From b51e104439587fabc53e3f644bcef0af43f10c23 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Mon, 18 Aug 2025 20:55:12 +0200 Subject: [PATCH] actions/checkout: rename from actions/get-merge-commit This moves the logic to "check whether the PR can be merged and determine the relevant commits" into the PR / prepare job directly - since that's the only place where it is supposed to be used. Because of the if condition in get-merge-commit, this logic was run multiple times, for example in the lint workflow, where only one of targetSha or mergedSha was provided as input. However, this input was thrown away directly. This might not be a big problem, because this was not expensive, so far. But with the next commit, this will become more so. This also separates the logic a bit cleaner - `prepare` figures out all the parameters for the whole PR workflow, while `checkout` handles the consistency around these checkouts. --- .github/actions/checkout/action.yml | 54 ++++++++++++++ .github/actions/get-merge-commit/action.yml | 80 --------------------- .github/workflows/README.md | 2 +- .github/workflows/build.yml | 7 +- .github/workflows/check.yml | 10 ++- .github/workflows/eval.yml | 17 ++--- .github/workflows/lint.yml | 24 +++---- .github/workflows/pr.yml | 21 +++--- 8 files changed, 91 insertions(+), 124 deletions(-) create mode 100644 .github/actions/checkout/action.yml delete mode 100644 .github/actions/get-merge-commit/action.yml diff --git a/.github/actions/checkout/action.yml b/.github/actions/checkout/action.yml new file mode 100644 index 000000000000..e3c592f6e53a --- /dev/null +++ b/.github/actions/checkout/action.yml @@ -0,0 +1,54 @@ +name: Checkout + +description: 'Checkout into trusted / untrusted / pinned folders consistently.' + +inputs: + merged-as-untrusted-at: + description: "Whether and which SHA to checkout for the merge commit in the ./untrusted folder." + type: boolean + pinnedFrom: + description: "Whether to checkout the pinned nixpkgs for CI and from where (trusted, untrusted)." + type: string + target-as-trusted-at: + description: "Whether and which SHA to checkout for the target commit in the ./trusted folder." + type: boolean + +runs: + using: composite + steps: + - if: inputs.merged-as-untrusted-at + # Would be great to do the checkouts in git worktrees of the existing spare checkout instead, + # but Nix is broken with them: + # https://github.com/NixOS/nix/issues/6073 + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + ref: ${{ inputs.merged-as-untrusted-at }} + path: untrusted + + - if: inputs.target-as-trusted-at + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + ref: ${{ inputs.target-as-trusted-at }} + path: trusted + + - if: inputs.pinnedFrom + id: pinned + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + env: + PINNED_FROM: ${{ inputs.pinnedFrom }} + with: + script: | + const path = require('node:path') + const pinned = require(path.resolve(path.join(process.env.PINNED_FROM, 'ci', 'pinned.json'))) + core.setOutput('pinnedSha', pinned.pins.nixpkgs.revision) + + - if: steps.pinned.outputs.pinnedSha + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + ref: ${{ steps.pinned.outputs.pinnedSha }} + path: pinned + sparse-checkout: | + lib + maintainers + nixos/lib + pkgs diff --git a/.github/actions/get-merge-commit/action.yml b/.github/actions/get-merge-commit/action.yml deleted file mode 100644 index 1d37ef6abd43..000000000000 --- a/.github/actions/get-merge-commit/action.yml +++ /dev/null @@ -1,80 +0,0 @@ -name: Get merge commit - -description: 'Checks whether the Pull Request is mergeable and checks out the repo at up to two commits: The result of a temporary merge of the head branch into the target branch ("merged"), and the parent of that commit on the target branch ("target"). Handles push events and merge conflicts gracefully.' - -inputs: - mergedSha: - description: "The merge commit SHA, previously collected." - type: string - merged-as-untrusted: - description: "Whether to checkout the merge commit in the ./untrusted folder." - type: boolean - pinnedFrom: - description: "Whether to checkout the pinned nixpkgs for CI and from where (trusted, untrusted)." - type: string - targetSha: - description: "The target commit SHA, previously collected." - type: string - target-as-trusted: - description: "Whether to checkout the target commit in the ./trusted folder." - type: boolean - -outputs: - mergedSha: - description: "The merge commit SHA" - value: ${{ steps.commits.outputs.mergedSha }} - targetSha: - description: "The target commit SHA" - value: ${{ steps.commits.outputs.targetSha }} - -runs: - using: composite - steps: - - id: commits - if: ${{ !inputs.mergedSha && !inputs.targetSha }} - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 - with: - script: | - require('./ci/github-script/prepare.js')({ - github, - context, - core, - }) - - - if: inputs.merged-as-untrusted && (inputs.mergedSha || steps.commits.outputs.mergedSha) - # Would be great to do the checkouts in git worktrees of the existing spare checkout instead, - # but Nix is broken with them: - # https://github.com/NixOS/nix/issues/6073 - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - ref: ${{ inputs.mergedSha || steps.commits.outputs.mergedSha }} - path: untrusted - - - if: inputs.target-as-trusted && (inputs.targetSha || steps.commits.outputs.targetSha) - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - ref: ${{ inputs.targetSha || steps.commits.outputs.targetSha }} - path: trusted - - - if: inputs.pinnedFrom - id: pinned - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 - env: - PINNED_FROM: ${{ inputs.pinnedFrom }} - with: - script: | - const path = require('node:path') - const pinned = require(path.resolve(path.join(process.env.PINNED_FROM, 'ci', 'pinned.json'))) - core.setOutput('pinnedSha', pinned.pins.nixpkgs.revision) - - - if: steps.pinned.outputs.pinnedSha - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - ref: ${{ steps.pinned.outputs.pinnedSha }} - path: pinned - sparse-checkout: | - lib - maintainers - nixos/lib - pkgs - diff --git a/.github/workflows/README.md b/.github/workflows/README.md index 10b0276be144..2c739bd56129 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -17,7 +17,7 @@ Some architectural notes about key decisions and concepts in our workflows: This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?". The checkout could be done via the virtual branch `refs/pull//merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore). This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout. - Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs. + Thus, we use the `prepare` job to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs. - Various workflows need to make comparisons against the base branch. In this case, we checkout the parent of the "test merge commit" for best results. diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ef3c71ca4fbe..d8fe8272d625 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -47,11 +47,10 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: sparse-checkout: .github/actions - - name: Check if the PR can be merged and checkout the merge commit - uses: ./.github/actions/get-merge-commit + - name: Checkout the merge commit + uses: ./.github/actions/checkout with: - mergedSha: ${{ inputs.mergedSha }} - merged-as-untrusted: true + merged-as-untrusted-at: ${{ inputs.mergedSha }} pinnedFrom: untrusted - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31 diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml index c06729fa7f5d..aca22eddff6b 100644 --- a/.github/workflows/check.yml +++ b/.github/workflows/check.yml @@ -99,14 +99,12 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: sparse-checkout: .github/actions - - name: Check if the PR can be merged and checkout the merge and target commits - uses: ./.github/actions/get-merge-commit + - name: Checkout merge and target commits + uses: ./.github/actions/checkout with: - mergedSha: ${{ inputs.mergedSha }} - merged-as-untrusted: true + merged-as-untrusted-at: ${{ inputs.mergedSha }} pinnedFrom: trusted - targetSha: ${{ inputs.targetSha }} - target-as-trusted: true + target-as-trusted-at: ${{ inputs.targetSha }} - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31 diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index a89f2e4d5f9b..a92e64de6715 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -88,10 +88,9 @@ jobs: with: sparse-checkout: .github/actions - name: Check out the PR at the test merge commit - uses: ./.github/actions/get-merge-commit + uses: ./.github/actions/checkout with: - mergedSha: ${{ inputs.mergedSha }} - merged-as-untrusted: true + merged-as-untrusted-at: ${{ inputs.mergedSha }} pinnedFrom: untrusted - name: Install Nix @@ -206,10 +205,9 @@ jobs: with: sparse-checkout: .github/actions - name: Check out the PR at the target commit - uses: ./.github/actions/get-merge-commit + uses: ./.github/actions/checkout with: - targetSha: ${{ inputs.targetSha }} - target-as-trusted: true + target-as-trusted-at: ${{ inputs.targetSha }} pinnedFrom: trusted - name: Download output paths and eval stats for all systems @@ -375,11 +373,10 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: sparse-checkout: .github/actions - - name: Check if the PR can be merged and checkout the merge commit - uses: ./.github/actions/get-merge-commit + - name: Checkout the merge commit + uses: ./.github/actions/checkout with: - mergedSha: ${{ inputs.mergedSha }} - merged-as-untrusted: true + merged-as-untrusted-at: ${{ inputs.mergedSha }} - name: Install Nix uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 44cb7fe7bada..817f42d496ad 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -24,11 +24,10 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: sparse-checkout: .github/actions - - name: Check if the PR can be merged and checkout the merge commit - uses: ./.github/actions/get-merge-commit + - name: Checkout the merge commit + uses: ./.github/actions/checkout with: - mergedSha: ${{ inputs.mergedSha }} - merged-as-untrusted: true + merged-as-untrusted-at: ${{ inputs.mergedSha }} pinnedFrom: untrusted - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31 @@ -56,11 +55,10 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: sparse-checkout: .github/actions - - name: Check if the PR can be merged and checkout the merge commit - uses: ./.github/actions/get-merge-commit + - name: Checkout the merge commit + uses: ./.github/actions/checkout with: - mergedSha: ${{ inputs.mergedSha }} - merged-as-untrusted: true + merged-as-untrusted-at: ${{ inputs.mergedSha }} pinnedFrom: untrusted - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31 @@ -77,14 +75,12 @@ jobs: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: sparse-checkout: .github/actions - - name: Check if the PR can be merged and checkout merged and target commits - uses: ./.github/actions/get-merge-commit + - name: Checkout merge and target commits + uses: ./.github/actions/checkout with: - mergedSha: ${{ inputs.mergedSha }} - merged-as-untrusted: true + merged-as-untrusted-at: ${{ inputs.mergedSha }} pinnedFrom: untrusted - targetSha: ${{ inputs.targetSha }} - target-as-trusted: true + target-as-trusted-at: ${{ inputs.targetSha }} - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31 diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 1de7d6614c9c..a2636d75022f 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -3,7 +3,7 @@ name: PR on: pull_request: paths: - - .github/actions/get-merge-commit/action.yml + - .github/actions/checkout/action.yml - .github/workflows/build.yml - .github/workflows/check.yml - .github/workflows/eval.yml @@ -25,21 +25,24 @@ jobs: outputs: baseBranch: ${{ steps.branches.outputs.base }} headBranch: ${{ steps.branches.outputs.head }} - mergedSha: ${{ steps.get-merge-commit.outputs.mergedSha }} - targetSha: ${{ steps.get-merge-commit.outputs.targetSha }} + mergedSha: ${{ steps.prepare.outputs.mergedSha }} + targetSha: ${{ steps.prepare.outputs.targetSha }} systems: ${{ steps.systems.outputs.systems }} touched: ${{ steps.files.outputs.touched }} steps: - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 with: sparse-checkout: | - .github/actions ci/github-script - ci/supportedBranches.js - ci/supportedSystems.json - - name: Check if the PR can be merged and get the test merge commit - uses: ./.github/actions/get-merge-commit - id: get-merge-commit + - id: prepare + uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 + with: + script: | + require('./ci/github-script/prepare.js')({ + github, + context, + core, + }) - name: Load supported systems id: systems