actions/checkout: rename from actions/get-merge-commit

This moves the logic to "check whether the PR can be merged and
determine the relevant commits" into the PR / prepare job directly -
since that's the only place where it is supposed to be used.

Because of the if condition in get-merge-commit, this logic was run
multiple times, for example in the lint workflow, where only one of
targetSha or mergedSha was provided as input. However, this input was
thrown away directly. This might not be a big problem, because this was
not expensive, so far. But with the next commit, this will become more
so.

This also separates the logic a bit cleaner - `prepare` figures out all
the parameters for the whole PR workflow, while `checkout` handles the
consistency around these checkouts.

.github/actions/checkout/action.yml

@@ -0,0 +1,54 @@
+name: Checkout
+
+description: 'Checkout into trusted / untrusted / pinned folders consistently.'
+
+inputs:
+  merged-as-untrusted-at:
+    description: "Whether and which SHA to checkout for the merge commit in the ./untrusted folder."
+    type: boolean
+  pinnedFrom:
+    description: "Whether to checkout the pinned nixpkgs for CI and from where (trusted, untrusted)."
+    type: string
+  target-as-trusted-at:
+    description: "Whether and which SHA to checkout for the target commit in the ./trusted folder."
+    type: boolean
+
+runs:
+  using: composite
+  steps:
+    - if: inputs.merged-as-untrusted-at
+      # Would be great to do the checkouts in git worktrees of the existing spare checkout instead,
+      # but Nix is broken with them:
+      # https://github.com/NixOS/nix/issues/6073
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        ref: ${{ inputs.merged-as-untrusted-at }}
+        path: untrusted
+
+    - if: inputs.target-as-trusted-at
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        ref: ${{ inputs.target-as-trusted-at }}
+        path: trusted
+
+    - if: inputs.pinnedFrom
+      id: pinned
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      env:
+        PINNED_FROM: ${{ inputs.pinnedFrom }}
+      with:
+        script: |
+          const path = require('node:path')
+          const pinned = require(path.resolve(path.join(process.env.PINNED_FROM, 'ci', 'pinned.json')))
+          core.setOutput('pinnedSha', pinned.pins.nixpkgs.revision)
+
+    - if: steps.pinned.outputs.pinnedSha
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        ref: ${{ steps.pinned.outputs.pinnedSha }}
+        path: pinned
+        sparse-checkout: |
+          lib
+          maintainers
+          nixos/lib
+          pkgs

.github/actions/get-merge-commit/action.yml

@@ -1,80 +0,0 @@
-name: Get merge commit
-
-description: 'Checks whether the Pull Request is mergeable and checks out the repo at up to two commits: The result of a temporary merge of the head branch into the target branch ("merged"), and the parent of that commit on the target branch ("target"). Handles push events and merge conflicts gracefully.'
-
-inputs:
-  mergedSha:
-    description: "The merge commit SHA, previously collected."
-    type: string
-  merged-as-untrusted:
-    description: "Whether to checkout the merge commit in the ./untrusted folder."
-    type: boolean
-  pinnedFrom:
-    description: "Whether to checkout the pinned nixpkgs for CI and from where (trusted, untrusted)."
-    type: string
-  targetSha:
-    description: "The target commit SHA, previously collected."
-    type: string
-  target-as-trusted:
-    description: "Whether to checkout the target commit in the ./trusted folder."
-    type: boolean
-
-outputs:
-  mergedSha:
-    description: "The merge commit SHA"
-    value: ${{ steps.commits.outputs.mergedSha }}
-  targetSha:
-    description: "The target commit SHA"
-    value: ${{ steps.commits.outputs.targetSha }}
-
-runs:
-  using: composite
-  steps:
-    - id: commits
-      if: ${{ !inputs.mergedSha && !inputs.targetSha }}
-      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-      with:
-        script: |
-          require('./ci/github-script/prepare.js')({
-            github,
-            context,
-            core,
-          })
-
-    - if: inputs.merged-as-untrusted && (inputs.mergedSha || steps.commits.outputs.mergedSha)
-      # Would be great to do the checkouts in git worktrees of the existing spare checkout instead,
-      # but Nix is broken with them:
-      # https://github.com/NixOS/nix/issues/6073
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        ref: ${{ inputs.mergedSha || steps.commits.outputs.mergedSha }}
-        path: untrusted
-
-    - if: inputs.target-as-trusted && (inputs.targetSha || steps.commits.outputs.targetSha)
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        ref: ${{ inputs.targetSha || steps.commits.outputs.targetSha }}
-        path: trusted
-
-    - if: inputs.pinnedFrom
-      id: pinned
-      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-      env:
-        PINNED_FROM: ${{ inputs.pinnedFrom }}
-      with:
-        script: |
-          const path = require('node:path')
-          const pinned = require(path.resolve(path.join(process.env.PINNED_FROM, 'ci', 'pinned.json')))
-          core.setOutput('pinnedSha', pinned.pins.nixpkgs.revision)
-
-    - if: steps.pinned.outputs.pinnedSha
-      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      with:
-        ref: ${{ steps.pinned.outputs.pinnedSha }}
-        path: pinned
-        sparse-checkout: |
-          lib
-          maintainers
-          nixos/lib
-          pkgs
-

.github/workflows/README.md

@@ -17,7 +17,7 @@ Some architectural notes about key decisions and concepts in our workflows:
   This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?".
   The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore).
   This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout.
-  Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.
+  Thus, we use the `prepare` job to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.
 
 - Various workflows need to make comparisons against the base branch.
   In this case, we checkout the parent of the "test merge commit" for best results.

.github/workflows/build.yml

@@ -47,11 +47,10 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
+      - name: Checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
+        uses: ./.github/actions/checkout
         with:
-          mergedSha: ${{ inputs.mergedSha }}
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
           pinnedFrom: untrusted
 
       - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31

.github/workflows/check.yml

@@ -99,14 +99,12 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge and target commits
+      - name: Checkout merge and target commits
-        uses: ./.github/actions/get-merge-commit
+        uses: ./.github/actions/checkout
         with:
-          mergedSha: ${{ inputs.mergedSha }}
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
           pinnedFrom: trusted
-          targetSha: ${{ inputs.targetSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
-          target-as-trusted: true
 
       - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
 

.github/workflows/eval.yml

@@ -88,10 +88,9 @@ jobs:
         with:
           sparse-checkout: .github/actions
       - name: Check out the PR at the test merge commit
-        uses: ./.github/actions/get-merge-commit
+        uses: ./.github/actions/checkout
         with:
-          mergedSha: ${{ inputs.mergedSha }}
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
           pinnedFrom: untrusted
 
       - name: Install Nix
@@ -206,10 +205,9 @@ jobs:
         with:
           sparse-checkout: .github/actions
       - name: Check out the PR at the target commit
-        uses: ./.github/actions/get-merge-commit
+        uses: ./.github/actions/checkout
         with:
-          targetSha: ${{ inputs.targetSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
-          target-as-trusted: true
           pinnedFrom: trusted
 
       - name: Download output paths and eval stats for all systems
@@ -375,11 +373,10 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
+      - name: Checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
+        uses: ./.github/actions/checkout
         with:
-          mergedSha: ${{ inputs.mergedSha }}
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
 
       - name: Install Nix
         uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31

.github/workflows/lint.yml

@@ -24,11 +24,10 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
+      - name: Checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
+        uses: ./.github/actions/checkout
         with:
-          mergedSha: ${{ inputs.mergedSha }}
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
           pinnedFrom: untrusted
 
       - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
@@ -56,11 +55,10 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout the merge commit
+      - name: Checkout the merge commit
-        uses: ./.github/actions/get-merge-commit
+        uses: ./.github/actions/checkout
         with:
-          mergedSha: ${{ inputs.mergedSha }}
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
           pinnedFrom: untrusted
 
       - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
@@ -77,14 +75,12 @@ jobs:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           sparse-checkout: .github/actions
-      - name: Check if the PR can be merged and checkout merged and target commits
+      - name: Checkout merge and target commits
-        uses: ./.github/actions/get-merge-commit
+        uses: ./.github/actions/checkout
         with:
-          mergedSha: ${{ inputs.mergedSha }}
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          merged-as-untrusted: true
           pinnedFrom: untrusted
-          targetSha: ${{ inputs.targetSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
-          target-as-trusted: true
 
       - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
 

.github/workflows/pr.yml

@@ -3,7 +3,7 @@ name: PR
 on:
   pull_request:
     paths:
-      - .github/actions/get-merge-commit/action.yml
+      - .github/actions/checkout/action.yml
       - .github/workflows/build.yml
       - .github/workflows/check.yml
       - .github/workflows/eval.yml
@@ -25,21 +25,24 @@ jobs:
     outputs:
       baseBranch: ${{ steps.branches.outputs.base }}
       headBranch: ${{ steps.branches.outputs.head }}
-      mergedSha: ${{ steps.get-merge-commit.outputs.mergedSha }}
+      mergedSha: ${{ steps.prepare.outputs.mergedSha }}
-      targetSha: ${{ steps.get-merge-commit.outputs.targetSha }}
+      targetSha: ${{ steps.prepare.outputs.targetSha }}
       systems: ${{ steps.systems.outputs.systems }}
       touched: ${{ steps.files.outputs.touched }}
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           sparse-checkout: |
-            .github/actions
             ci/github-script
-            ci/supportedBranches.js
+      - id: prepare
-            ci/supportedSystems.json
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
-      - name: Check if the PR can be merged and get the test merge commit
+        with:
-        uses: ./.github/actions/get-merge-commit
+          script: |
-        id: get-merge-commit
+            require('./ci/github-script/prepare.js')({
+              github,
+              context,
+              core,
+            })
 
       - name: Load supported systems
         id: systems