From 88afad8833aba51d5d24d2f667ab8eea2f9508cd Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Sun, 5 Jan 2025 14:19:45 +0100 Subject: [PATCH] workflows: basic consistency in formatting workflows Same top-level ordering of keys / empty lines and same indentation for yaml lists. One blank line between each step. Makes it easier to read and compare the workflows. --- .github/workflows/backport.yml | 13 ++- .github/workflows/check-cherry-picks.yml | 28 ++--- .../workflows/check-maintainers-sorted.yml | 3 + .github/workflows/check-nix-format.yml | 7 ++ .github/workflows/check-nixf-tidy.yml | 6 ++ .github/workflows/check-shell.yml | 2 + .github/workflows/codeowners-v2.yml | 100 +++++++++--------- .github/workflows/editorconfig-v2.yml | 65 ++++++------ .github/workflows/eval-lib-tests.yml | 9 +- .github/workflows/get-merge-commit.yml | 51 ++++----- .github/workflows/labels.yml | 18 ++-- .github/workflows/manual-nixos-v2.yml | 9 +- .github/workflows/manual-nixpkgs-v2.yml | 9 +- .github/workflows/nix-parse-v2.yml | 65 ++++++------ .github/workflows/nixpkgs-vet.yml | 5 + .github/workflows/no-channel.yml | 14 +-- .github/workflows/periodic-merge-24h.yml | 1 - .github/workflows/periodic-merge-6h.yml | 1 - .../periodic-merge-haskell-updates.yml | 1 - 19 files changed, 225 insertions(+), 182 deletions(-) diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml index 42283f3ab40c..bae29bc9428b 100644 --- a/.github/workflows/backport.yml +++ b/.github/workflows/backport.yml @@ -1,13 +1,14 @@ -name: Backport -on: - pull_request_target: - types: [closed, labeled] - # WARNING: # When extending this action, be aware that $GITHUB_TOKEN allows write access to # the GitHub repository. This means that it should not evaluate user input in a # way that allows code injection. +name: Backport + +on: + pull_request_target: + types: [closed, labeled] + permissions: {} jobs: @@ -23,10 +24,12 @@ jobs: with: app-id: ${{ vars.BACKPORT_APP_ID }} private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }} + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: ref: ${{ github.event.pull_request.head.sha }} token: ${{ steps.app-token.outputs.token }} + - name: Create backport PRs uses: korthout/backport-action@be567af183754f6a5d831ae90f648954763f17f5 # v3.1.0 with: diff --git a/.github/workflows/check-cherry-picks.yml b/.github/workflows/check-cherry-picks.yml index 71b3bff044c7..1759aa5833b2 100644 --- a/.github/workflows/check-cherry-picks.yml +++ b/.github/workflows/check-cherry-picks.yml @@ -1,10 +1,11 @@ name: "Check cherry-picks" + on: pull_request_target: branches: - - 'release-**' - - 'staging-**' - - '!staging-next' + - 'release-**' + - 'staging-**' + - '!staging-next' permissions: {} @@ -14,13 +15,14 @@ jobs: runs-on: ubuntu-24.04 if: github.repository_owner == 'NixOS' steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - fetch-depth: 0 - filter: blob:none - - name: Check cherry-picks - env: - BASE_SHA: ${{ github.event.pull_request.base.sha }} - HEAD_SHA: ${{ github.event.pull_request.head.sha }} - run: | - ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA" + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + fetch-depth: 0 + filter: blob:none + + - name: Check cherry-picks + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: | + ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA" diff --git a/.github/workflows/check-maintainers-sorted.yml b/.github/workflows/check-maintainers-sorted.yml index 21247e20cb9b..e2673059a7af 100644 --- a/.github/workflows/check-maintainers-sorted.yml +++ b/.github/workflows/check-maintainers-sorted.yml @@ -4,6 +4,7 @@ on: pull_request_target: paths: - 'maintainers/maintainer-list.nix' + permissions: contents: read @@ -21,9 +22,11 @@ jobs: sparse-checkout: | lib maintainers + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 with: # explicitly enable sandbox extra_nix_config: sandbox = true + - name: Check that maintainer-list.nix is sorted run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix diff --git a/.github/workflows/check-nix-format.yml b/.github/workflows/check-nix-format.yml index d0b8c84c031d..57eb03a911c4 100644 --- a/.github/workflows/check-nix-format.yml +++ b/.github/workflows/check-nix-format.yml @@ -3,12 +3,14 @@ # https://github.com/NixOS/rfcs/pull/166. # Because of this, this action is not yet enabled for all files -- only for # those who have opted in. + name: Check that Nix files are formatted on: pull_request_target: # See the comment at the same location in ./nixpkgs-vet.yml types: [opened, synchronize, reopened, edited] + permissions: contents: read @@ -28,6 +30,7 @@ jobs: ref: ${{ needs.get-merge-commit.outputs.mergedSha }} # Fetches the merge commit and its parents fetch-depth: 2 + - name: Checking out base branch run: | base=$(mktemp -d) @@ -35,6 +38,7 @@ jobs: git worktree add "$base" "$baseRev" echo "baseRev=$baseRev" >> "$GITHUB_ENV" echo "base=$base" >> "$GITHUB_ENV" + - name: Get Nixpkgs revision for nixfmt run: | # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt @@ -42,13 +46,16 @@ jobs: # This should not be a URL, because it would allow PRs to run arbitrary code in CI! rev=$(jq -r .rev ci/pinned-nixpkgs.json) echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV" + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 with: # explicitly enable sandbox extra_nix_config: sandbox = true nix_path: nixpkgs=${{ env.url }} + - name: Install nixfmt run: "nix-env -f '' -iAP nixfmt-rfc-style" + - name: Check that Nix files are formatted according to the RFC style run: | unformattedFiles=() diff --git a/.github/workflows/check-nixf-tidy.yml b/.github/workflows/check-nixf-tidy.yml index e18964acb7f3..c2082c2fae8f 100644 --- a/.github/workflows/check-nixf-tidy.yml +++ b/.github/workflows/check-nixf-tidy.yml @@ -3,6 +3,7 @@ name: Check changed Nix files with nixf-tidy (experimental) on: pull_request_target: types: [opened, synchronize, reopened, edited] + permissions: contents: read @@ -18,6 +19,7 @@ jobs: ref: refs/pull/${{ github.event.pull_request.number }}/merge # Fetches the merge commit and its parents fetch-depth: 2 + - name: Checking out base branch run: | base=$(mktemp -d) @@ -25,6 +27,7 @@ jobs: git worktree add "$base" "$baseRev" echo "baseRev=$baseRev" >> "$GITHUB_ENV" echo "base=$base" >> "$GITHUB_ENV" + - name: Get Nixpkgs revision for nixf run: | # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf @@ -32,14 +35,17 @@ jobs: # This should not be a URL, because it would allow PRs to run arbitrary code in CI! rev=$(jq -r .rev ci/pinned-nixpkgs.json) echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV" + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 with: # explicitly enable sandbox extra_nix_config: sandbox = true nix_path: nixpkgs=${{ env.url }} + - name: Install nixf and jq # provided jq is incompatible with our expression run: "nix-env -f '' -iAP nixf jq" + - name: Check that Nix files pass nixf-tidy run: | # Filtering error messages we don't like diff --git a/.github/workflows/check-shell.yml b/.github/workflows/check-shell.yml index 0f1595597733..3a153860a09c 100644 --- a/.github/workflows/check-shell.yml +++ b/.github/workflows/check-shell.yml @@ -27,6 +27,8 @@ jobs: with: # pull_request_target checks out the base branch by default ref: refs/pull/${{ github.event.pull_request.number }}/merge + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 + - name: Build shell run: nix-build shell.nix diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml index b5f1f88d0c88..ca68edeaab21 100644 --- a/.github/workflows/codeowners-v2.yml +++ b/.github/workflows/codeowners-v2.yml @@ -1,5 +1,3 @@ -name: Codeowners v2 - # This workflow depends on two GitHub Apps with the following permissions: # - For checking code owners: # - Permissions: @@ -22,6 +20,8 @@ name: Codeowners v2 # # Note that the latter is also used for ./eval.yml requesting reviewers. +name: Codeowners v2 + on: pull_request_target: types: [opened, ready_for_review, synchronize, reopened, edited] @@ -45,67 +45,67 @@ jobs: needs: get-merge-commit if: needs.get-merge-commit.outputs.mergedSha steps: - - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 - - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15 - if: github.repository_owner == 'NixOS' - with: - # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere. - name: nixpkgs-ci - authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' + - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15 + if: github.repository_owner == 'NixOS' + with: + # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere. + name: nixpkgs-ci + authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' - # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself. - # We later build and run code from the base branch with access to secrets, - # so it's important this is not the PRs code. - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - path: base + # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself. + # We later build and run code from the base branch with access to secrets, + # so it's important this is not the PRs code. + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + path: base - - name: Build codeowners validator - run: nix-build base/ci -A codeownersValidator + - name: Build codeowners validator + run: nix-build base/ci -A codeownersValidator - - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1 - id: app-token - with: - app-id: ${{ vars.OWNER_RO_APP_ID }} - private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }} + - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1 + id: app-token + with: + app-id: ${{ vars.OWNER_RO_APP_ID }} + private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }} - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - ref: ${{ needs.get-merge-commit.outputs.mergedSha }} - path: pr + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + ref: ${{ needs.get-merge-commit.outputs.mergedSha }} + path: pr - - name: Validate codeowners - run: result/bin/codeowners-validator - env: - OWNERS_FILE: pr/${{ env.OWNERS_FILE }} - GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }} - REPOSITORY_PATH: pr - OWNER_CHECKER_REPOSITORY: ${{ github.repository }} - # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody - EXPERIMENTAL_CHECKS: "avoid-shadowing" + - name: Validate codeowners + run: result/bin/codeowners-validator + env: + OWNERS_FILE: pr/${{ env.OWNERS_FILE }} + GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }} + REPOSITORY_PATH: pr + OWNER_CHECKER_REPOSITORY: ${{ github.repository }} + # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody + EXPERIMENTAL_CHECKS: "avoid-shadowing" # Request reviews from code owners request: name: Request runs-on: ubuntu-24.04 steps: - - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 - # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head. - # This is intentional, because we need to request the review of owners as declared in the base branch. - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head. + # This is intentional, because we need to request the review of owners as declared in the base branch. + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1 - id: app-token - with: - app-id: ${{ vars.OWNER_APP_ID }} - private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }} + - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1 + id: app-token + with: + app-id: ${{ vars.OWNER_APP_ID }} + private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }} - - name: Build review request package - run: nix-build ci -A requestReviews + - name: Build review request package + run: nix-build ci -A requestReviews - - name: Request reviews - run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE" - env: - GH_TOKEN: ${{ steps.app-token.outputs.token }} + - name: Request reviews + run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE" + env: + GH_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/editorconfig-v2.yml b/.github/workflows/editorconfig-v2.yml index 7c79cef1aae4..90301d84b375 100644 --- a/.github/workflows/editorconfig-v2.yml +++ b/.github/workflows/editorconfig-v2.yml @@ -1,15 +1,15 @@ name: "Checking EditorConfig v2" -permissions: - pull-requests: read - contents: read - on: # avoids approving first time contributors pull_request_target: branches-ignore: - 'release-**' +permissions: + pull-requests: read + contents: read + jobs: get-merge-commit: uses: ./.github/workflows/get-merge-commit.yml @@ -20,29 +20,34 @@ jobs: needs: get-merge-commit if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')" steps: - - name: Get list of changed files from PR - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh api \ - repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \ - | jq '.[] | select(.status != "removed") | .filename' \ - > "$HOME/changed_files" - - name: print list of changed files - run: | - cat "$HOME/changed_files" - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - # pull_request_target checks out the base branch by default - ref: ${{ needs.get-merge-commit.outputs.mergedSha }} - - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 - with: - # nixpkgs commit is pinned so that it doesn't break - # editorconfig-checker 2.4.0 - nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz - - name: Checking EditorConfig - run: | - < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size' - - if: ${{ failure() }} - run: | - echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again." + - name: Get list of changed files from PR + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh api \ + repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \ + | jq '.[] | select(.status != "removed") | .filename' \ + > "$HOME/changed_files" + + - name: print list of changed files + run: | + cat "$HOME/changed_files" + + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + # pull_request_target checks out the base branch by default + ref: ${{ needs.get-merge-commit.outputs.mergedSha }} + + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 + with: + # nixpkgs commit is pinned so that it doesn't break + # editorconfig-checker 2.4.0 + nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz + + - name: Checking EditorConfig + run: | + < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size' + + - if: ${{ failure() }} + run: | + echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again." diff --git a/.github/workflows/eval-lib-tests.yml b/.github/workflows/eval-lib-tests.yml index 39fb99ae0ff9..03efa973ef8c 100644 --- a/.github/workflows/eval-lib-tests.yml +++ b/.github/workflows/eval-lib-tests.yml @@ -1,12 +1,13 @@ name: "Building Nixpkgs lib-tests" -permissions: - contents: read - on: pull_request_target: paths: - 'lib/**' + +permissions: + contents: read + jobs: get-merge-commit: uses: ./.github/workflows/get-merge-commit.yml @@ -21,10 +22,12 @@ jobs: with: # pull_request_target checks out the base branch by default ref: ${{ needs.get-merge-commit.outputs.mergedSha }} + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 with: # explicitly enable sandbox extra_nix_config: sandbox = true + - name: Building Nixpkgs lib-tests run: | nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix diff --git a/.github/workflows/get-merge-commit.yml b/.github/workflows/get-merge-commit.yml index c76215aff60c..827c86316b8b 100644 --- a/.github/workflows/get-merge-commit.yml +++ b/.github/workflows/get-merge-commit.yml @@ -16,28 +16,29 @@ jobs: outputs: mergedSha: ${{ steps.merged.outputs.mergedSha }} steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - path: base - sparse-checkout: ci - - name: Check if the PR can be merged and get the test merge commit - id: merged - env: - GH_TOKEN: ${{ github.token }} - GH_EVENT: ${{ github.event_name }} - run: | - case "$GH_EVENT" in - push) - echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT" - ;; - pull_request_target) - if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then - echo "Checking the merge commit $mergedSha" - echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT" - else - # Skipping so that no notifications are sent - echo "Skipping the rest..." - fi - ;; - esac - rm -rf base + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + path: base + sparse-checkout: ci + + - name: Check if the PR can be merged and get the test merge commit + id: merged + env: + GH_TOKEN: ${{ github.token }} + GH_EVENT: ${{ github.event_name }} + run: | + case "$GH_EVENT" in + push) + echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT" + ;; + pull_request_target) + if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then + echo "Checking the merge commit $mergedSha" + echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT" + else + # Skipping so that no notifications are sent + echo "Skipping the rest..." + fi + ;; + esac + rm -rf base diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml index 5e2e3aeb3751..80a186bbfa62 100644 --- a/.github/workflows/labels.yml +++ b/.github/workflows/labels.yml @@ -1,14 +1,14 @@ +# WARNING: +# When extending this action, be aware that $GITHUB_TOKEN allows some write +# access to the GitHub API. This means that it should not evaluate user input in +# a way that allows code injection. + name: "Label PR" on: pull_request_target: types: [edited, opened, synchronize, reopened] -# WARNING: -# When extending this action, be aware that $GITHUB_TOKEN allows some write -# access to the GitHub API. This means that it should not evaluate user input in -# a way that allows code injection. - permissions: contents: read pull-requests: write @@ -19,7 +19,7 @@ jobs: runs-on: ubuntu-24.04 if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')" steps: - - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0 - with: - repo-token: ${{ secrets.GITHUB_TOKEN }} - sync-labels: true + - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0 + with: + repo-token: ${{ secrets.GITHUB_TOKEN }} + sync-labels: true diff --git a/.github/workflows/manual-nixos-v2.yml b/.github/workflows/manual-nixos-v2.yml index 014fef1f5924..8e6e43af54ca 100644 --- a/.github/workflows/manual-nixos-v2.yml +++ b/.github/workflows/manual-nixos-v2.yml @@ -1,8 +1,5 @@ name: "Build NixOS manual v2" -permissions: - contents: read - on: pull_request_target: branches: @@ -10,6 +7,9 @@ on: paths: - 'nixos/**' +permissions: + contents: read + jobs: nixos: name: nixos-manual-build @@ -20,14 +20,17 @@ jobs: with: # pull_request_target checks out the base branch by default ref: refs/pull/${{ github.event.pull_request.number }}/merge + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 with: # explicitly enable sandbox extra_nix_config: sandbox = true + - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15 with: # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere. name: nixpkgs-ci authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' + - name: Building NixOS manual run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux diff --git a/.github/workflows/manual-nixpkgs-v2.yml b/.github/workflows/manual-nixpkgs-v2.yml index ec8a3f6d9876..43f883454afe 100644 --- a/.github/workflows/manual-nixpkgs-v2.yml +++ b/.github/workflows/manual-nixpkgs-v2.yml @@ -1,8 +1,5 @@ name: "Build Nixpkgs manual v2" -permissions: - contents: read - on: pull_request_target: branches: @@ -12,6 +9,9 @@ on: - 'lib/**' - 'pkgs/tools/nix/nixdoc/**' +permissions: + contents: read + jobs: nixpkgs: name: nixpkgs-manual-build @@ -22,14 +22,17 @@ jobs: with: # pull_request_target checks out the base branch by default ref: refs/pull/${{ github.event.pull_request.number }}/merge + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 with: # explicitly enable sandbox extra_nix_config: sandbox = true + - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15 with: # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere. name: nixpkgs-ci authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}' + - name: Building Nixpkgs manual run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests diff --git a/.github/workflows/nix-parse-v2.yml b/.github/workflows/nix-parse-v2.yml index 61418079e62f..be4113741d78 100644 --- a/.github/workflows/nix-parse-v2.yml +++ b/.github/workflows/nix-parse-v2.yml @@ -1,15 +1,15 @@ name: "Check whether nix files are parseable v2" -permissions: - pull-requests: read - contents: read - on: # avoids approving first time contributors pull_request_target: branches-ignore: - 'release-**' +permissions: + pull-requests: read + contents: read + jobs: get-merge-commit: uses: ./.github/workflows/get-merge-commit.yml @@ -20,30 +20,33 @@ jobs: needs: get-merge-commit if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')" steps: - - name: Get list of changed files from PR - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - gh api \ - repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \ - | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \ - > "$HOME/changed_files" - if [[ -s "$HOME/changed_files" ]]; then - echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV" - fi - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - # pull_request_target checks out the base branch by default - ref: ${{ needs.get-merge-commit.outputs.mergedSha }} - if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }} - - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 - with: - nix_path: nixpkgs=channel:nixpkgs-unstable - - name: Parse all changed or added nix files - run: | - ret=0 - while IFS= read -r file; do - out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; } - done < "$HOME/changed_files" - exit "$ret" - if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }} + - name: Get list of changed files from PR + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + run: | + gh api \ + repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \ + | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \ + > "$HOME/changed_files" + if [[ -s "$HOME/changed_files" ]]; then + echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV" + fi + + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + # pull_request_target checks out the base branch by default + ref: ${{ needs.get-merge-commit.outputs.mergedSha }} + if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }} + + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 + with: + nix_path: nixpkgs=channel:nixpkgs-unstable + + - name: Parse all changed or added nix files + run: | + ret=0 + while IFS= read -r file; do + out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; } + done < "$HOME/changed_files" + exit "$ret" + if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }} diff --git a/.github/workflows/nixpkgs-vet.yml b/.github/workflows/nixpkgs-vet.yml index 5e39f3873b91..7638f7da9a5f 100644 --- a/.github/workflows/nixpkgs-vet.yml +++ b/.github/workflows/nixpkgs-vet.yml @@ -2,6 +2,7 @@ # Among other checks, it makes sure that `pkgs/by-name` (see `../../pkgs/by-name/README.md`) follows the validity rules outlined in [RFC 140](https://github.com/NixOS/rfcs/pull/140). # When you make changes to this workflow, please also update `ci/nixpkgs-vet.sh` to reflect the impact of your work to the CI. # See https://github.com/NixOS/nixpkgs-vet for details on the tool and its checks. + name: Vet nixpkgs on: @@ -37,12 +38,15 @@ jobs: ref: ${{ needs.get-merge-commit.outputs.mergedSha }} # Fetches the merge commit and its parents fetch-depth: 2 + - name: Checking out base branch run: | base=$(mktemp -d) git worktree add "$base" "$(git rev-parse HEAD^1)" echo "base=$base" >> "$GITHUB_ENV" + - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30 + - name: Fetching the pinned tool # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh run: | @@ -55,6 +59,7 @@ jobs: # Adds a result symlink as a GC root. nix-store --realise "$toolPath" --add-root result + - name: Running nixpkgs-vet env: # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/ diff --git a/.github/workflows/no-channel.yml b/.github/workflows/no-channel.yml index b7b61f9d6492..acaa937ad936 100644 --- a/.github/workflows/no-channel.yml +++ b/.github/workflows/no-channel.yml @@ -15,11 +15,11 @@ jobs: name: "This PR is is targeting a channel branch" runs-on: ubuntu-24.04 steps: - - run: | - cat <