --paginate \
| jq '.[] | select(.status != "removed") | .filename' \
> "$HOME/changed_files"
- name: print list of changed files
run: |
cat "$HOME/changed_files"
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
# nixpkgs commit is pinned so that it doesn't break
# editorconfig-checker 2.4.0
nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
- name: Checking EditorConfig
run: |
< "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
- if: ${{ failure() }}
run: |
echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."
.github/workflows/eval-lib-tests.yml
+5 -5
View File
@@ -1,12 +1,12 @@
name: "Building Nixpkgs lib-tests"
permissions:
contents: read
on:
pull_request_target:
paths:
- 'lib/**'
permissions: {}
jobs:
get-merge-commit:
uses: ./.github/workflows/get-merge-commit.yml
@@ -19,12 +19,12 @@ jobs:
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
# explicitly enable sandbox
extra_nix_config: sandbox = true
- name: Building Nixpkgs lib-tests
run: |
nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix
.github/workflows/eval.yml
+35 -29
View File
@@ -12,8 +12,7 @@ on:
- haskell-updates
- python-updates
permissions:
contents: read
permissions: {}
jobs:
get-merge-commit:
@@ -23,10 +22,9 @@ jobs:
name: Attributes
runs-on: ubuntu-24.04
needs: get-merge-commit
# Skip this and dependent steps if the PR can't be merged
if: needs.get-merge-commit.outputs.mergedSha
outputs:
baseSha: ${{ steps.baseSha.outputs.baseSha }}
targetSha: ${{ steps.targetSha.outputs.targetSha }}
systems: ${{ steps.systems.outputs.systems }}
steps:
- name: Check out the PR at the test merge commit
@@ -36,15 +34,17 @@ jobs:
fetch-depth: 2
path: nixpkgs
- name: Determine base commit
- name: Determine target commit
if: github.event_name == 'pull_request_target'
id: baseSha
id: targetSha
run: |
baseSha=$(git -C nixpkgs rev-parse HEAD^1)
echo "baseSha=$baseSha" >> "$GITHUB_OUTPUT"
targetSha=$(git -C nixpkgs rev-parse HEAD^1)
echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"
- name: Install Nix
uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
extra_nix_config: sandbox = true
- name: Evaluate the list of all attributes and get the systems matrix
id: systems
@@ -61,7 +61,7 @@ jobs:
eval-aliases:
name: Eval nixpkgs with aliases enabled
runs-on: ubuntu-24.04
needs: [ attrs, get-merge-commit ]
needs: [ get-merge-commit ]
steps:
- name: Check out the PR at the test merge commit
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -71,6 +71,8 @@ jobs:
- name: Install Nix
uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
extra_nix_config: sandbox = true
- name: Query nixpkgs with aliases enabled to check for basic syntax errors
run: |
@@ -106,6 +108,8 @@ jobs:
- name: Install Nix
uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
extra_nix_config: sandbox = true
- name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes
env:
@@ -128,7 +132,7 @@ jobs:
runs-on: ubuntu-24.04
needs: [ outpaths, attrs, get-merge-commit ]
outputs:
baseRunId: ${{ steps.baseRunId.outputs.baseRunId }}
targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
steps:
- name: Download output paths and eval stats for all systems
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@@ -145,6 +149,8 @@ jobs:
- name: Install Nix
uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
extra_nix_config: sandbox = true
- name: Combine all output paths and eval stats
run: |
@@ -158,11 +164,11 @@ jobs:
name: result
path: prResult/*
- name: Get base run id
if: needs.attrs.outputs.baseSha
id: baseRunId
- name: Get target run id
if: needs.attrs.outputs.targetSha
id: targetRunId
run: |
# Get the latest eval.yml workflow run for the PR's base commit
# Get the latest eval.yml workflow run for the PR's target commit
if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \
-f head_sha="$BASE_SHA" -f event=push \
--jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \
@@ -185,30 +191,30 @@ jobs:
exit 0
fi
echo "baseRunId=$runId" >> "$GITHUB_OUTPUT"
echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"
env:
REPOSITORY: ${{ github.repository }}
BASE_SHA: ${{ needs.attrs.outputs.baseSha }}
BASE_SHA: ${{ needs.attrs.outputs.targetSha }}
GH_TOKEN: ${{ github.token }}
- uses: actions/download-artifact@v4
if: steps.baseRunId.outputs.baseRunId
if: steps.targetRunId.outputs.targetRunId
with:
name: result
path: baseResult
path: targetResult
github-token: ${{ github.token }}
run-id: ${{ steps.baseRunId.outputs.baseRunId }}
run-id: ${{ steps.targetRunId.outputs.targetRunId }}
- name: Compare against the base branch
if: steps.baseRunId.outputs.baseRunId
- name: Compare against the target branch
if: steps.targetRunId.outputs.targetRunId
run: |
git -C nixpkgs worktree add ../base ${{ needs.attrs.outputs.baseSha }}
git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.baseSha }} ${{ needs.attrs.outputs.mergedSha }} \
git -C nixpkgs worktree add ../target ${{ needs.attrs.outputs.targetSha }}
git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.targetSha }} \
| jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
# Use the base branch to get accurate maintainer info
nix-build base/ci -A eval.compare \
--arg beforeResultDir ./baseResult \
# Use the target branch to get accurate maintainer info
nix-build target/ci -A eval.compare \
--arg beforeResultDir ./targetResult \
--arg afterResultDir ./prResult \
--arg touchedFilesJson ./touched-files.json \
-o comparison
@@ -216,7 +222,7 @@ jobs:
cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
- name: Upload the combined results
if: steps.baseRunId.outputs.baseRunId
if: steps.targetRunId.outputs.targetRunId
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
with:
name: comparison
@@ -227,7 +233,7 @@ jobs:
name: Tag
runs-on: ubuntu-24.04
needs: [ attrs, process ]
if: needs.process.outputs.baseRunId
if: needs.process.outputs.targetRunId
permissions:
pull-requests: write
statuses: write
@@ -254,7 +260,7 @@ jobs:
- name: Check out Nixpkgs at the base commit
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ needs.attrs.outputs.baseSha }}
ref: ${{ needs.attrs.outputs.targetSha }}
path: base
sparse-checkout: ci
.github/workflows/get-merge-commit.yml
+26 -26
View File
@@ -7,7 +7,6 @@ on:
description: "The merge commit SHA"
value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}
# We need a token to query the API, but it doesn't need any special permissions
permissions: {}
jobs:
@@ -16,28 +15,29 @@ jobs:
outputs:
mergedSha: ${{ steps.merged.outputs.mergedSha }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: base
sparse-checkout: ci
- name: Check if the PR can be merged and get the test merge commit
id: merged
env:
GH_TOKEN: ${{ github.token }}
GH_EVENT: ${{ github.event_name }}
run: |
case "$GH_EVENT" in
push)
echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
;;
pull_request_target)
if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
echo "Checking the merge commit $mergedSha"
echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
else
# Skipping so that no notifications are sent
echo "Skipping the rest..."
fi
;;
esac
rm -rf base
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
path: base
sparse-checkout: ci
- name: Check if the PR can be merged and get the test merge commit
id: merged
env:
GH_TOKEN: ${{ github.token }}
GH_EVENT: ${{ github.event_name }}
run: |
case "$GH_EVENT" in
push)
echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
;;
pull_request_target)
if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
echo "Checking the merge commit $mergedSha"
echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
else
# Skipping so that no notifications are sent
echo "Skipping the rest..."
fi
;;
esac
rm -rf base
.github/workflows/labels.yml
+9 -9
View File
@@ -1,14 +1,14 @@
# WARNING:
# When extending this action, be aware that $GITHUB_TOKEN allows some write
# access to the GitHub API. This means that it should not evaluate user input in
# a way that allows code injection.
name: "Label PR"
on:
pull_request_target:
types: [edited, opened, synchronize, reopened]
# WARNING:
# When extending this action, be aware that $GITHUB_TOKEN allows some write
# access to the GitHub API. This means that it should not evaluate user input in
# a way that allows code injection.
permissions:
contents: read
pull-requests: write
@@ -19,7 +19,7 @@ jobs:
runs-on: ubuntu-24.04
if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
steps:
- uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
sync-labels: true
- uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
with:
repo-token: ${{ secrets.GITHUB_TOKEN }}
sync-labels: true
.github/workflows/manual-nixos-v2.yml
+6 -6
View File
@@ -1,8 +1,5 @@
name: "Build NixOS manual v2"
permissions:
contents: read
on:
pull_request_target:
branches:
@@ -10,24 +7,27 @@ on:
paths:
- 'nixos/**'
permissions: {}
jobs:
nixos:
name: nixos-manual-build
runs-on: ubuntu-24.04
if: github.repository_owner == 'NixOS'
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: refs/pull/${{ github.event.pull_request.number }}/merge
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
# explicitly enable sandbox
extra_nix_config: sandbox = true
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
if: github.repository_owner == 'NixOS'
with:
# This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
name: nixpkgs-ci
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
- name: Building NixOS manual
run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux
.github/workflows/manual-nixpkgs-v2.yml
+6 -6
View File
@@ -1,8 +1,5 @@
name: "Build Nixpkgs manual v2"
permissions:
contents: read
on:
pull_request_target:
branches:
@@ -12,24 +9,27 @@ on:
- 'lib/**'
- 'pkgs/tools/nix/nixdoc/**'
permissions: {}
jobs:
nixpkgs:
name: nixpkgs-manual-build
runs-on: ubuntu-24.04
if: github.repository_owner == 'NixOS'
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: refs/pull/${{ github.event.pull_request.number }}/merge
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
# explicitly enable sandbox
extra_nix_config: sandbox = true
- uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
if: github.repository_owner == 'NixOS'
with:
# This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
name: nixpkgs-ci
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
- name: Building Nixpkgs manual
run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests
.github/workflows/nix-parse-v2.yml
+33 -35
View File
@@ -1,14 +1,9 @@
name: "Check whether nix files are parseable v2"
permissions:
pull-requests: read
contents: read
on:
# avoids approving first time contributors
pull_request_target:
branches-ignore:
- 'release-**'
permissions: {}
jobs:
get-merge-commit:
@@ -18,32 +13,35 @@ jobs:
name: nix-files-parseable-check
runs-on: ubuntu-24.04
needs: get-merge-commit
if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
steps:
- name: Get list of changed files from PR
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh api \
repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
| jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
> "$HOME/changed_files"
if [[ -s "$HOME/changed_files" ]]; then
echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
fi
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
nix_path: nixpkgs=channel:nixpkgs-unstable
- name: Parse all changed or added nix files
run: |
ret=0
while IFS= read -r file; do
out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
done < "$HOME/changed_files"
exit "$ret"
if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
- name: Get list of changed files from PR
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh api \
repos/${{ github.repository }}/pulls/${{github.event.number}}/files --paginate \
| jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
> "$HOME/changed_files"
if [[ -s "$HOME/changed_files" ]]; then
echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
fi
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
with:
extra_nix_config: sandbox = true
nix_path: nixpkgs=channel:nixpkgs-unstable
- name: Parse all changed or added nix files
run: |
ret=0
while IFS= read -r file; do
out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
done < "$HOME/changed_files"
exit "$ret"
if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
.github/workflows/nixpkgs-vet.yml
+10 -7
View File
@@ -2,10 +2,10 @@
# Among other checks, it makes sure that `pkgs/by-name` (see `../../pkgs/by-name/README.md`) follows the validity rules outlined in [RFC 140](https://github.com/NixOS/rfcs/pull/140).
# When you make changes to this workflow, please also update `ci/nixpkgs-vet.sh` to reflect the impact of your work to the CI.
# See https://github.com/NixOS/nixpkgs-vet for details on the tool and its checks.
name: Vet nixpkgs
on:
# Using pull_request_target instead of pull_request avoids having to approve first time contributors.
pull_request_target:
# This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
# Instead it causes an `edited` event, so we need to add it explicitly here.
@@ -33,16 +33,18 @@ jobs:
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
# pull_request_target checks out the base branch by default
ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
# Fetches the merge commit and its parents
fetch-depth: 2
- name: Checking out base branch
- name: Checking out target branch
run: |
base=$(mktemp -d)
git worktree add "$base" "$(git rev-parse HEAD^1)"
echo "base=$base" >> "$GITHUB_ENV"
target=$(mktemp -d)
git worktree add "$target" "$(git rev-parse HEAD^1)"
echo "target=$target" >> "$GITHUB_ENV"
- uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
- name: Fetching the pinned tool
# Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh
run: |
@@ -55,12 +57,13 @@ jobs:
# Adds a result symlink as a GC root.
nix-store --realise "$toolPath" --add-root result
- name: Running nixpkgs-vet
env:
# Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
CLICOLOR_FORCE: 1
run: |
if result/bin/nixpkgs-vet --base "$base" .; then
if result/bin/nixpkgs-vet --base "$target" .; then
exit 0
else
exitCode=$?
.github/workflows/no-channel.yml
+7 -7
View File
@@ -15,11 +15,11 @@ jobs:
name: "This PR is is targeting a channel branch"
runs-on: ubuntu-24.04
steps:
- run: |
cat <<EOF
The nixos-* and nixpkgs-* branches are pushed to by the channel
release script and should not be merged into directly.
- run: |
cat <<EOF
The nixos-* and nixpkgs-* branches are pushed to by the channel
release script and should not be merged into directly.
Please target the equivalent release-* branch or master instead.
EOF
exit 1
Please target the equivalent release-* branch or master instead.
EOF
exit 1
.github/workflows/periodic-merge-24h.yml
+8 -26
View File
@@ -7,7 +7,6 @@
name: "Periodic Merges (24h)"
on:
schedule:
# * is a special character in YAML so you have to quote this string
@@ -16,15 +15,11 @@ on:
workflow_dispatch:
permissions:
contents: read
contents: write # for devmasx/merge-branch to merge branches
pull-requests: write # for peter-evans/create-or-update-comment to create or update comment
jobs:
periodic-merge:
permissions:
contents: write # for devmasx/merge-branch to merge branches
pull-requests: write # for peter-evans/create-or-update-comment to create or update comment
if: github.repository_owner == 'NixOS'
runs-on: ubuntu-24.04
strategy:
# don't fail fast, so that all pairs are tried
fail-fast: false
@@ -37,22 +32,9 @@ jobs:
into: staging-next-24.11
- from: staging-next-24.11
into: staging-24.11
name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
with:
type: now
from_branch: ${{ matrix.pairs.from }}
target_branch: ${{ matrix.pairs.into }}
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on failure
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
if: ${{ failure() }}
with:
issue-number: 105153
body: |
Periodic merge from `${{ matrix.pairs.from }}` into `${{ matrix.pairs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
- from: master staging
into: haskell-updates
uses: ./.github/workflows/periodic-merge.yml
with:
from: ${{ matrix.pairs.from }}
into: ${{ matrix.pairs.into }}
.github/workflows/periodic-merge-6h.yml
+6 -26
View File
@@ -7,7 +7,6 @@
name: "Periodic Merges (6h)"
on:
schedule:
# * is a special character in YAML so you have to quote this string
@@ -16,15 +15,11 @@ on:
workflow_dispatch:
permissions:
contents: read
contents: write # for devmasx/merge-branch to merge branches
pull-requests: write # for peter-evans/create-or-update-comment to create or update comment
jobs:
periodic-merge:
permissions:
contents: write # for devmasx/merge-branch to merge branches
pull-requests: write # for peter-evans/create-or-update-comment to create or update comment
if: github.repository_owner == 'NixOS'
runs-on: ubuntu-24.04
strategy:
# don't fail fast, so that all pairs are tried
fail-fast: false
@@ -37,22 +32,7 @@ jobs:
into: staging-next
- from: staging-next
into: staging
name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
with:
type: now
from_branch: ${{ matrix.pairs.from }}
target_branch: ${{ matrix.pairs.into }}
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on failure
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
if: ${{ failure() }}
with:
issue-number: 105153
body: |
Periodic merge from `${{ matrix.pairs.from }}` into `${{ matrix.pairs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
uses: ./.github/workflows/periodic-merge.yml
with:
from: ${{ matrix.pairs.from }}
into: ${{ matrix.pairs.into }}
.github/workflows/periodic-merge-haskell-updates.yml
-59
View File
@@ -1,59 +0,0 @@
# This action periodically merges a merge base of master and staging into haskell-updates.
#
# haskell-updates is based on master (so there are little unrelated failures and the cache
# is already prepopulated), but needs to target staging due to the high amount of rebuilds
# it typically causes. To prevent unrelated commits clattering the GitHub UI, we need to
# take care to only merge the merge-base of master and staging into haskell-updates.
#
# See also https://github.com/NixOS/nixpkgs/issues/361143.
name: "Periodic Merges (haskell-updates)"
on:
schedule:
# * is a special character in YAML so you have to quote this string
# Merge every 24 hours
- cron: '0 0 * * *'
workflow_dispatch:
permissions:
contents: read
jobs:
periodic-merge:
permissions:
contents: write # for devmasx/merge-branch to merge branches
pull-requests: write # for peter-evans/create-or-update-comment to create or update comment
if: github.repository_owner == 'NixOS'
runs-on: ubuntu-24.04
name: git merge-base master staging → haskell-updates
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
# Note: If we want to do something similar for more branches, we can move this into a
# separate job, so we can use the matrix strategy again.
- name: Find merge base of master and staging
id: find_merge_base_step
run: |
merge_base="$(git merge-base refs/remotes/origin/master refs/remotes/origin/staging)"
echo "Found merge base: $merge_base" >&2
echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
- name: git merge-base master staging → haskell-updates
uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
with:
type: now
head_to_merge: ${{ steps.find_merge_base_step.outputs.merge_base }}
target_branch: haskell-updates
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on failure
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
if: ${{ failure() }}
with:
issue-number: 367709
body: |
Periodic merge from `${{ steps.find_merge_base_step.outputs.merge_base }}` into `haskell-updates` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
.github/workflows/periodic-merge.yml
+50
View File
@@ -0,0 +1,50 @@
name: "Merge"
on:
workflow_call:
inputs:
from:
description: Branch to merge into target branch. Can also be two branches separated by space to find the merge base between them.
required: true
type: string
into:
description: Target branch to merge into.
required: true
type: string
jobs:
merge:
if: github.repository_owner == 'NixOS'
runs-on: ubuntu-24.04
name: ${{ inputs.from }} → ${{ inputs.into }}
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Find merge base between two branches
if: contains(inputs.from, ' ')
id: merge_base
env:
branches: ${{ inputs.from }}
run: |
# turn into bash array, split on space
read -ra branches <<< "$branches"
git fetch --shallow-since="1 month ago" origin "${branches[@]}"
merge_base="$(git merge-base "refs/remotes/origin/${branches[0]}" "refs/remotes/origin/${branches[1]}")"
echo "Found merge base: $merge_base" >&2
echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
- name: ${{ inputs.from }} → ${{ inputs.into }}
uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
with:
type: now
from_branch: ${{ steps.merge_base.outputs.merge_base || inputs.from }}
target_branch: ${{ inputs.into }}
github_token: ${{ secrets.GITHUB_TOKEN }}
- name: Comment on failure
uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
if: ${{ failure() }}
with:
issue-number: 105153
body: |
Periodic merge from `${{ inputs.from }}` into `${{ inputs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
nixos/modules/programs/wayland/sway.nix
+1 -4
View File
@@ -117,10 +117,7 @@ in
lib.mkIf
(
(lib.elem "nvidia" config.services.xserver.videoDrivers)
&& !config.hardware.nvidia.open
&& (lib.versionOlder "551" (
lib.versions.major (lib.getVersion config.hardware.nvidia.package)
))
&& (lib.versionOlder (lib.versions.major (lib.getVersion config.hardware.nvidia.package)) "551")
)
[
"Using Sway with Nvidia driver version <= 550 may result in a broken system. Configure hardware.nvidia.package to use a newer version."
pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+2 -2
View File
@@ -98,8 +98,8 @@ rec {
thunderbird-esr = thunderbird-128;
thunderbird-128 = common {
version = "128.5.2esr";
sha512 = "cbfd4b1a7245c2a2f6ef9b2cf69d95a8095eba855755d00fd397351b21ad504733084d6f41801f4114be7015332b8db65e5290bec45f5321efc753412b9acecc";
version = "128.6.0esr";
sha512 = "a561eac0bf0b8c72f3337ccebcde9099c342d1b31ce2b1f31096f1f805a195c49d627cf726cd56d41b21ec292d96fd577e8f226fcb24d8b13e0d773fc334b073";
updateScript = callPackage ./update.nix {
attrPath = "thunderbirdPackages.thunderbird-128";
pkgs/by-name/bu/bup/package.nix
+2 -2
View File
@@ -15,7 +15,7 @@
assert par2Support -> par2cmdline != null;
let
version = "0.33.6";
version = "0.33.7";
pythonDeps =
with python3.pkgs;
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
repo = "bup";
owner = "bup";
rev = version;
hash = "sha256-78lKB4iKlcHKR+suHDKJlDpZ2Gj8mfXmGK8tK/gFYMw=";
hash = "sha256-tuOUml4gF4i7bE2xtjJJol1gRAfYv73RghUYwIDsGyM=";
};
buildInputs = [
pkgs/by-name/fa/faraday-cli/package.nix
+7 -11
View File
@@ -6,21 +6,19 @@
python3.pkgs.buildPythonApplication rec {
pname = "faraday-cli";
version = "2.1.11";
version = "2.1.12";
pyproject = true;
src = fetchFromGitHub {
owner = "infobyte";
repo = "faraday-cli";
tag = version;
hash = "sha256-bCiiX5dYodnWkKeNo2j3PGMz17F5y2X4ECZiStDdK5U=";
hash = "sha256-TZABx76ap4mzZ99Xd8chkwBsGmT9qJWAeMaubUwGiRw=";
};
nativeBuildInputs = with python3.pkgs; [
setuptools
];
build-system = with python3.pkgs; [ setuptools ];
propagatedBuildInputs = with python3.pkgs; [
dependencies = with python3.pkgs; [
arrow
click
cmd2
@@ -42,16 +40,14 @@ python3.pkgs.buildPythonApplication rec {
# Tests requires credentials
doCheck = false;
pythonImportsCheck = [
"faraday_cli"
];
pythonImportsCheck = [ "faraday_cli" ];
meta = with lib; {
description = "Command Line Interface for Faraday";
mainProgram = "faraday-cli";
homepage = "https://github.com/infobyte/faraday-cli";
changelog = "https://github.com/infobyte/faraday-cli/releases/tag/${version}";
license = with licenses; [ gpl3Only ];
license = licenses.gpl3Only;
maintainers = with maintainers; [ fab ];
mainProgram = "faraday-cli";
};
}
pkgs/by-name/he/hentai-at-home/package.nix
+16 -10
View File
@@ -2,24 +2,23 @@
lib,
stdenvNoCC,
fetchzip,
jdk,
jdk_headless,
makeWrapper,
buildPackages,
jre_headless,
javaOpts ? "-XX:+UseZGC",
}:
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "hentai-at-home";
version = "1.6.3";
version = "1.6.4";
src = fetchzip {
url = "https://repo.e-hentai.org/hath/HentaiAtHome_${finalAttrs.version}_src.zip";
hash = "sha512-kBB5mn9MwpkZ0z+Fl5ABs4YWBkXkMRcADYSAPkeifyhbYQQPOnijXKYZCkzE4UB3uQ1j6Kj6WnpO/4jquYEiOQ==";
hash = "sha512-dcHWZiU0ySLlEhZeK1n2T/dyO6Wk9eS7CpZRSfzY3KvHrPBthQnaFrarSopPXJan1+zWROu1pEff1WSr5+HO4Q==";
stripRoot = false;
};
nativeBuildInputs = [
jdk
jdk_headless
makeWrapper
];
@@ -28,24 +27,31 @@ stdenvNoCC.mkDerivation (finalAttrs: {
stdenvNoCC.buildPlatform.libc == "glibc"
) "${buildPackages.glibcLocales}/lib/locale/locale-archive";
buildPhase = ''
make all
'';
makeFlags = [ "all" ];
enableParallelBuilding = false;
installPhase = ''
runHook preInstall
mkdir -p $out/share/java
cp build/HentaiAtHome.jar $out/share/java
mkdir -p $out/bin
makeWrapper ${jre_headless}/bin/java $out/bin/HentaiAtHome \
makeWrapper ${jdk_headless}/bin/java $out/bin/HentaiAtHome \
--add-flags "${javaOpts} -jar $out/share/java/HentaiAtHome.jar"
runHook postInstall
'';
doInstallCheck = true;
installCheckPhase = ''
runHook preInstallCheck
pushd $(mktemp -d)
$out/bin/HentaiAtHome
popd
runHook postInstallCheck
'';
strictDeps = true;
@@ -56,6 +62,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
license = licenses.gpl3;
maintainers = with maintainers; [ terrorjack ];
mainProgram = "HentaiAtHome";
platforms = jdk.meta.platforms;
platforms = jdk_headless.meta.platforms;
};
})
pkgs/tools/security/keyscope/default.nix → pkgs/by-name/ke/keyscope/package.nix
+18 -24
View File
@@ -1,39 +1,28 @@
{
lib,
rustPlatform,
fetchFromGitHub,
pkg-config,
gitUpdater,
openssl,
stdenv,
DiskArbitration,
Foundation,
IOKit,
Security,
pkg-config,
rustPlatform,
}:
rustPlatform.buildRustPackage rec {
pname = "keyscope";
version = "1.3.0";
version = "1.4.0";
src = fetchFromGitHub {
owner = "spectralops";
repo = pname;
rev = "v${version}";
sha256 = "sha256-SrBtgirg52q7gM3GZsJsV8ASACvb4sYv5HDbyItpjbk=";
repo = "keyscope";
tag = "v${version}";
hash = "sha256-2DhKiQixhTCQD/SYIQa+o1kzEsslu6wAReuWr0rTrH8=";
};
cargoHash = "sha256-MFP3AqlfaclmZxRwaWFw6hsZwCQMRKJEyFEyUN+QLqo=";
cargoHash = "sha256-01Q5qCH0VIdO9dpcZxp8wbSjeON9N2C+0qa/2CvMHrc=";
nativeBuildInputs = [ pkg-config ];
buildInputs =
[ openssl ]
++ lib.optionals stdenv.hostPlatform.isDarwin [
DiskArbitration
Foundation
IOKit
Security
];
buildInputs = [ openssl ];
# build script tries to get information from git
postPatch = ''
@@ -42,12 +31,17 @@ rustPlatform.buildRustPackage rec {
VERGEN_GIT_SEMVER = "v${version}";
meta = with lib; {
# Test require network access
doCheck = false;
passthru.updateScript = gitUpdater { };
meta = {
description = "Key and secret workflow (validation, invalidation, etc.) tool";
mainProgram = "keyscope";
homepage = "https://github.com/spectralops/keyscope";
changelog = "https://github.com/spectralops/keyscope/blob/v${version}/CHANGELOG.md";
license = licenses.asl20;
maintainers = with maintainers; [ figsoda ];
license = lib.licenses.asl20;
maintainers = with lib.maintainers; [ figsoda ];
mainProgram = "keyscope";
};
}
pkgs/by-name/ni/nixos-option/package.nix
+7 -11
View File
@@ -8,6 +8,7 @@
nix,
nixosTests,
shellcheck,
runCommand,
stdenvNoCC,
}:
@@ -19,7 +20,6 @@ stdenvNoCC.mkDerivation {
nativeBuildInputs = [
installShellFiles
makeWrapper
shellcheck
];
env = {
@@ -42,15 +42,6 @@ stdenvNoCC.mkDerivation {
runHook postInstall
'';
doInstallCheck = true;
installCheckPhase = ''
runHook preInstallCheck
shellcheck $out/bin/nixos-option
runHook postInstallCheck
'';
postFixup = ''
wrapProgram $out/bin/nixos-option \
--prefix PATH : ${
@@ -63,7 +54,12 @@ stdenvNoCC.mkDerivation {
}
'';
passthru.tests.installer-simpleUefiSystemdBoot = nixosTests.installer.simpleUefiSystemdBoot;
passthru.tests = {
installer-simpleUefiSystemdBoot = nixosTests.installer.simpleUefiSystemdBoot;
shellcheck = runCommand "nixos-option-shellchecked" { nativeBuildInputs = [ shellcheck ]; } ''
shellcheck ${./nixos-option.sh} && touch $out
'';
};
meta = {
description = "Evaluate NixOS configuration and return the properties of given option";
pkgs/by-name/pd/pdfium-binaries/package.nix
+5 -5
View File
@@ -4,7 +4,7 @@
stdenv,
}:
let
version = "6927";
version = "6941";
src =
let
inherit (stdenv.hostPlatform) system;
@@ -16,10 +16,10 @@ let
aarch64-darwin = "mac-arm64";
};
hash = selectSystem {
x86_64-linux = "sha256-hx9+3/CD2xdsu/jm3St3UPXpAzySrgtC14UTQ5pkHPg=";
aarch64-linux = "sha256-CEtviohWUR2/gUBGFq6dkMb0U68CVaTopcI5Xgv7Bks=";
x86_64-darwin = "sha256-H4fVtDUuqJxeh37oMXcVuCpGth/WLXk8p8/3PfjWYgM=";
aarch64-darwin = "sha256-FlyG1Qcl4G3ZVZoVJE3U2CNJoXKr8+1O747XjDq/Eog=";
x86_64-linux = "sha256-9dD4/OjWvUkm7HAOS/jBrtDXiB4LSfEH5j8S6iMI2Go=";
aarch64-linux = "sha256-VpeRfZ1aFVjJlnUO0C+FNwkaXDdHvZSya7MDj90YPmo=";
x86_64-darwin = "sha256-qsFSzksWJXN1F9AmWBQm8hXRyIEs3d9WaeD/7ZjQN7M=";
aarch64-darwin = "sha256-zYhz63VLHJu9vszY2PxWHwAmSgMnvD2baDsK+TsvvyQ=";
};
in
fetchzip {
pkgs/by-name/pi/pik/package.nix
+3 -3
View File
@@ -8,16 +8,16 @@
rustPlatform.buildRustPackage rec {
pname = "pik";
version = "0.13.0";
version = "0.14.0";
src = fetchFromGitHub {
owner = "jacek-kurlit";
repo = "pik";
rev = version;
hash = "sha256-u9zgwjzEfUwPqZDipke+MB2kbNR/PEkGKCdtEYBYQeE=";
hash = "sha256-6nIJ2uayWTwcrGJd7nJQFZ84+QE3R6k/2y9mxdILCEU=";
};
cargoHash = "sha256-Slxk6netGiw3vNGoJMf9i1tO0z/njgpxX7s7S1ydFsw=";
cargoHash = "sha256-geOAhnAg1JefM06rG4nc5aUY7It7c7U5aELpFiFOW4w=";
passthru.tests.version = testers.testVersion { package = pik; };
pkgs/by-name/sc/screenly-cli/package.nix
+3 -3
View File
@@ -12,16 +12,16 @@
rustPlatform.buildRustPackage rec {
pname = "screenly-cli";
version = "1.0.2";
version = "1.0.3";
src = fetchFromGitHub {
owner = "screenly";
repo = "cli";
tag = "v${version}";
hash = "sha256-iEz6LFPzOZCOvUMx3s6entcwyEsAKirY8CiIoId/Ie0=";
hash = "sha256-sRi0CpdaPCH54m2XojicARLXZELB4PFcLLw0KB0j6jE=";
};
cargoHash = "sha256-YurXcmjL44TBrLQocbCKtOEpG7d49aKU9Q/3vPoPvHg=";
cargoHash = "sha256-6IK1aO4bx09ZVve7z340O7KMOttCcq3MqMs/XM6L0l4=";
nativeBuildInputs = [
pkg-config
pkgs/by-name/sm/smbmap/package.nix
+2 -2
View File
@@ -6,14 +6,14 @@
python3.pkgs.buildPythonApplication rec {
pname = "smbmap";
version = "1.10.5";
version = "1.10.7";
pyproject = true;
src = fetchFromGitHub {
owner = "ShawnDEvans";
repo = "smbmap";
tag = "v${version}";
hash = "sha256-xeQ3o0Pt4eDeMnSJKdEJfHhA0oPiD7tmX9TQAb3b9I8=";
hash = "sha256-HF1O9iX1rqAVegHFkBychoMta04uEzN3gkIF4StgggQ=";
};
build-system = with python3.pkgs; [ setuptools ];
pkgs/by-name/st/static-web-server/package.nix
+3 -3
View File
@@ -9,16 +9,16 @@
rustPlatform.buildRustPackage rec {
pname = "static-web-server";
version = "2.34.0";
version = "2.35.0";
src = fetchFromGitHub {
owner = "static-web-server";
repo = pname;
rev = "v${version}";
hash = "sha256-rHY1UVLAojGEbVdTRNshvcvxI4pYaU2nRUkmYWSTvvw=";
hash = "sha256-vrv/qCn57wO3no3ASgaJFAhTjFyW5M4kZkfpgkpYYhY=";
};
cargoHash = "sha256-lT+rwKXqFnFIxjD9DQQf1GY9pqrkUIT7PEsH4i8DM+g=";
cargoHash = "sha256-JDZKcKLVYTrmhaJyZcTECCDbAjRewr1A/XiaG4lpsjA=";
buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
pkgs/by-name/sy/sysdig-cli-scanner/sysdig-cli-scanner.versions.nix
+9 -9
View File
@@ -1,23 +1,23 @@
{
version = "1.18.0";
version = "v1.19.0";
x86_64-linux = {
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.18.0/linux/amd64/sysdig-cli-scanner";
hash = "sha256-ruN8eQ0OhdnUR4okMDhZ/352yVLYlEmWfnmdvskjyGU=";
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/v1.19.0/linux/amd64/sysdig-cli-scanner";
hash = "sha256-TYjf9Axt8IRaTCQ4oA8jdKGLotRPZPJfSDsTXB0nyuU=";
};
aarch64-linux = {
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.18.0/linux/arm64/sysdig-cli-scanner";
hash = "sha256-sO0DEH+TjJ6fbILpNMMfBbiy5fRQ4bUbBDhPZCJZqgE=";
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/v1.19.0/linux/arm64/sysdig-cli-scanner";
hash = "sha256-dSGHZxERmjk1bOXtvLPyJ3KQYhC8XtfSpDqmESv1Cj0=";
};
x86_64-darwin = {
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.18.0/darwin/amd64/sysdig-cli-scanner";
hash = "sha256-IqbhJthyOtmR2Nj26W4GgCYGf/iUTcvG1vjaNCMoXuk=";
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/v1.19.0/darwin/amd64/sysdig-cli-scanner";
hash = "sha256-rJcudXL2BY/r4W0QdZAjl/1c8NPz08qB7kEvbsq5nog=";
};
aarch64-darwin = {
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/1.18.0/darwin/arm64/sysdig-cli-scanner";
hash = "sha256-39LA6kKo0NoQmhP2LmXM6WJiYDR2PuyoUa4xr0jwhSg=";
url = "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/v1.19.0/darwin/arm64/sysdig-cli-scanner";
hash = "sha256-1NLzebkzfP/KakW9p2466BVkSee4x6tZRP2d0eTALIo=";
};
}
pkgs/development/python-modules/cyclopts/default.nix
+2 -2
View File
@@ -19,7 +19,7 @@
buildPythonPackage rec {
pname = "cyclopts";
version = "3.1.4";
version = "3.1.5";
pyproject = true;
disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
owner = "BrianPugh";
repo = "cyclopts";
tag = "v${version}";
hash = "sha256-cJ5i/X+0/TpPVtJVEts5NeICsVrmzJjW0m0IXmGIXf4=";
hash = "sha256-iYlQeBR9xuuiTp9mma5okGdAimnEpKd0x4HvC9OkYq0=";
};
build-system = [
pkgs/development/python-modules/freetype-py/default.nix
+20 -11
View File
@@ -3,7 +3,8 @@
stdenv,
buildPythonPackage,
fetchPypi,
substituteAll,
replaceVars,
setuptools,
setuptools-scm,
freetype,
pytestCheckHook,
@@ -11,24 +12,32 @@
buildPythonPackage rec {
pname = "freetype-py";
version = "2.1.0.post1";
format = "setuptools";
version = "2.3.0";
pyproject = true;
src = fetchPypi {
inherit pname version;
sha256 = "1k62fx53qrv9nb73mpqi2r11wzbx41qfv5qppvh6rylywnrknf3n";
hash = "sha256-+bZM4ycqXDWNzugkgAoy1wmX+4cqCWWlV63KIPznpdA=";
extension = "zip";
};
patches = [
(substituteAll {
src = ./library-paths.patch;
(replaceVars ./library-paths.patch {
freetype = "${freetype.out}/lib/libfreetype${stdenv.hostPlatform.extensions.sharedLibrary}";
})
];
nativeBuildInputs = [ setuptools-scm ];
postPatch = ''
substituteInPlace pyproject.toml \
--replace-fail ', "certifi", "cmake"' ""
'';
propagatedBuildInputs = [ freetype ];
build-system = [
setuptools
setuptools-scm
];
dependencies = [ freetype ];
preCheck = ''
cd tests
@@ -38,10 +47,10 @@ buildPythonPackage rec {
pythonImportsCheck = [ "freetype" ];
meta = with lib; {
meta = {
homepage = "https://github.com/rougier/freetype-py";
description = "FreeType (high-level Python API)";
license = licenses.bsd3;
maintainers = with maintainers; [ goertzenator ];
license = lib.licenses.bsd3;
maintainers = with lib.maintainers; [ goertzenator ];
};
}
pkgs/development/python-modules/minio/default.nix
+2 -2
View File
@@ -22,7 +22,7 @@
buildPythonPackage rec {
pname = "minio";
version = "7.2.13";
version = "7.2.14";
pyproject = true;
disabled = pythonOlder "3.8";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
owner = "minio";
repo = "minio-py";
tag = version;
hash = "sha256-RauPMoqVp4xnS4CXLH0HVTjA8o/BstoEWKWFHvjVllA=";
hash = "sha256-FnId8ewKU5+COnrWW6VJWfL7BLij1IIuGOjEWZrPKNQ=";
};
postPatch = ''
pkgs/development/python-modules/nibe/default.nix
+2 -2
View File
@@ -19,7 +19,7 @@
buildPythonPackage rec {
pname = "nibe";
version = "2.14.0";
version = "2.15.0";
pyproject = true;
disabled = pythonOlder "3.9";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
owner = "yozik04";
repo = "nibe";
tag = version;
hash = "sha256-qk2RUGutzxpoEriTa08W2aDQ1c4y2DzNHMx4K1IW5RQ=";
hash = "sha256-lV5Wp2Qp1v6RE/zA1VqvdWHFZXb+aeFdmhA87wnF46U=";
};
pythonRelaxDeps = [ "async-modbus" ];
pkgs/development/python-modules/ohmepy/default.nix → pkgs/development/python-modules/ohme/default.nix
+1 -1
View File
@@ -8,7 +8,7 @@
}:
buildPythonPackage rec {
pname = "ohmepy";
pname = "ohme";
version = "1.2.3";
pyproject = true;
pkgs/development/python-modules/periodictable/default.nix
+21 -12
View File
@@ -1,38 +1,47 @@
{
lib,
fetchPypi,
fetchFromGitHub,
buildPythonPackage,
setuptools,
numpy,
pyparsing,
pytest-cov-stub,
pytestCheckHook,
pythonOlder,
}:
buildPythonPackage rec {
pname = "periodictable";
version = "1.7.1";
format = "setuptools";
version = "2.0.2";
pyproject = true;
disabled = pythonOlder "3.7";
disabled = pythonOlder "3.8";
src = fetchPypi {
inherit pname version;
hash = "sha256-Q9fbcjPWszli+D156lT0fDuSPT6DQDy8A/WPNTr0tSw=";
src = fetchFromGitHub {
owner = "python-periodictable";
repo = "periodictable";
tag = "v${version}";
hash = "sha256-nI6hiLnqmVXT06pPkHCBEMTxZhfnZJqSImW3V9mJ4+8=";
};
propagatedBuildInputs = [
build-system = [ setuptools ];
dependencies = [
numpy
pyparsing
];
nativeCheckInputs = [ pytestCheckHook ];
nativeCheckInputs = [
pytest-cov-stub
pytestCheckHook
];
pythonImportsCheck = [ "periodictable" ];
meta = with lib; {
meta = {
description = "Extensible periodic table of the elements";
homepage = "https://github.com/pkienzle/periodictable";
license = licenses.publicDomain;
maintainers = with maintainers; [ rprospero ];
license = lib.licenses.publicDomain;
maintainers = with lib.maintainers; [ rprospero ];
};
}
pkgs/development/python-modules/strawberry-graphql/default.nix
+2 -2
View File
@@ -44,7 +44,7 @@
buildPythonPackage rec {
pname = "strawberry-graphql";
version = "0.254.0";
version = "0.257.0";
pyproject = true;
disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
owner = "strawberry-graphql";
repo = "strawberry";
tag = version;
hash = "sha256-lD5TQvBxv4+1fuDHoX45kkTFRHrURRL2jLH/rPfCzzA=";
hash = "sha256-HU3d3ss9axGMqWGxlCQjbRsia9XiMQvHaVs9YMX01v8=";
};
postPatch = ''
pkgs/development/tools/rust/rustup/0001-dynamically-patchelf-binaries.patch
+1 -1
View File
@@ -23,7 +23,7 @@ index dfccc661..85233f3b 100644
+ let mut unwrapped_name = path.file_name().unwrap().to_string_lossy().to_string();
+ unwrapped_name.push_str("-unwrapped");
+ let unwrapped_dir = path.with_file_name(unwrapped_name);
+ fs::create_dir(&unwrapped_dir).context("failed to create unwrapped directory")?;
+ fs::create_dir_all(&unwrapped_dir).context("failed to create unwrapped directory")?;
+ let mut unwrapped_lld = unwrapped_dir;
+ unwrapped_lld.push(dest_lld_path.file_name().unwrap());
+ fs::rename(dest_lld_path, &unwrapped_lld).context("failed to move file")?;
pkgs/servers/home-assistant/component-packages.nix
+3 -1
View File
@@ -3919,7 +3919,8 @@
];
"ohme" =
ps: with ps; [
]; # missing inputs: ohme
ohme
];
"ollama" =
ps: with ps; [
ha-ffmpeg
@@ -7035,6 +7036,7 @@
"nx584"
"obihai"
"octoprint"
"ohme"
"ollama"
"omnilogic"
"onboarding"
pkgs/top-level/all-packages.nix
-4
View File
@@ -3873,10 +3873,6 @@ with pkgs;
keybase-gui = callPackage ../tools/security/keybase/gui.nix { };
keyscope = callPackage ../tools/security/keyscope {
inherit (darwin.apple_sdk.frameworks) DiskArbitration Foundation IOKit Security;
};
keystore-explorer = callPackage ../applications/misc/keystore-explorer {
jdk = jdk11;
};
pkgs/top-level/python-packages.nix
+1 -1
View File
@@ -4880,7 +4880,7 @@ self: super: with self; {
oelint-parser = callPackage ../development/python-modules/oelint-parser { };
ohmepy = callPackage ../development/python-modules/ohmepy { };
ohme = callPackage ../development/python-modules/ohme { };
openstep-parser = callPackage ../development/python-modules/openstep-parser { };