Merge branch 'master' into current

Signed-off-by: Florian Brandes <florian.brandes@posteo.de>

.devcontainer/devcontainer.json

@@ -1,30 +0,0 @@
-{
-  "name": "nixpkgs",
-  "image": "mcr.microsoft.com/devcontainers/universal:2-linux",
-  "features": {
-    "ghcr.io/devcontainers/features/nix:1": {
-      // fails in the devcontainer sandbox, enable sandbox via config instead
-      "multiUser": false,
-      "packages": "nixpkgs.nixd,nixpkgs.nixfmt-rfc-style",
-      "useAttributePath": true,
-      "extraNixConfig": "experimental-features = nix-command flakes,sandbox = true"
-    }
-  },
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "jnoortheen.nix-ide"
-      ],
-      "settings": {
-        "[nix]": {
-            "editor.formatOnSave": true
-        },
-        "nix.enableLanguageServer": true,
-        "nix.serverPath": "nixd"
-      }
-    }
-  },
-  "remoteEnv": {
-    "NIXPKGS": "/workspaces/nixpkgs"
-  }
-}

.editorconfig

@@ -24,7 +24,7 @@ insert_final_newline = false
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
 # Match json/lockfiles/markdown/nix/perl/python/ruby/shell/docbook files, set indent to spaces
-[*.{bash,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
+[*.{json,lock,md,nix,pl,pm,py,rb,sh,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
@@ -36,7 +36,7 @@ indent_size = 1
 indent_size = 2
 
 # Match perl/python/shell scripts, set indent width of four
-[*.{bash,pl,pm,py,sh}]
+[*.{pl,pm,py,sh}]
 indent_size = 4
 
 # Match gemfiles, set indent to spaces with width of two
@@ -44,10 +44,6 @@ indent_size = 4
 indent_size = 2
 indent_style = space
 
-# Match package.json, which are generally pulled from upstream and accept them as they are
-[package.json]
-indent_style = unset
-
 # Disable file types or individual files
 # some of these files may be auto-generated and/or require significant changes
 
@@ -90,7 +86,7 @@ indent_style = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset
 
-[registry.dat]
+[pkgs/development/compilers/elm/registry.dat]
 end_of_line = unset
 insert_final_newline = unset
 
@@ -107,11 +103,6 @@ trim_trailing_whitespace = unset
 [pkgs/tools/misc/timidity/timidity.cfg]
 trim_trailing_whitespace = unset
 
-[pkgs/tools/security/qdigidoc/vendor/*]
-end_of_line = unset
-insert_final_newline = unset
-trim_trailing_whitespace = unset
-
 [pkgs/tools/virtualization/ovftool/*.ova]
 end_of_line = unset
 insert_final_newline = unset

.git-blame-ignore-revs

@@ -1,11 +1,5 @@
 # This file contains a list of commits that are not likely what you
 # are looking for in a blame, such as mass reformatting or renaming.
-#
-# If a commit's line ends with `# !autorebase <command>`,
-# where <command> is an idempotent bash command that reapplies the changes from the commit,
-# the `maintainers/scripts/auto-rebase/run.sh` script can be used to rebase
-# across that commit while automatically resolving merge conflicts caused by the commit.
-#
 # You can set this file as a default ignore file for blame by running
 # the following command.
 #
@@ -46,9 +40,6 @@ d1c1a0c656ccd8bd3b25d3c4287f2d075faf3cf3
 # fix indentation in meteor default.nix
 a37a6de881ec4c6708e6b88fd16256bbc7f26bbd
 
-# pkgs/stdenv/make-derivation: Reindent
-b4cc2a2479a7ab0f6440b2e1319221920ef72699
-
 # treewide: automatically md-convert option descriptions
 2e751c0772b9d48ff6923569adfa661b030ab6a2
 
@@ -130,136 +121,3 @@ c759efa5e7f825913f9a69ef20f025f50f56dc4d
 
 # python3Packages: format with nixfmt
 59b1aef59071cae6e87859dc65de973d2cc595c0
-
-# treewide description changes (#317959)
-bf995e3641950f4183c1dd9010349263dfa0123b
-755b915a158c9d588f08e9b08da9f7f3422070cc
-f8c4a98e8e138e21353a2c33b90db3359f539b37
-
-# vscode-extensions.*: format with nixfmt (RFC 166)
-7bf9febfa6271012b1ef86647a3a06f06875fdcf
-
-# remove uses of mdDoc (#303841)
-1a24330f792c8625746d07d842290e6fd95ae6f9
-acd0e3898feb321cb9a71a0fd376f1157d0f4553
-1b28414d2886c57343864326dbb745a634d3e37d
-6afb255d976f85f3359e4929abd6f5149c323a02
-
-# azure-cli: move to by-name, nixfmt #325950
-96cd538b68bd1d0a0a37979356d669abbba32ebc
-
-# poptracker: format with nixfmt-rfc-style (#326697)
-ff5c8f6cc3d1f2e017e86d50965c14b71f00567b
-
-# mangal: format with nixfmt-rfc-style #328284
-3bb5e993cac3a6e1c3056d2bc9bf43eb2c7a5951
-
-# pico-sdk: switch to finalAttrs (#329438)
-8946018b0391ae594d167f1e58497b18de068968
-
-# ollama: format with nixfmt-rfc-style (#329353)
-bdfde18037f8d9f9b641a4016c8ada4dc4cbf856
-
-# nixos/ollama: format with nixfmt-rfc-style (#329561)
-246d1ee533810ac1946d863bbd9de9b525818d56
-
-# steam: cleanup (#216972)
-ad815aebfbfe1415ff6436521d545029c803c3fb
-
-# nixos/nvidia: apply nixfmt-rfc-style (#313440)
-fbdcdde04a7caa007e825a8b822c75fab9adb2d6
-
-# treewide: reformat files which need reformatting after (#341407)
-e0464e47880a69896f0fb1810f00e0de469f770a
-
-# step-cli: format package.nix with nixfmt (#331629)
-fc7a83f8b62e90de5679e993d4d49ca014ea013d
-
-# ndn-cxx: format with nixfmt-rfc-style
-160b2b769c3b8a6d1ae9947afa77520fa2887db7
-
-# ndn-tools: format with nixfmt-rfc-style
-4882ef721ce3d7bb3b5e48ff80125255db515013
-
-# nfd: format with nixfmt-rfc-style
-548c2377fa81e2abfc192fbf4f521e601251c468
-
-# darwin.stdenv: format with nixfmt-rfc-style (#333962)
-93c10ac9e561c6594d3baaeaff2341907390d9b8
-
-# nrr: format with nixfmt-rfc-style (#334578)
-cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
-
-# nixos/kanidm: inherit lib, nixfmt
-8f18393d380079904d072007fb19dc64baef0a3a
-
-# fetchurl: nixfmt-rfc-style
-ce21e97a1f20dee15da85c084f9d1148d84f853b
-
-# percona: apply nixfmt
-8d14fa2886fec877690c6d28cfcdba4503dbbcea
-
-# nixos/virtualisation: format image-related files
-# Original formatting commit that was reverted
-04fadac429ca7d6b92025188652376c230205730
-# Revert commit
-4cec81a9959ce612b653860dcca53101a36f328a
-# Final commit that does the formatting
-88b285c01d84de82c0b2b052fd28eaf6709c2d26
-
-# sqlc: format with nixfmt
-2bdec131b2bb2c8563f4556d741d34ccb77409e2
-
-# ant: format with nixfmt-rfc-style
-2538d58436b8d0b56d29780aeebf4bf720ddb9ea
-
-# treewide: migrate packages to pkgs/by-name, take 1
-571c71e6f73af34a229414f51585738894211408
-
-# format files with nixfmt (#347275)
-adb9714bd909df283c66bbd641bd631ff50a4260
-
-# treewide: incus packages
-9ab59bb5fb943ad6740f64f5a79eae9642fb8211
-
-# treewide nixfmt reformat pass 1, master, staging and staging-next
-4f0dadbf38ee4cf4cc38cbc232b7708fddf965bc
-667d42c00d566e091e6b9a19b365099315d0e611
-84d4f874c2bac9f3118cb6907d7113b3318dcb5e
-
-# tmuxPlugins sha-to-sri.py script
-516b1e74c358a9c4b06e5591f8c1a2897aad0c33
-
-# treewide: migrate comments in lib to rfc145 style
-ef85e0daa092c9eae0d32c7ce16b889728a5fbc0
-d89ad6c70e0e89aaae75e9f886878ea4e103965a
-e0fe216f4912dd88a021d12a44155fd2cfeb31c8
-80d5b411f6397d5c3e755a0635d95742f76f3c75
-
-# nixos/movim: format with nixfmt-rfc-style
-43c1654cae47cbf987cb63758c06245fa95c1e3b
-
-# nixos/iso-image.nix: nixfmt
-da9a092c34cef6947d7aee2b134f61df45171631
-
-# python-packages: format with nixfmt-rfc-style
-5f6f5e13ae0b6960cbf1be8aeb3d0048285a08d1
-
-# python-packages: sort with keep-sorted
-fd14c067813572afc03ddbf7cdedc3eab5a59954
-783add849cbca228a36ffdf407e5d380dc2fe6c4
-
-# treewide format of all Nix files
-374e6bcc403e02a35e07b650463c01a52b13a7c8 # !autorebase nix-shell --run treefmt
-
-# nix: nixfmt-rfc-style
-a4f7e161b380b35b2f7bc432659a95fd71254ad8
-0812c9a321003c924868051d2b2e1934e8880f3f
-34f269c14ac18d89ddee9a8f54b1ca92a85bbcc6
-062c34cdace499aa44f0fa6ca6f2ca71769f6c43
-
-# haskellPackages.hercules-ci-agent (cabal2nix -> nixfmt-rfc-style)
-9314da7ee8d2aedfb15193b8c489da51efe52bb5
-
-# nix-builder-vm: nixfmt-rfc-style
-a034fb50f79816c6738fb48b48503b09ea3b0132

.gitattributes

@@ -16,5 +16,3 @@ nixos/doc/default.nix linguist-documentation=false
 
 nixos/modules/module-list.nix merge=union
 # pkgs/top-level/all-packages.nix merge=union
-
-ci/OWNERS linguist-language=CODEOWNERS

.github/CODEOWNERS

@@ -0,0 +1,379 @@
+# CODEOWNERS file
+#
+# This file is used to describe who owns what in this repository. This file does not
+# replace `meta.maintainers` but is instead used for other things than derivations
+# and modules, like documentation, package sets, and other assets.
+#
+# For documentation on this file, see https://help.github.com/articles/about-codeowners/
+# Mentioned users will get code review requests.
+#
+# IMPORTANT NOTE: in order to actually get pinged, commit access is required.
+# This also holds true for GitHub teams. Since almost none of our teams have write
+# permissions, you need to list all members of the team with commit access individually.
+
+# GitHub actions
+/.github/workflows @NixOS/Security @Mic92 @zowoq
+
+# EditorConfig
+/.editorconfig @Mic92 @zowoq
+
+# Libraries
+/lib                        @infinisil
+/lib/systems                @alyssais @ericson2314
+/lib/generators.nix         @infinisil @Profpatsch
+/lib/cli.nix                @infinisil @Profpatsch
+/lib/debug.nix              @infinisil @Profpatsch
+/lib/asserts.nix            @infinisil @Profpatsch
+/lib/path.*                 @infinisil
+/lib/fileset                @infinisil
+## Libraries / Module system
+/lib/modules.nix            @infinisil @roberth
+/lib/types.nix              @infinisil @roberth
+/lib/options.nix            @infinisil @roberth
+/lib/tests/modules.sh       @infinisil @roberth
+/lib/tests/modules          @infinisil @roberth
+
+# Nixpkgs Internals
+/default.nix                                     @Ericson2314
+/pkgs/top-level/default.nix                      @Ericson2314
+/pkgs/top-level/impure.nix                       @Ericson2314
+/pkgs/top-level/stage.nix                        @Ericson2314
+/pkgs/top-level/splice.nix                       @Ericson2314
+/pkgs/top-level/release-cross.nix                @Ericson2314
+/pkgs/stdenv/generic                             @Ericson2314
+/pkgs/stdenv/generic/check-meta.nix              @Ericson2314
+/pkgs/stdenv/cross                               @Ericson2314
+/pkgs/build-support/cc-wrapper                   @Ericson2314
+/pkgs/build-support/bintools-wrapper             @Ericson2314
+/pkgs/build-support/setup-hooks                  @Ericson2314
+/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
+/pkgs/build-support/setup-hooks/auto-patchelf.py @layus
+/pkgs/pkgs-lib                                   @infinisil
+## Format generators/serializers
+/pkgs/pkgs-lib/formats/libconfig                 @ckiee @h7x4
+/pkgs/pkgs-lib/formats/hocon                     @h7x4
+
+# pkgs/by-name
+/pkgs/test/check-by-name @infinisil
+/pkgs/by-name/README.md @infinisil
+/pkgs/top-level/by-name-overlay.nix @infinisil
+/.github/workflows/check-by-name.yml @infinisil
+
+# Nixpkgs build-support
+/pkgs/build-support/writers @lassulus @Profpatsch
+
+# Nixpkgs make-disk-image
+/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
+/nixos/lib/make-disk-image.nix                 @raitobezarius
+
+# Nix, the package manager
+pkgs/tools/package-management/nix/                    @raitobezarius
+nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius
+
+# Nixpkgs documentation
+/maintainers/scripts/db-to-md.sh @jtojnar @ryantm
+/maintainers/scripts/doc @jtojnar @ryantm
+
+# Contributor documentation
+/CONTRIBUTING.md @infinisil
+/.github/PULL_REQUEST_TEMPLATE.md @infinisil
+/doc/contributing/ @infinisil
+/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
+/lib/README.md @infinisil
+/doc/README.md @infinisil
+/nixos/README.md @infinisil
+/pkgs/README.md @infinisil
+/maintainers/README.md @infinisil
+
+# User-facing development documentation
+/doc/development.md @infinisil
+/doc/development @infinisil
+
+# NixOS Internals
+/nixos/default.nix                                    @infinisil
+/nixos/lib/from-env.nix                               @infinisil
+/nixos/lib/eval-config.nix                            @infinisil
+/nixos/modules/system                                 @dasJ
+/nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
+/nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
+
+# NixOS integration test driver
+/nixos/lib/test-driver  @tfc
+
+# NixOS QEMU virtualisation
+/nixos/virtualisation/qemu-vm.nix           @raitobezarius
+
+# Systemd
+/nixos/modules/system/boot/systemd.nix      @NixOS/systemd
+/nixos/modules/system/boot/systemd          @NixOS/systemd
+/nixos/lib/systemd-*.nix                    @NixOS/systemd
+/pkgs/os-specific/linux/systemd             @NixOS/systemd
+
+# Systemd-boot
+/nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
+
+# Images and installer media
+/nixos/modules/installer/cd-dvd/            @samueldr
+/nixos/modules/installer/sd-card/           @samueldr
+
+# Updaters
+## update.nix
+/maintainers/scripts/update.nix   @jtojnar
+/maintainers/scripts/update.py    @jtojnar
+## common-updater-scripts
+/pkgs/common-updater/scripts/update-source-version    @jtojnar
+
+# Python-related code and docs
+/doc/languages-frameworks/python.section.md                 @mweinelt
+/pkgs/development/interpreters/python/hooks                 @jonringer
+
+# Haskell
+/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier
+/maintainers/scripts/haskell                  @sternenseemann @maralorn @ncfavier
+/pkgs/development/compilers/ghc               @sternenseemann @maralorn @ncfavier
+/pkgs/development/haskell-modules             @sternenseemann @maralorn @ncfavier
+/pkgs/test/haskell                            @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @ncfavier
+
+# Perl
+/pkgs/development/interpreters/perl @stigtsp @zakame @dasJ @marcusramberg
+/pkgs/top-level/perl-packages.nix   @stigtsp @zakame @dasJ @marcusramberg
+/pkgs/development/perl-modules      @stigtsp @zakame @dasJ @marcusramberg
+
+# R
+/pkgs/applications/science/math/R   @jbedo
+/pkgs/development/r-modules         @jbedo
+
+# Rust
+/pkgs/development/compilers/rust @Mic92 @zowoq @winterqt @figsoda
+/pkgs/build-support/rust @zowoq @winterqt @figsoda
+/doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
+
+# C compilers
+/pkgs/development/compilers/gcc
+/pkgs/development/compilers/llvm @RossComputerGuy
+/pkgs/development/compilers/emscripten @raitobezarius
+/doc/languages-frameworks/emscripten.section.md @raitobezarius
+
+# Audio
+/nixos/modules/services/audio/botamusique.nix @mweinelt
+/nixos/modules/services/audio/snapserver.nix @mweinelt
+/nixos/tests/modules/services/audio/botamusique.nix @mweinelt
+/nixos/tests/snapcast.nix @mweinelt
+
+# Browsers
+/pkgs/applications/networking/browsers/firefox @mweinelt
+/pkgs/applications/networking/browsers/chromium @emilylange
+/nixos/tests/chromium.nix @emilylange
+
+# Certificate Authorities
+pkgs/data/misc/cacert/ @ajs124 @lukegb @mweinelt
+pkgs/development/libraries/nss/ @ajs124 @lukegb @mweinelt
+pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
+
+# Jetbrains
+/pkgs/applications/editors/jetbrains @edwtjo
+
+# Licenses
+/lib/licenses.nix @alyssais
+
+# Qt
+/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
+
+# KDE / Plasma 5
+/pkgs/applications/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/desktops/plasma-5 @K900 @NickCao @SuperSandro2000 @ttuegel
+/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
+
+# KDE / Plasma 6
+/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
+
+# PostgreSQL and related stuff
+/pkgs/servers/sql/postgresql @thoughtpolice
+/nixos/modules/services/databases/postgresql.xml @thoughtpolice
+/nixos/modules/services/databases/postgresql.nix @thoughtpolice
+/nixos/tests/postgresql.nix @thoughtpolice
+
+# Hardened profile & related modules
+/nixos/modules/profiles/hardened.nix @joachifm
+/nixos/modules/security/hidepid.nix @joachifm
+/nixos/modules/security/lock-kernel-modules.nix @joachifm
+/nixos/modules/security/misc.nix @joachifm
+/nixos/tests/hardened.nix @joachifm
+/pkgs/os-specific/linux/kernel/hardened-config.nix @joachifm
+
+# Home Automation
+/nixos/modules/services/misc/home-assistant.nix @mweinelt
+/nixos/modules/services/misc/zigbee2mqtt.nix @mweinelt
+/nixos/tests/home-assistant.nix @mweinelt
+/nixos/tests/zigbee2mqtt.nix @mweinelt
+/pkgs/servers/home-assistant @mweinelt
+/pkgs/tools/misc/esphome @mweinelt
+
+# Network Time Daemons
+/pkgs/tools/networking/chrony @thoughtpolice
+/pkgs/tools/networking/ntp @thoughtpolice
+/pkgs/tools/networking/openntpd @thoughtpolice
+/nixos/modules/services/networking/ntp @thoughtpolice
+
+# Network
+/pkgs/tools/networking/octodns @Janik-Haag
+/pkgs/tools/networking/kea/default.nix @mweinelt
+/pkgs/tools/networking/babeld/default.nix @mweinelt
+/nixos/modules/services/networking/babeld.nix @mweinelt
+/nixos/modules/services/networking/kea.nix @mweinelt
+/nixos/modules/services/networking/knot.nix @mweinelt
+nixos/modules/services/networking/networkmanager.nix @Janik-Haag
+/nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
+/nixos/tests/babeld.nix @mweinelt
+/nixos/tests/kea.nix @mweinelt
+/nixos/tests/knot.nix @mweinelt
+/nixos/tests/networking/* @Janik-Haag
+
+# Web servers
+/doc/packages/nginx.section.md @raitobezarius
+/pkgs/servers/http/nginx/ @raitobezarius
+/nixos/modules/services/web-servers/nginx/ @raitobezarius
+
+# Dhall
+/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
+/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry
+
+# Idris
+/pkgs/development/idris-modules @Infinisil
+
+# Bazel
+/pkgs/development/tools/build-managers/bazel @Profpatsch
+
+# NixOS modules for e-mail and dns services
+/nixos/modules/services/mail/mailman.nix    @peti
+/nixos/modules/services/mail/postfix.nix    @peti
+/nixos/modules/services/networking/bind.nix @peti
+/nixos/modules/services/mail/rspamd.nix     @peti
+
+# Emacs
+/pkgs/applications/editors/emacs/elisp-packages @adisbladis
+/pkgs/applications/editors/emacs                @adisbladis
+/pkgs/top-level/emacs-packages.nix              @adisbladis
+
+# Neovim
+/pkgs/applications/editors/neovim      @figsoda @jonringer @teto
+
+# VimPlugins
+/pkgs/applications/editors/vim/plugins         @figsoda @jonringer
+
+# VsCode Extensions
+/pkgs/applications/editors/vscode/extensions   @jonringer
+
+# PHP interpreter, packages, extensions, tests and documentation
+/doc/languages-frameworks/php.section.md          @aanderse @drupol @globin @ma27 @talyz
+/nixos/tests/php                                  @aanderse @drupol @globin @ma27 @talyz
+/pkgs/build-support/php/build-pecl.nix            @aanderse @drupol @globin @ma27 @talyz
+/pkgs/build-support/php                                     @drupol
+/pkgs/development/interpreters/php       @jtojnar @aanderse @drupol @globin @ma27 @talyz
+/pkgs/development/php-packages                    @aanderse @drupol @globin @ma27 @talyz
+/pkgs/top-level/php-packages.nix         @jtojnar @aanderse @drupol @globin @ma27 @talyz
+
+# Docker tools
+/pkgs/build-support/docker                   @roberth
+/nixos/tests/docker-tools*                   @roberth
+/doc/build-helpers/images/dockertools.section.md  @roberth
+
+# Blockchains
+/pkgs/applications/blockchains  @mmahut @RaghavSood
+
+# Go
+/doc/languages-frameworks/go.section.md @kalbasit @Mic92 @zowoq
+/pkgs/build-support/go @kalbasit @Mic92 @zowoq
+/pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
+
+# GNOME
+/pkgs/desktops/gnome                              @jtojnar
+/pkgs/desktops/gnome/extensions                   @jtojnar
+/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
+
+# Cinnamon
+/pkgs/desktops/cinnamon @mkg20001
+
+# nim
+/pkgs/development/compilers/nim   @ehmry
+/pkgs/development/nim-packages    @ehmry
+/pkgs/top-level/nim-packages.nix  @ehmry
+
+# terraform providers
+/pkgs/applications/networking/cluster/terraform-providers @zowoq
+
+# Forgejo
+nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
+pkgs/by-name/fo/forgejo/package.nix     @adamcstephens @bendlas @emilylange
+
+# Dotnet
+/pkgs/build-support/dotnet                  @IvarWithoutBones
+/pkgs/development/compilers/dotnet          @IvarWithoutBones
+/pkgs/test/dotnet                           @IvarWithoutBones
+/doc/languages-frameworks/dotnet.section.md @IvarWithoutBones
+
+# Node.js
+/pkgs/build-support/node/build-npm-package      @lilyinstarlight @winterqt
+/pkgs/build-support/node/fetch-npm-deps         @lilyinstarlight @winterqt
+/doc/languages-frameworks/javascript.section.md @lilyinstarlight @winterqt
+
+# environment.noXlibs option aka NoX
+/nixos/modules/config/no-x-libs.nix  @SuperSandro2000
+
+# OCaml
+/pkgs/build-support/ocaml           @ulrikstrid
+/pkgs/development/compilers/ocaml   @ulrikstrid
+/pkgs/development/ocaml-modules     @ulrikstrid
+
+# ZFS
+pkgs/os-specific/linux/zfs/2_1.nix        @raitobezarius
+pkgs/os-specific/linux/zfs/generic.nix    @raitobezarius
+nixos/modules/tasks/filesystems/zfs.nix   @raitobezarius
+nixos/tests/zfs.nix                       @raitobezarius
+
+# Zig
+/pkgs/development/compilers/zig @figsoda
+/doc/hooks/zig.section.md       @figsoda
+
+# Buildbot
+nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
+nixos/tests/buildbot.nix                               @Mic92 @zowoq
+pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
+
+# Pretix
+pkgs/by-name/pr/pretix/ @mweinelt
+pkgs/by-name/pr/pretalx/ @mweinelt
+nixos/modules/services/web-apps/pretix.nix @mweinelt
+nixos/modules/services/web-apps/pretalx.nix @mweinelt
+nixos/tests/web-apps/pretix.nix @mweinelt
+nixos/tests/web-apps/pretalx.nix @mweinelt
+
+# incus/lxc/lxd
+nixos/maintainers/scripts/lxd/          @adamcstephens
+nixos/modules/virtualisation/incus.nix  @adamcstephens
+nixos/modules/virtualisation/lxc*       @adamcstephens
+nixos/modules/virtualisation/lxd*       @adamcstephens
+nixos/tests/incus/                      @adamcstephens
+nixos/tests/lxd/                        @adamcstephens
+pkgs/by-name/in/incus/                  @adamcstephens
+pkgs/by-name/lx/lxc*                    @adamcstephens
+pkgs/by-name/lx/lxd*                    @adamcstephens
+pkgs/os-specific/linux/lxc/             @adamcstephens
+
+# ExpidusOS, Flutter
+/pkgs/development/compilers/flutter @RossComputerGuy
+/pkgs/desktops/expidus              @RossComputerGuy
+
+# GNU Tar & Zip
+/pkgs/tools/archivers/gnutar        @RossComputerGuy
+/pkgs/tools/archivers/zip           @RossComputerGuy
+
+# SELinux
+/pkgs/os-specific/linux/checkpolicy @RossComputerGuy
+/pkgs/os-specific/linux/libselinux  @RossComputerGuy
+/pkgs/os-specific/linux/libsepol    @RossComputerGuy
+

.github/ISSUE_TEMPLATE.md

@@ -1,6 +1,11 @@
-<!--
-    Please note: This blank issue template is meant for extraordinary issues
-    that do not fit the templates. Unless you know your issue is relevant to
-    Nixpkgs and requires the free-form blank issue, please use the issue
-    templates instead.
--->
+## Issue description
+
+
+
+### Steps to reproduce
+
+
+
+## Technical details
+
+Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -1,143 +0,0 @@
-name: "Bug report (package)"
-description: "Create a generic bug report against a package."
-title: "PACKAGENAME: BUG TITLE"
-labels: ["0.kind: bug"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`PACKAGENAME: BUG TITLE`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it failing to launch on ARM Linux, your title would be as follows:
-        > `hello: fails to launch on aarch64-linux`
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        > [!IMPORTANT]
-        > If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "input"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+-label%3A%226.topic%3A+darwin%22+-label%3A%226.topic%3A+nixos%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -1,157 +0,0 @@
-name: "Bug report (macOS)"
-description: "Create a bug report against a package where the issue only occurs on macOS."
-title: "PACKAGENAME: BUG TITLE"
-labels: ["0.kind: bug", "6.topic: darwin"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`PACKAGENAME: BUG TITLE`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it failing to launch on Apple Silicon, your title would be as follows:
-        > `hello: fails to launch on aarch64-darwin`
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        > [!IMPORTANT]
-        > If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "input"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "dropdown"
-    id: "nix-darwin"
-    attributes:
-      label: "Are you using nix-darwin?"
-      description: |
-        [`nix-darwin`](https://github.com/LnL7/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
-      options:
-        - "Yes, I am using nix-darwin."
-        - "No, I am not using nix-darwin."
-      default: 1
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-
-        If this issue is related to the Darwin packaging architecture as a whole, or is related to the core Darwin frameworks, consider mentioning the `@NixOS/darwin-core` team.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs/NixOS, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+darwin%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -1,147 +0,0 @@
-name: "Bug report (NixOS module)"
-description: "Create a bug report against a NixOS Module."
-title: "nixos/MODULENAME: BUG TITLE"
-labels: ["0.kind: bug", "6.topic: nixos"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`nixos/MODULENAME: BUG TITLE`** template above with the correct module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`systemd-boot`](https://search.nixos.org/options?channel=unstable&show=boot.loader.systemd-boot.enable&from=0&size=1) module about it failing to install [`memtest86`](https://search.nixos.org/options?channel=unstable&show=boot.loader.systemd-boot.memtest86.enable&from=0&size=1), your title would be as follows:
-        > `nixos/systemd-boot: fails to install memtest86`
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        > [!IMPORTANT]
-        > If you are using an older version, please [update to the latest stable version](https://nixos.org/download) and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "input"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the `meta.maintainers` list of the offending module. This is done by prefixing the person's username with an '@' character. You can quickly go to the source code of a module by searching for it on the [NixOS Option Search](https://search.nixos.org/options) and clicking the "Declared in..." button.
-
-        Please note that the maintainer attribute name does not always match the maintainer's GitHub username. If that occurs, try looking in [`maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix) for the maintainer attribute name, and checking if the maintainer has a listed GitHub username.
-
-        If in doubt, check `git blame` for whoever last touched the module, or check the associated package's maintainers. Please add the mentions above the `---` characters.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+nixos%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -1,150 +0,0 @@
-name: "Build failure"
-description: "Report a package that is failing to build."
-title: "Build failure: PACKAGENAME"
-labels: ["0.kind: build failure"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Build failure: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
-
-        > [!TIP]
-        > For instance, if you were filing a build failure against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package, your title would be as follows:
-        > `Build failure: hello`
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        In what version of Nixpkgs did the build failure occur?
-
-        > [!IMPORTANT]
-        > If you are using an older version, please update to the latest stable version and check if the build failure persists before continuing this report.
-        > If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
-      options:
-        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this build failure. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "dropdown"
-    id: "hydra"
-    attributes:
-      label: "Can Hydra reproduce this build failure?"
-      description: |
-        Can [Hydra](https://hydra.nixos.org), Nixpkgs' Continuous Integration system, reproduce this build failure?
-        Please use the search function in the header bar to locate the last build job for the package in question.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
-          You can still open a build failure report, but please say '**No, Hydra cannot reproduce this build failure.**' below.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
-      options:
-        - "Please select the Hydra Status."
-        - "Yes, Hydra can reproduce this build failure."
-        - "No, Hydra cannot reproduce this build failure."
-        - "Hydra is currently rebuilding this package."
-        - "The last build job was manually cancelled."
-      default: 0
-    validations:
-      required: true
-  - type: "input"
-    id: "hydra-logs"
-    attributes:
-      label: "Link to Hydra build job"
-      description: "If you answered 'yes' in the question above, please copy-and-paste the link to the failing Hydra job here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        Please copy and paste the logs from the failed build.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: true
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+build+failure%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -1,125 +0,0 @@
-name: "Request: package update"
-description: "Create an update request for an existing, but outdated package."
-title: "Update Request: PACKAGENAME OLDVERSION → NEWVERSION"
-labels: ["0.kind: enhancement", "9.needs: package (update)"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Update Request: PACKAGENAME OLDVERSION → NEWVERSION`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)), the current version of the package, and the latest version of the package.
-
-        > [!TIP]
-        > For instance, if you were filing a request against the out of date `hello` package, where the current version in Nixpkgs is 1.0.0, but the latest version upstream is 1.0.1, your title would be as follows:
-        > `Update Request: hello 1.0.0 → 1.0.1`
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        > [!IMPORTANT]
-        > If you are using an older or stable version, please update to the latest **unstable** version and check if the package is still out of date.
-        > If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "input"
-    id: "name"
-    attributes:
-      label: "Package name"
-      description: "Please indicate the name of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "upstream-version"
-    attributes:
-      label: "Upstream version"
-      description: "Please indicate the latest version of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "nixpkgs-version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        Please indicate the current version number in Nixpkgs' **unstable** channel. You can check this by setting the [NixOS Package Search](https://search.nixos.org/packages?channel=unstable) channel to 'unstable' and searching for the package.
-        If you meant to request an upgrade in the stable channel, please file the '**Request: backport to stable**' form instead.
-    validations:
-      required: true
-  - type: "input"
-    id: "changelog"
-    attributes:
-      label: "Changelog"
-      description: "If applicable, please link the upstream changelog for the latest version."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the update here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this package update does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+package+%28update%29%22) or in [Nixpkgs Unstable](https://search.nixos.org/packages?channel=unstable)."
-          required: true
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%229.needs%3A+package+%28update%29%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -1,101 +0,0 @@
-name: "Request: NixOS module"
-description: "Create a new NixOS Module request for an existing package."
-title: "Module Request: nixos/MODULENAME"
-labels: ["0.kind: enhancement", "6.topic: nixos", "9.needs: module (new)"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Module Request: nixos/MODULENAME`** template above with the correct module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)).
-
-        > [!TIP]
-        > For instance, if you were filing a request against the missing `hello` module, your title would be as follows:
-        > `Module Request: nixos/hello`
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        > [!IMPORTANT]
-        > If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
-      options:
-        - "Please select a version."
-        - "- Unstable (25.05)"
-        - "- Stable (24.11)"
-        - "- Previous Stable (24.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the proposed module"
-      description: "Please include a clear and concise description of what the module should accomplish."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the proposed module here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this module does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+module+%28new%29%22) or in [NixOS Unstable](https://search.nixos.org/options?channel=unstable)."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%229.needs%3A+module+%28new%29%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve NixOS!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/07_backport_request.yml

@@ -1,103 +0,0 @@
-name: "Request: backport to stable"
-description: "Create a backport request for a package that is up-to-date in the unstable channel, but outdated in the stable channel."
-title: "Backport to Stable: PACKAGENAME OLDVERSION → NEWVERSION"
-labels: ["0.kind: enhancement", "9.needs: port to stable"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        > [!CAUTION]
-        > **Before you begin:** Be advised that backports are subject to the [release suitability guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).
-        > Stable releases of Nixpkgs do not receive breaking changes, which include major package updates that have incompatible API changes and break backwards compatibility. In the [Semantic Versioning standard](https://semver.org/), this is the first version number. (1.X.X)
-        > Generally, only minor package updates, such as security patches, bug fixes and feature additions (but not removals!) will be considered for backporting. Please read the rules above carefully before filing this backport request.
-
-        Welcome to Nixpkgs. Please replace the **`Backport to Stable: PACKAGENAME OLDVERSION → NEWVERSION`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)), the current version of the package in Nixpkgs Stable and the current version of the package in Nixpkgs Unstable.
-
-        > [!TIP]
-        > For instance, if you were filing a request against the out of date `hello` package, where the current version in Nixpkgs Unstable is 1.0.1, but the current version in Nixpkgs Stable is 1.0.0, your title would be as follows:
-        > `Backport to Stable: hello 1.0.0 → 1.0.1`
-
-        ---
-  - type: "input"
-    id: "name"
-    attributes:
-      label: "Package name"
-      description: "Please indicate the name of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "unstable-version"
-    attributes:
-      label: "Version in unstable"
-      description: "Please indicate the current version of the package in the unstable channel."
-    validations:
-      required: true
-  - type: "input"
-    id: "stable-version"
-    attributes:
-      label: "Version in stable"
-      description: "Please indicate the current version of the package in the stable channel."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "reasoning"
-    attributes:
-      label: "Reasoning for backport"
-      description: "Please briefly explain why this backport fits the [release suitability guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases) and why you think this update should be backported."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this backport does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+in%3Atitle+backport)."
-          required: true
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+port+to+stable%22+)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/08_documentation_request.yml

@@ -1,87 +0,0 @@
-name: "Request: documentation"
-description: "Report missing or incorrect documentation in the NixOS or Nixpkgs manuals."
-title: "Missing Documentation: PACKAGENAME"
-labels: ["0.kind: enhancement", "9.needs: documentation"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Missing Documentation: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) or module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)).
-
-        > [!TIP]
-        > For instance, if you were filing an issue against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it not having any NixOS-specific documentation, your title would be as follows:
-        > `Missing Documentation: hello`
-
-        ---
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the problem"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "proposal"
-    attributes:
-      label: "Proposed solution"
-      description: |
-        If possible, please draft a tentative documentation chapter to resolve this issue.
-        Your proposal should be written in CommonMark Markdown, optionally enhanced with [Nix-specific extensions](https://github.com/NixOS/nixpkgs/tree/master/doc#syntax).
-      render: "markdown"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this request is not already implemented in the latest [NixOS](https://nixos.org/manual/nixos/unstable/) or [Nixpkgs](https://nixos.org/manual/nixpkgs/unstable/) manuals."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing documentation issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+documentation%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "priorisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/09_unreproducible_package.yml

@@ -1,158 +0,0 @@
-name: "Unreproducible Package"
-description: "Report a package that does not produce a bit-by-bit reproducible result each time it is built."
-title: "Unreproducible Package: PACKAGENAME"
-labels: ["0.kind: enhancement", "6.topic: reproducible builds"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Unreproducible Package: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
-
-        > [!NOTE]
-        > This form is for reporting unreproducible packages. For more information, see the [Reproducible Builds Status](https://reproducible.nixos.org/) page.
-        > To report a package that fails to build entirely, please use the "Build Failure" form instead.
-
-        ---
-  - type: "input"
-    id: "version"
-    attributes:
-      label: "Nixpkgs Revision"
-      description: "In which commit of Nixpkgs is this package displaying unreproducibility?"
-  - type: "textarea"
-    id: "introduction"
-    attributes:
-      label: "Introduction"
-      description: |
-        This is a generic introduction to build reproducibility.
-        Please replace **PACKAGENAME** below with the canonical package name of the package, as you have done for the title above.
-      value: |
-        Building **PACKAGENAME** multiple times does not yield bit-by-bit identical
-        results, complicating the detection of Continuous Integration (CI) breaches. For
-        more information on this issue, visit [reproducible-builds.org](https://reproducible-builds.org/).
-
-        Fixing bit-by-bit reproducibility also has additional advantages, such as
-        avoiding hard-to-reproduce bugs, making content-addressed storage more effective
-        and reducing rebuilds in such systems.
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: |
-        This is a step-by-step instruction set meant for maintainers to debug the package that is failing to reproduce. You should also follow it to gather the `diffoscope` logs that will be needed below.
-        Please replace **PACKAGENAME** below with the canonical package name of the package, as you have done for the introduction and the title above.
-      value: |
-        ### 1. Build the package
-
-        This step will build the package. Specific arguments are passed to the command
-        to keep the build artifacts so we can compare them in case of differences.
-
-        Execute the following command:
-
-        ```
-        nix-build '<nixpkgs>' -A PACKAGENAME && nix-build '<nixpkgs>' -A PACKAGENAME --check --keep-failed
-        ```
-
-        Or using the new command line style:
-
-        ```
-        nix build nixpkgs#PACKAGENAME && nix build nixpkgs#PACKAGENAME --rebuild --keep-failed
-        ```
-
-        ### 2. Compare the build artifacts
-
-        If the previous command completes successfully, no differences were found and
-        there's nothing to do, builds are reproducible.
-        If it terminates with the error message `error: derivation '<X>' may not be
-        deterministic: output '<Y>' differs from '<Z>'`, use `diffoscope` to investigate
-        the discrepancies between the two build outputs. You may need to add the
-        `--exclude-directory-metadata recursive` option to ignore files and directories
-        metadata (*e.g. timestamp*) differences.
-
-        ```
-        nix run nixpkgs#diffoscopeMinimal -- --exclude-directory-metadata recursive <Y> <Z>
-        ```
-
-        ### 3. Examine the build log
-
-        To examine the build log, use:
-
-        ```
-        nix-store --read-log $(nix-instantiate '<nixpkgs>' -A PACKAGENAME)
-        ```
-
-        Or with the new command line style:
-
-        ```
-        nix log $(nix path-info --derivation nixpkgs#PACKAGENAME)
-        ```
-    validations:
-      required: true
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Diffoscope log"
-      description: |
-        Please copy and paste the relevant `diffoscope` log output, gathered from the steps above.
-        This will be automatically formatted into a monospaced text block, so no need for backticks.
-      render: "console"
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%226.topic%3A+reproducible+builds%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,48 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: '0.kind: bug'
+assignees: ''
+
+---
+
+### Describe the bug
+A clear and concise description of what the bug is.
+
+### Steps To Reproduce
+Steps to reproduce the behavior:
+1. ...
+2. ...
+3. ...
+
+### Expected behavior
+A clear and concise description of what you expected to happen.
+
+### Screenshots
+If applicable, add screenshots to help explain your problem.
+
+### Additional context
+Add any other context about the problem here.
+
+### Notify maintainers
+
+<!--
+Please @ people who are in the `meta.maintainers` list of the offending package or module.
+If in doubt, check `git blame` for whoever last touched something.
+-->
+
+### Metadata
+Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.
+
+```console
+[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
+output here
+```
+
+---
+
+Add a :+1: [reaction] to [issues you find important].
+
+[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+[issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/build_failure.md

@@ -0,0 +1,46 @@
+---
+name: Build failure
+about: Create a report to help us improve
+title: 'Build failure: PACKAGENAME'
+labels: '0.kind: build failure'
+assignees: ''
+
+---
+
+### Steps To Reproduce
+
+Steps to reproduce the behavior:
+1. build *X*
+
+### Build log
+
+```
+log here if short otherwise a link to a gist
+```
+
+### Additional context
+
+Add any other context about the problem here.
+
+### Notify maintainers
+
+<!--
+Please @ people who are in the `meta.maintainers` list of the offending package or module.
+If in doubt, check `git blame` for whoever last touched something.
+-->
+
+### Metadata
+
+Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.
+
+```console
+[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
+output here
+```
+
+---
+
+Add a :+1: [reaction] to [issues you find important].
+
+[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+[issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/missing_documentation.md

@@ -0,0 +1,38 @@
+---
+name: Missing or incorrect documentation
+about: Help us improve the Nixpkgs and NixOS reference manuals
+title: 'Documentation: '
+labels: '9.needs: documentation'
+assignees: ''
+
+---
+
+## Problem
+
+<!-- describe your problem -->
+
+## Proposal
+
+<!-- propose a solution (optional) -->
+
+## Checklist
+
+<!-- make sure this issue is not redundant or obsolete -->
+
+- [ ] checked [latest Nixpkgs manual] \([source][nixpkgs-source]) and [latest NixOS manual] \([source][nixos-source])
+- [ ] checked [open documentation issues] for possible duplicates
+- [ ] checked [open documentation pull requests] for possible solutions
+
+[latest Nixpkgs manual]: https://nixos.org/manual/nixpkgs/unstable/
+[latest NixOS manual]: https://nixos.org/manual/nixos/unstable/
+[nixpkgs-source]: https://github.com/NixOS/nixpkgs/tree/master/doc
+[nixos-source]: https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual
+[open documentation issues]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+documentation%22
+[open documentation pull requests]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+documentation%22%2C%226.topic%3A+documentation%22
+
+---
+
+Add a :+1: [reaction] to [issues you find important].
+
+[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+[issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/out_of_date_package_report.md

@@ -0,0 +1,35 @@
+---
+name: Out-of-date package reports
+about: For packages that are out-of-date
+title: 'Update request: PACKAGENAME OLDVERSION → NEWVERSION'
+labels: '9.needs: package (update)'
+assignees: ''
+
+---
+
+- Package name:
+- Latest released version:
+<!-- Search your package here: https://search.nixos.org/packages?channel=unstable -->
+- Current version on the unstable channel:
+- Current version on the stable/release channel:
+<!--
+Type the name of your package and try to find an open pull request for the package
+If you find an open pull request, you can review it!
+There's a high chance that you'll have the new version right away while helping the community!
+-->
+- [ ] Checked the [nixpkgs pull requests](https://github.com/NixOS/nixpkgs/pulls)
+
+**Notify maintainers**
+
+<!-- If the search.nixos.org result shows no maintainers, tag the person that last updated the package. -->
+
+-----
+
+Note for maintainers: Please tag this issue in your PR.
+
+---
+
+Add a :+1: [reaction] to [issues you find important].
+
+[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+[issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/packaging_request.md

@@ -0,0 +1,26 @@
+---
+name: Packaging requests
+about: For packages that are missing
+title: 'Package request: PACKAGENAME'
+labels: '0.kind: packaging request'
+assignees: ''
+
+---
+
+**Project description**
+
+<!-- Describe the project a little: -->
+
+**Metadata**
+
+* homepage URL:
+* source URL:
+* license: mit, bsd, gpl2+ , ...
+* platforms: unix, linux, darwin, ...
+
+---
+
+Add a :+1: [reaction] to [issues you find important].
+
+[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+[issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/unreproducible_package.md

@@ -0,0 +1,94 @@
+---
+name: Unreproducible package
+about: A package that does not produce a bit-by-bit reproducible result each time it is built
+title: ''
+labels: [ '0.kind: enhancement', '6.topic: reproducible builds' ]
+assignees: ''
+
+---
+
+<!--
+Hello dear reporter,
+
+Thank you for bringing attention to this issue. Your insights are valuable to
+us, and we appreciate the time you took to document the problem.
+
+I wanted to kindly point out that in this issue template, it would be beneficial
+to replace the placeholder `<package>` with the actual, canonical name of the
+package you're reporting the issue for. Doing so will provide better context and
+facilitate quicker troubleshooting for anyone who reads this issue in the
+future.
+
+Best regards
+-->
+
+Building this package multiple times does not yield bit-by-bit identical
+results, complicating the detection of Continuous Integration (CI) breaches. For
+more information on this issue, visit
+[reproducible-builds.org](https://reproducible-builds.org/).
+
+Fixing bit-by-bit reproducibility also has additional advantages, such as
+avoiding hard-to-reproduce bugs, making content-addressed storage more effective
+and reducing rebuilds in such systems.
+
+### Steps To Reproduce
+
+In the following steps, replace `<package>` with the canonical name of the
+package.
+
+#### 1. Build the package
+
+This step will build the package. Specific arguments are passed to the command
+to keep the build artifacts so we can compare them in case of differences.
+
+Execute the following command:
+
+```
+nix-build '<nixpkgs>' -A <package> && nix-build '<nixpkgs>' -A <package> --check --keep-failed
+```
+
+Or using the new command line style:
+
+```
+nix build nixpkgs#<package> && nix build nixpkgs#<package> --rebuild --keep-failed
+```
+
+#### 2. Compare the build artifacts
+
+If the previous command completes successfully, no differences were found and
+there's nothing to do, builds are reproducible.
+If it terminates with the error message `error: derivation '<X>' may not be
+deterministic: output '<Y>' differs from '<Z>'`, use `diffoscope` to investigate
+the discrepancies between the two build outputs. You may need to add the
+`--exclude-directory-metadata recursive` option to ignore files and directories
+metadata (*e.g. timestamp*) differences.
+
+```
+nix run nixpkgs#diffoscopeMinimal -- --exclude-directory-metadata recursive <Y> <Z>
+```
+
+#### 3. Examine the build log
+
+To examine the build log, use:
+
+```
+nix-store --read-log $(nix-instantiate '<nixpkgs>' -A <package>)
+```
+
+Or with the new command line style:
+
+```
+nix log $(nix path-info --derivation nixpkgs#<package>)
+```
+
+### Additional context
+
+(please share the relevant fragment of the diffoscope output here, and any
+additional analysis you may have done)
+
+---
+
+Add a :+1: [reaction] to [issues you find important].
+
+[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+[issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,7 +1,6 @@
+## Description of changes
 
 <!--
-^ Please summarise the changes you have done and explain why they are necessary here ^
-
 For package updates please link to a changelog or describe changes, this helps your fellow maintainers discover breaking updates.
 For new packages please briefly describe the package or provide a link to its homepage.
 -->
@@ -22,10 +21,10 @@ For new packages please briefly describe the package or provide a link to its ho
   - [NixOS test(s)](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
   - and/or [package tests](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests)
   - or, for functions and "core" functionality, tests in [lib/tests](https://github.com/NixOS/nixpkgs/blob/master/lib/tests) or [pkgs/test](https://github.com/NixOS/nixpkgs/blob/master/pkgs/test)
-  - made sure NixOS tests are [linked](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#linking-nixos-module-tests-to-a-package) to the relevant packages
+  - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
-- [25.05 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2505.section.md) (or backporting [24.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2411.section.md) and [25.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2505.section.md) Release notes)
+- [24.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2411.section.md) (or backporting [23.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) and [24.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2405.section.md) Release notes)
   - [ ] (Package updates) Added a release notes entry if the change is major or breaking
   - [ ] (Module updates) Added a release notes entry if the change is significant
   - [ ] (Module addition) Added a release notes entry if adding a new NixOS module

.github/labeler-no-sync.yml

@@ -1,28 +0,0 @@
-# This file is used by .github/workflows/labels.yml
-# This version uses `sync-labels: false`, meaning that a non-match will NOT remove the label
-
-"backport release-24.11":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - .github/workflows/*
-        - ci/**/*.*
-
-"6.topic: policy discussion":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - .github/**/*
-        - CONTRIBUTING.md
-        - pkgs/README.md
-        - nixos/README.md
-        - maintainers/README.md
-        - lib/README.md
-        - doc/README.md
-
-"8.has: documentation":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - doc/**/*
-        - nixos/doc/**/*

.github/labeler.yml

@@ -1,7 +1,3 @@
-# This file is used by .github/workflows/labels.yml
-# This version uses `sync-labels: true`, meaning that a non-match will remove the label
-
-# NOTE: bsd, darwin and cross-compilation labels are handled by ofborg
 "6.topic: agda":
   - any:
     - changed-files:
@@ -16,55 +12,9 @@
   - any:
     - changed-files:
       - any-glob-to-any-file:
+        - pkgs/desktops/cinnamon/**/*
         - nixos/modules/services/x11/desktop-managers/cinnamon.nix
         - nixos/tests/cinnamon.nix
-        - nixos/tests/cinnamon-wayland.nix
-        - pkgs/by-name/ci/cinnamon-*/**/*
-        - pkgs/by-name/cj/cjs/**/*
-        - pkgs/by-name/mu/muffin/**/*
-        - pkgs/by-name/ne/nemo/**/*
-        - pkgs/by-name/ne/nemo-*/**/*
-
-"6.topic: continuous integration":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - .github/**/*
-        - ci/**/*
-
-"6.topic: coq":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/applications/science/logic/coq/**/*
-        - pkgs/development/coq-modules/**/*
-        - pkgs/top-level/coq-packages.nix
-
-"6.topic: crystal":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/development/compilers/crystal/**/*
-
-"6.topic: cuda":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/development/cuda-modules/**/*
-        - pkgs/top-level/cuda-packages.nix
-
-"6.topic: deepin":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - nixos/modules/services/desktops/deepin/**/*
-        - pkgs/desktops/deepin/**/*
-
-"6.topic: docker tools":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/applications/virtualization/docker/**/*
 
 "6.topic: dotnet":
   - any:
@@ -84,9 +34,9 @@
         - nixos/modules/services/editors/emacs.nix
         - nixos/modules/services/editors/emacs.xml
         - nixos/tests/emacs-daemon.nix
-        - pkgs/applications/editors/emacs/build-support/**/*
         - pkgs/applications/editors/emacs/elisp-packages/**/*
         - pkgs/applications/editors/emacs/**/*
+        - pkgs/build-support/emacs/**/*
         - pkgs/top-level/emacs-packages.nix
 
 "6.topic: Enlightenment DE":
@@ -124,19 +74,6 @@
         - lib/systems/flake-systems.nix
         - nixos/modules/config/nix-flakes.nix
 
-"6.topic: flutter":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/build-support/flutter/*.nix
-        - pkgs/development/compilers/flutter/**/*.nix
-
-"6.topic: games":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/games/**/*
-
 "6.topic: GNOME":
   - any:
     - changed-files:
@@ -156,12 +93,6 @@
         - pkgs/build-support/go/**/*
         - pkgs/development/compilers/go/**/*
 
-"6.topic: hardware":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - nixos/modules/hardware/**/*
-
 "6.topic: haskell":
   - any:
     - changed-files:
@@ -175,48 +106,6 @@
         - pkgs/top-level/haskell-packages.nix
         - pkgs/top-level/release-haskell.nix
 
-"6.topic: java":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        # Distributions
-        - pkgs/development/compilers/adoptopenjdk-icedtea-web/**/*
-        - pkgs/development/compilers/corretto/**/*
-        - pkgs/development/compilers/graalvm/**/*
-        - pkgs/development/compilers/openjdk/**/*
-        - pkgs/by-name/op/openjfx/**/*
-        - pkgs/development/compilers/semeru-bin/**/*
-        - pkgs/development/compilers/temurin-bin/**/*
-        - pkgs/development/compilers/zulu/**/*
-        # Documentation
-        - doc/languages-frameworks/java.section.md
-        # Gradle
-        - doc/languages-frameworks/gradle.section.md
-        - pkgs/development/tools/build-managers/gradle/**/*
-        - pkgs/by-name/gr/gradle-completion/**/*
-        # Maven
-        - pkgs/by-name/ma/maven/**/*
-        - doc/languages-frameworks/maven.section.md
-        # Ant
-        - pkgs/by-name/an/ant/**/*
-        # javaPackages attrset
-        - pkgs/development/java-modules/**/*
-        - pkgs/top-level/java-packages.nix
-        # Maintainer tooling
-        - pkgs/by-name/ni/nixpkgs-openjdk-updater/**/*
-        # Misc
-        - nixos/modules/programs/java.nix
-
-"6.topic: jitsi":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - nixos/modules/services/networking/jitsi-videobridge.nix
-        - nixos/modules/services/web-apps/jitsi-meet.nix
-        - pkgs/servers/web-apps/jitsi-meet/**/*
-        - pkgs/servers/jitsi-videobridge/**/*
-        - pkgs/applications/networking/instant-messengers/jitsi/**/*
-
 "6.topic: julia":
   - any:
     - changed-files:
@@ -260,7 +149,7 @@
   - any:
     - changed-files:
       - any-glob-to-any-file:
-        - pkgs/development/compilers/llvm/**/*
+        - pkgs/development/compilers/llvm/*
 
 "6.topic: lua":
   - any:
@@ -304,37 +193,21 @@
         - lib/tests/modules.sh
         - lib/tests/modules/**
 
-"6.topic: musl":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/os-specific/linux/musl/**/*
-
 "6.topic: nixos":
   - any:
     - changed-files:
       - any-glob-to-any-file:
         - nixos/**/*
-        - pkgs/by-name/sw/switch-to-configuration-ng/**/*
-        - pkgs/by-name/ni/nixos-rebuild-ng/**/*
         - pkgs/os-specific/linux/nixos-rebuild/**/*
 
-"6.topic: nixos-container":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - nixos/modules/virtualisation/nixos-containers.nix
-        - pkgs/tools/virtualization/nixos-container/**/*
-
 "6.topic: nim":
   - any:
     - changed-files:
       - any-glob-to-any-file:
         - doc/languages-frameworks/nim.section.md
-        - pkgs/build-support/build-nim-package.nix
-        - pkgs/build-support/build-nim-sbom.nix
-        - pkgs/by-name/ni/nim*
-        - pkgs/top-level/nim-overrides.nix
+        - pkgs/development/compilers/nim/*
+        - pkgs/development/nim-packages/**/*
+        - pkgs/top-level/nim-packages.nix
 
 "6.topic: nodejs":
   - any:
@@ -348,15 +221,6 @@
         - pkgs/development/tools/pnpm/**/*
         - pkgs/development/web/nodejs/*
 
-"6.topic: nvidia":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - nixos/modules/hardware/video/nvidia.nix
-        - nixos/modules/services/hardware/nvidia-container-toolkit/**/*
-        - nixos/modules/services/hardware/nvidia-optimus.nix
-        - pkgs/os-specific/linux/nvidia-x11/**/*
-
 "6.topic: ocaml":
   - any:
     - changed-files:
@@ -383,13 +247,18 @@
     - changed-files:
       - any-glob-to-any-file:
         - doc/languages-frameworks/php.section.md
-        - nixos/tests/php/**/*
         - pkgs/build-support/php/**/*
-        - pkgs/development/interpreters/php/**/*
+        - pkgs/development/interpreters/php/*
         - pkgs/development/php-packages/**/*
         - pkgs/test/php/default.nix
         - pkgs/top-level/php-packages.nix
 
+"6.topic: policy discussion":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - .github/**/*
+
 "6.topic: printing":
   - any:
     - changed-files:
@@ -418,19 +287,6 @@
         - pkgs/development/libraries/kde-frameworks/**/*
         - pkgs/development/libraries/qt-5/**/*
 
-"6.topic: R":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/applications/science/math/R/**/*
-        - pkgs/development/r-modules/**/*
-
-"6.topic: rocm":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/development/rocm-modules/**/*
-
 "6.topic: ruby":
   - any:
     - changed-files:
@@ -438,7 +294,6 @@
         - doc/languages-frameworks/ruby.section.md
         - pkgs/development/interpreters/ruby/**/*
         - pkgs/development/ruby-modules/**/*
-        - pkgs/top-level/ruby-packages.nix
 
 "6.topic: rust":
   - any:
@@ -467,21 +322,6 @@
         - pkgs/os-specific/linux/systemd/**/*
         - nixos/modules/system/boot/systemd*/**/*
 
-"6.topic: tcl":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - doc/languages-frameworks/tcl.section.md
-        - pkgs/development/interpreters/tcl/*
-        - pkgs/development/tcl-modules/**/*
-        - pkgs/top-level/tcl-packages.nix
-
-"6.topic: teams":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-          - maintainers/team-list.nix
-
 "6.topic: TeX":
   - any:
     - changed-files:
@@ -498,7 +338,6 @@
         #       *developed in this repo*;
         #       - not individual tests
         #       - not packages for test frameworks
-        - pkgs/build-support/testers/**
         - nixos/lib/testing/**
         - nixos/lib/test-driver/**
         - nixos/tests/nixos-test-driver/**
@@ -506,12 +345,6 @@
         - nixos/tests/make-test-python.nix  # legacy
         # lib/debug.nix has a test framework (runTests) but it's not the main focus
 
-"6.topic: updaters":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/common-updater/**/*
-
 "6.topic: vim":
   - any:
     - changed-files:
@@ -528,25 +361,6 @@
       - any-glob-to-any-file:
         - pkgs/applications/editors/vscode/**/*
 
-"6.topic: windows":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - pkgs/os-specific/windows/**/*
-
-"6.topic: xen-project":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - nixos/modules/virtualisation/xen*
-        - pkgs/by-name/xe/xen/*
-        - pkgs/by-name/qe/qemu_xen/*
-        - pkgs/by-name/xe/xen-guest-agent/*
-        - pkgs/by-name/xt/xtf/*
-        - pkgs/build-support/xen/*
-        - pkgs/development/ocaml-modules/xen*/*
-        - pkgs/development/ocaml-modules/vchan/*
-
 "6.topic: xfce":
   - any:
     - changed-files:
@@ -569,6 +383,13 @@
       - any-glob-to-any-file:
         - nixos/doc/manual/release-notes/**/*
 
+"8.has: documentation":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/**/*
+        - nixos/doc/**/*
+
 "8.has: module (update)":
   - any:
     - changed-files:

.github/workflows/README.md

@@ -1,20 +0,0 @@
-# GitHub Actions Workflows
-
-Some architectural notes about key decisions and concepts in our workflows:
-
-- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows. This has the advantage that those workflows will run without prior approval for external contributors.
-
-- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches. **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible. Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.
-
-- By definition `pull_request_target` runs in the context of the **base** of the pull request. This means, that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default. To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.
-
-- To test the pull request's contents, we checkout the "test merge commit". This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?". The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore). This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout. Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.
-
-- Various workflows need to make comparisons against the base branch. In this case, we checkout the parent of the "test merge commit" for best results. Note, that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.
-
-## Terminology
-
-- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions. Same as `github.event.pull_request.base.sha`.
-- **head commit**: The HEAD commit in the pull request's branch. Same as `github.event.pull_request.head.sha`.
-- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request. Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.
-- **target commit**: The base branch's parent of the "test merge commit" to compare against.

.github/workflows/backport.yml

@@ -1,41 +1,33 @@
+name: Backport
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
 # WARNING:
 # When extending this action, be aware that $GITHUB_TOKEN allows write access to
 # the GitHub repository. This means that it should not evaluate user input in a
 # way that allows code injection.
 
-name: Backport
-
-on:
-  pull_request_target:
-    types: [closed, labeled]
-
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   backport:
+    permissions:
+      contents: write # for korthout/backport-action to create branch
+      pull-requests: write # for korthout/backport-action to create PR to backport
     name: Backport Pull Request
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
-        id: app-token
-        with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-          token: ${{ steps.app-token.outputs.token }}
-
       - name: Create backport PRs
-        uses: korthout/backport-action@436145e922f9561fc5ea157ff406f21af2d6b363 # v3.2.0
+        uses: korthout/backport-action@ef20d86abccbac3ee3a73cb2efbdc06344c390e5 # v2.5.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           copy_labels_pattern: 'severity:\ssecurity'
-          github_token: ${{ steps.app-token.outputs.token }}
           pull_description: |-
             Bot-based backport to `${target_branch}`, triggered by a label in #${pull_number}.
 

.github/workflows/basic-eval.yml

@@ -0,0 +1,29 @@
+name: Basic evaluation checks
+
+on:
+  workflow_dispatch
+  # pull_request:
+  #   branches:
+  #    - master
+  #    - release-**
+  # push:
+  #   branches:
+  #    - master
+  #    - release-**
+permissions:
+  contents: read
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
+    steps:
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      with:
+        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+        name: nixpkgs-ci
+        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+    # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset
+    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'

.github/workflows/check-by-name.yml

@@ -0,0 +1,123 @@
+# Checks pkgs/by-name (see pkgs/by-name/README.md)
+# using the nixpkgs-check-by-name tool (see https://github.com/NixOS/nixpkgs-check-by-name)
+#
+# When you make changes to this workflow, also update pkgs/test/check-by-name/run-local.sh adequately
+name: Check pkgs/by-name
+
+on:
+  # Using pull_request_target instead of pull_request avoids having to approve first time contributors
+  pull_request_target:
+    # This workflow depends on the base branch of the PR,
+    # but changing the base branch is not included in the default trigger events,
+    # which would be `opened`, `synchronize` or `reopened`.
+    # Instead it causes an `edited` event, so we need to add it explicitly here
+    # While `edited` is also triggered when the PR title/body is changed,
+    # this PR action is fairly quick, and PR's don't get edited that often,
+    # so it shouldn't be a problem
+    # There is a feature request for adding a `base_changed` event:
+    # https://github.com/orgs/community/discussions/35058
+    types: [opened, synchronize, reopened, edited]
+
+permissions: {}
+
+# We don't use a concurrency group here, because the action is triggered quite often (due to the PR edit
+# trigger), and contributers would get notified on any canceled run.
+# There is a feature request for supressing notifications on concurrency-canceled runs:
+# https://github.com/orgs/community/discussions/13015
+
+jobs:
+  check:
+    # This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases
+    runs-on: ubuntu-latest
+    # This should take 1 minute at most, but let's be generous.
+    # The default of 6 hours is definitely too long
+    timeout-minutes: 10
+    steps:
+      # This step has to be in this file,
+      # because it's needed to determine which revision of the repository to fetch,
+      # and we can only use other files from the repository once it's fetched.
+      - name: Resolving the merge commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # This checks for mergeability of a pull request as recommended in
+          # https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests
+
+          # Retry the API query this many times
+          retryCount=5
+          # Start with 5 seconds, but double every retry
+          retryInterval=5
+          while true; do
+            echo "Checking whether the pull request can be merged"
+            prInfo=$(gh api \
+              -H "Accept: application/vnd.github+json" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              /repos/"$GITHUB_REPOSITORY"/pulls/${{ github.event.pull_request.number }})
+            mergeable=$(jq -r .mergeable <<< "$prInfo")
+            mergedSha=$(jq -r .merge_commit_sha <<< "$prInfo")
+
+            if [[ "$mergeable" == "null" ]]; then
+              if (( retryCount == 0 )); then
+                echo "Not retrying anymore, probably GitHub is having internal issues"
+                exit 1
+              else
+                (( retryCount -= 1 )) || true
+
+                # null indicates that GitHub is still computing whether it's mergeable
+                # Wait a couple seconds before trying again
+                echo "GitHub is still computing whether this PR can be merged, waiting $retryInterval seconds before trying again ($retryCount retries left)"
+                sleep "$retryInterval"
+
+                (( retryInterval *= 2 )) || true
+              fi
+            else
+              break
+            fi
+          done
+
+          if [[ "$mergeable" == "true" ]]; then
+            echo "The PR can be merged, checking the merge commit $mergedSha"
+            echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
+          else
+            echo "The PR cannot be merged, it has a merge conflict, skipping the rest.."
+          fi
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        if: env.mergedSha
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: ${{ env.mergedSha }}
+          # Fetches the merge commit and its parents
+          fetch-depth: 2
+      - name: Checking out base branch
+        if: env.mergedSha
+        run: |
+          base=$(mktemp -d)
+          git worktree add "$base" "$(git rev-parse HEAD^1)"
+          echo "base=$base" >> "$GITHUB_ENV"
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+        if: env.mergedSha
+      - name: Fetching the pinned tool
+        if: env.mergedSha
+        # Update the pinned version using pkgs/test/check-by-name/update-pinned-tool.sh
+        run: |
+          # The pinned version of the tooling to use
+          toolVersion=$(<pkgs/test/check-by-name/pinned-version.txt)
+          # Fetch the x86_64-linux-specific release artifact containing the Gzipped NAR of the pre-built tool
+          toolPath=$(curl -sSfL https://github.com/NixOS/nixpkgs-check-by-name/releases/download/"$toolVersion"/x86_64-linux.nar.gz \
+            | gzip -cd | nix-store --import | tail -1)
+          # Adds a result symlink as a GC root
+          nix-store --realise "$toolPath" --add-root result
+      - name: Running nixpkgs-check-by-name
+        if: env.mergedSha
+        env:
+          # Force terminal colors to be enabled. The library that
+          # nixpkgs-check-by-name uses respects: https://bixense.com/clicolors/
+          CLICOLOR_FORCE: 1
+        run: |
+          if result/bin/nixpkgs-check-by-name --base "$base" .; then
+            exit 0
+          else
+            exitCode=$?
+            echo "To run locally: ./maintainers/scripts/check-by-name.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
+            exit "$exitCode"
+          fi

.github/workflows/check-cherry-picks.yml

@@ -1,28 +1,25 @@
 name: "Check cherry-picks"
-
 on:
   pull_request_target:
     branches:
-      - 'release-**'
-      - 'staging-**'
-      - '!staging-next'
+     - 'release-**'
+     - 'staging-**'
+     - '!staging-next'
 
 permissions: {}
 
 jobs:
   check:
-    name: cherry-pick-check
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-          filter: blob:none
-
-      - name: Check cherry-picks
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: |
-          ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      with:
+        fetch-depth: 0
+        filter: blob:none
+    - name: Check cherry-picks
+      env:
+        BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      run: |
+        ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

.github/workflows/check-maintainers-sorted.yaml

@@ -0,0 +1,28 @@
+name: "Check that maintainer list is sorted"
+
+on:
+  pull_request_target:
+    paths:
+      - 'maintainers/maintainer-list.nix'
+permissions:
+  contents: read
+
+jobs:
+  nixos:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          # Only these directories to perform the check
+          sparse-checkout: |
+            lib
+            maintainers
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - name: Check that maintainer-list.nix is sorted
+        run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix

.github/workflows/check-maintainers-sorted.yml

@@ -1,28 +0,0 @@
-name: "Check that maintainer list is sorted"
-
-on:
-  pull_request_target:
-    paths:
-      - 'maintainers/maintainer-list.nix'
-
-permissions: {}
-
-jobs:
-  nixos:
-    name: maintainer-list-check
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-          # Only these directories to perform the check
-          sparse-checkout: |
-            lib
-            maintainers
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Check that maintainer-list.nix is sorted
-        run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix

.github/workflows/check-nix-format.yml

@@ -1,44 +1,65 @@
-# NOTE: Formatting with the RFC-style nixfmt command is not yet stable.
-# See https://github.com/NixOS/rfcs/pull/166.
-
+# This file was copied mostly from check-maintainers-sorted.yaml.
+# NOTE: Formatting with the RFC-style nixfmt command is not yet stable. See
+# https://github.com/NixOS/rfcs/pull/166.
+# Because of this, this action is not yet enabled for all files -- only for
+# those who have opted in.
 name: Check that Nix files are formatted
 
 on:
   pull_request_target:
-    types: [opened, synchronize, reopened, edited]
-
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
   nixos:
-    name: nixfmt-check
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
         with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
+          # explicitly enable sandbox
           extra_nix_config: sandbox = true
-
-      - name: Check that Nix files are formatted
+          # fix a commit from nixpkgs-unstable to avoid e.g. building nixfmt
+          # from staging
+          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/4b455dc2048f73a79eb3713f342369ff58f93e0b.tar.gz
+      - name: Install nixfmt
+        run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
+      - name: Check that Nix files are formatted according to the RFC style
+        # Each environment variable beginning with NIX_FMT_PATHS_ is a list of
+        # paths to check with nixfmt.
+        env:
+          NIX_FMT_PATHS_BSD: pkgs/os-specific/bsd
+          NIX_FMT_PATHS_MPVSCRIPTS: pkgs/applications/video/mpv/scripts
+          # Format paths related to the Nixpkgs CUDA ecosystem.
+          NIX_FMT_PATHS_CUDA: |
+            pkgs/development/cuda-modules
+            pkgs/test/cuda
+            pkgs/top-level/cuda-packages.nix
+          NIX_FMT_PATHS_MAINTAINERS: |
+            maintainers/maintainer-list.nix
+            maintainers/team-list.nix
+          NIX_FMT_PATHS_K3S: |
+            nixos/modules/services/cluster/k3s
+            nixos/tests/k3s
+            pkgs/applications/networking/cluster/k3s
+          NIX_FMT_PATHS_VSCODE_EXTS: pkgs/applications/editors/vscode/extensions
+          NIX_FMT_PATHS_PHP_PACKAGES: pkgs/development/php-packages
+          NIX_FMT_PATHS_BUILD_SUPPORT_PHP: pkgs/build-support/php
+        # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
         run: |
-          # Note that it's fine to run this on untrusted code because:
-          # - There's no secrets accessible here
-          # - The build is sandboxed
-          if ! nix-build ci -A fmt.check; then
-            echo "Some Nix files are not properly formatted"
-            echo "Please format them by going to the Nixpkgs root directory and running one of:"
-            echo "  nix-shell --run treefmt"
-            echo "  nix develop --command treefmt"
-            echo "  nix fmt"
-            echo "Make sure your branch is up to date with master; rebase if not."
-            echo "If you're having trouble, please ping @NixOS/nix-formatting"
-            exit 1
-          fi
+          for env_var in "${!NIX_FMT_PATHS_@}"; do
+            readarray -t paths <<< "${!env_var}"
+            if [[ "${paths[*]}" == "" ]]; then
+              echo "Error: $env_var is empty."
+              exit 1
+            fi
+            echo "Checking paths: ${paths[@]}"
+            if ! nixfmt --check "${paths[@]}"; then
+              echo "Error: nixfmt failed."
+              exit 1
+            fi
+          done

.github/workflows/check-nixf-tidy.yml

@@ -1,132 +0,0 @@
-name: Check changed Nix files with nixf-tidy (experimental)
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened, edited]
-
-permissions: {}
-
-jobs:
-  nixos:
-    name: exp-nixf-tidy-check
-    runs-on: ubuntu-24.04
-    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-          # Fetches the merge commit and its parents
-          fetch-depth: 2
-
-      - name: Checking out target branch
-        run: |
-          target=$(mktemp -d)
-          targetRev=$(git rev-parse HEAD^1)
-          git worktree add "$target" "$targetRev"
-          echo "targetRev=$targetRev" >> "$GITHUB_ENV"
-          echo "target=$target" >> "$GITHUB_ENV"
-
-      - name: Get Nixpkgs revision for nixf
-        run: |
-          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf
-          # from staging
-          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
-          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
-          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-          nix_path: nixpkgs=${{ env.url }}
-
-      - name: Install nixf and jq
-        # provided jq is incompatible with our expression
-        run: "nix-env -f '<nixpkgs>' -iAP nixf jq"
-
-      - name: Check that Nix files pass nixf-tidy
-        run: |
-          # Filtering error messages we don't like
-          nixf_wrapper(){
-            nixf-tidy --variable-lookup < "$1" | jq -r '
-              [
-                "sema-escaping-with"
-              ]
-              as $ignored_errors|[.[]|select(.sname as $s|$ignored_errors|index($s)|not)]
-            '
-          }
-
-          failedFiles=()
-
-          # Don't report errors to file overview
-          # to avoid duplicates when editing title and description
-          if [[ "${{ github.event.action }}" == 'edited' ]] && [[ -z "${{ github.event.edited.changes.base }}" ]]; then
-            DONT_REPORT_ERROR=1
-          else
-            DONT_REPORT_ERROR=
-          fi
-          # TODO: Make this more parallel
-
-          # Loop through all Nix files touched by the PR
-          while readarray -d '' -n 2 entry && (( ${#entry[@]} != 0 )); do
-            type=${entry[0]}
-            file=${entry[1]}
-            case $type in
-              A*)
-                source=""
-                dest=$file
-                ;;
-              M*)
-                source=$file
-                dest=$file
-                ;;
-              C*|R*)
-                source=$file
-                read -r -d '' dest
-                ;;
-              *)
-                echo "Ignoring file $file with type $type"
-                continue
-            esac
-
-            if [[ -n "$source" ]] && [[ "$(nixf_wrapper ${{ env.target }}/"$source")" != '[]' ]] 2>/dev/null; then
-              echo "Ignoring file $file because it doesn't pass nixf-tidy in the target commit"
-              echo # insert blank line
-            else
-              nixf_report="$(nixf_wrapper "$dest")"
-              if [[ "$nixf_report" != '[]' ]]; then
-                echo "$dest doesn't pass nixf-tidy. Reported by nixf-tidy:"
-                errors=$(echo "$nixf_report" | jq -r --arg dest "$dest" '
-                  def getLCur: "line=" + (.line+1|tostring) + ",col=" + (.column|tostring);
-                  def getRCur: "endLine=" + (.line+1|tostring) + ",endColumn=" + (.column|tostring);
-                  def getRange: "file=\($dest)," + (.lCur|getLCur) + "," + (.rCur|getRCur);
-                  def getBody: . as $top|(.range|getRange) + ",title="+ .sname + "::" +
-                    (.message|sub("{}" ; ($top.args.[]|tostring)));
-                  def getNote: "\n::notice " + (.|getBody);
-                  def getMessage: "::error " + (.|getBody) + (if (.notes|length)>0 then
-                    ([.notes.[]|getNote]|add) else "" end);
-                  .[]|getMessage
-                ')
-                if [[ -z "$DONT_REPORT_ERROR" ]]; then
-                  echo "$errors"
-                else
-                  # just print in plain text
-                  echo "${errors/::/}"
-                  echo # add one empty line
-                fi
-                failedFiles+=("$dest")
-              fi
-            fi
-          done < <(git diff -z --name-status ${{ env.targetRev }} -- '*.nix')
-
-          if [[ -n "$DONT_REPORT_ERROR" ]]; then
-            echo "Edited the PR but didn't change the base branch, only the description/title."
-            echo "Not reporting errors again to avoid duplication."
-            echo # add one empty line
-          fi
-
-          if (( "${#failedFiles[@]}" > 0 )); then
-            echo "Some new/changed Nix files don't pass nixf-tidy."
-            echo "See ${{ github.event.pull_request.html_url }}/files for reported errors."
-            echo "If you believe this is a false positive, ping @Aleksanaa and @inclyc in this PR."
-            exit 1
-          fi

.github/workflows/check-shell.yml

@@ -1,33 +0,0 @@
-name: "Check shell"
-
-on:
-  pull_request_target:
-    paths:
-      - 'shell.nix'
-      - 'ci/**'
-
-permissions: {}
-
-jobs:
-  shell-check:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            system: x86_64-linux
-          - runner: macos-14
-            system: aarch64-darwin
-
-    name: shell-check-${{ matrix.system }}
-    runs-on: ${{ matrix.runner }}
-
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-
-      - name: Build shell
-        run: nix-build shell.nix

.github/workflows/codeowners-v2.yml

@@ -1,111 +0,0 @@
-# This workflow depends on two GitHub Apps with the following permissions:
-# - For checking code owners:
-#   - Permissions:
-#     - Repository > Administration: read-only
-#     - Organization > Members: read-only
-#   - Install App on this repository, setting these variables:
-#     - OWNER_RO_APP_ID (variable)
-#     - OWNER_RO_APP_PRIVATE_KEY (secret)
-# - For requesting code owners:
-#   - Permissions:
-#     - Repository > Administration: read-only
-#     - Organization > Members: read-only
-#     - Repository > Pull Requests: read-write
-#   - Install App on this repository, setting these variables:
-#     - OWNER_APP_ID (variable)
-#     - OWNER_APP_PRIVATE_KEY (secret)
-#
-# This split is done because checking code owners requires handling untrusted PR input,
-# while requesting code owners requires PR write access, and those shouldn't be mixed.
-#
-# Note that the latter is also used for ./eval.yml requesting reviewers.
-
-name: Codeowners v2
-
-on:
-  pull_request_target:
-    types: [opened, ready_for_review, synchronize, reopened, edited]
-
-permissions: {}
-
-env:
-  OWNERS_FILE: ci/OWNERS
-  # Don't do anything on draft PRs
-  DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
-
-jobs:
-  get-merge-commit:
-    if: github.repository_owner == 'NixOS'
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  # Check that code owners is valid
-  check:
-    name: Check
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    if: github.repository_owner == 'NixOS' && needs.get-merge-commit.outputs.mergedSha
-    steps:
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-
-      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
-      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
-      # We later build and run code from the base branch with access to secrets,
-      # so it's important this is not the PRs code.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          path: base
-
-      - name: Build codeowners validator
-        run: nix-build base/ci -A codeownersValidator
-
-      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_RO_APP_ID }}
-          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-          path: pr
-
-      - name: Validate codeowners
-        run: result/bin/codeowners-validator
-        env:
-          OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
-          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPOSITORY_PATH: pr
-          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
-          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
-          EXPERIMENTAL_CHECKS: "avoid-shadowing"
-
-  # Request reviews from code owners
-  request:
-    name: Request
-    runs-on: ubuntu-24.04
-    if: github.repository_owner == 'NixOS'
-    steps:
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-
-      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
-      # This is intentional, because we need to request the review of owners as declared in the base branch.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_APP_ID }}
-          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
-
-      - name: Build review request package
-        run: nix-build ci -A requestReviews
-
-      - name: Request reviews
-        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/editorconfig-v2.yml

@@ -1,47 +0,0 @@
-name: "Checking EditorConfig v2"
-
-on:
-  pull_request_target:
-
-permissions: {}
-
-jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  tests:
-    name: editorconfig-check
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
-    steps:
-      - name: Get list of changed files from PR
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api \
-            repos/${{ github.repository }}/pulls/${{ github.event.number }}/files --paginate \
-            | jq '.[] | select(.status != "removed") | .filename' \
-            > "$HOME/changed_files"
-
-      - name: print list of changed files
-        run: |
-          cat "$HOME/changed_files"
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          # nixpkgs commit is pinned so that it doesn't break
-          # editorconfig-checker 2.4.0
-          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
-
-      - name: Checking EditorConfig
-        run: |
-          < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
-
-      - if: ${{ failure() }}
-        run: |
-          echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

.github/workflows/editorconfig.yml

@@ -0,0 +1,41 @@
+name: "Checking EditorConfig"
+
+permissions: read-all
+
+on:
+  # avoids approving first time contributors
+  pull_request_target:
+    branches-ignore:
+      - 'release-**'
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    steps:
+    - name: Get list of changed files from PR
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        gh api \
+          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
+          | jq '.[] | select(.status != "removed") | .filename' \
+          > "$HOME/changed_files"
+    - name: print list of changed files
+      run: |
+        cat "$HOME/changed_files"
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      with:
+        # pull_request_target checks out the base branch by default
+        ref: refs/pull/${{ github.event.pull_request.number }}/merge
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      with:
+        # nixpkgs commit is pinned so that it doesn't break
+        # editorconfig-checker 2.4.0
+        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
+    - name: Checking EditorConfig
+      run: |
+        cat "$HOME/changed_files" | nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
+    - if: ${{ failure() }}
+      run: |
+        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

.github/workflows/eval-lib-tests.yml

@@ -1,31 +0,0 @@
-name: "Building Nixpkgs lib-tests"
-
-on:
-  pull_request_target:
-    paths:
-      - 'lib/**'
-      - 'maintainers/**'
-
-permissions: {}
-
-jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  nixpkgs-lib-tests:
-    name: nixpkgs-lib-tests
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Building Nixpkgs lib-tests
-        run: |
-          nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix

.github/workflows/eval.yml

@@ -1,342 +0,0 @@
-name: Eval
-
-on:
-  pull_request_target:
-    types: [opened, ready_for_review, synchronize, reopened]
-  push:
-    # Keep this synced with ci/request-reviews/dev-branches.txt
-    branches:
-      - master
-      - staging
-      - release-*
-      - staging-*
-      - haskell-updates
-      - python-updates
-
-permissions: {}
-
-jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  attrs:
-    name: Attributes
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
-    outputs:
-      targetSha: ${{ steps.targetSha.outputs.targetSha }}
-      systems: ${{ steps.systems.outputs.systems }}
-    steps:
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-          fetch-depth: 2
-          path: nixpkgs
-
-      - name: Determine target commit
-        if: github.event_name == 'pull_request_target'
-        id: targetSha
-        run: |
-          targetSha=$(git -C nixpkgs rev-parse HEAD^1)
-          echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Evaluate the list of all attributes and get the systems matrix
-        id: systems
-        run: |
-          nix-build nixpkgs/ci -A eval.attrpathsSuperset
-          echo "systems=$(<result/systems.json)" >> "$GITHUB_OUTPUT"
-
-      - name: Upload the list of all attributes
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: paths
-          path: result/*
-
-  eval-aliases:
-    name: Eval nixpkgs with aliases enabled
-    runs-on: ubuntu-24.04
-    needs: [ get-merge-commit ]
-    steps:
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-          path: nixpkgs
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Ensure flake outputs on all systems still evaluate
-        run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build ./nixpkgs
-
-      - name: Query nixpkgs with aliases enabled to check for basic syntax errors
-        run: |
-          time nix-env -I ./nixpkgs -f ./nixpkgs -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null
-
-  outpaths:
-    name: Outpaths
-    runs-on: ubuntu-24.04
-    needs: [ attrs, get-merge-commit ]
-    strategy:
-      fail-fast: false
-      matrix:
-        system: ${{ fromJSON(needs.attrs.outputs.systems) }}
-    steps:
-      - name: Enable swap
-        run: |
-          sudo fallocate -l 10G /swapfile
-          sudo chmod 600 /swapfile
-          sudo mkswap /swapfile
-          sudo swapon /swapfile
-
-      - name: Download the list of all attributes
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          name: paths
-          path: paths
-
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-          path: nixpkgs
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes
-        env:
-          MATRIX_SYSTEM: ${{ matrix.system }}
-        run: |
-          nix-build nixpkgs/ci -A eval.singleSystem \
-            --argstr evalSystem "$MATRIX_SYSTEM" \
-            --arg attrpathFile ./paths/paths.json \
-            --arg chunkSize 10000
-          # If it uses too much memory, slightly decrease chunkSize
-
-      - name: Upload the output paths and eval stats
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: intermediate-${{ matrix.system }}
-          path: result/*
-
-  process:
-    name: Process
-    runs-on: ubuntu-24.04
-    needs: [ outpaths, attrs, get-merge-commit ]
-    outputs:
-      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}
-    steps:
-      - name: Download output paths and eval stats for all systems
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          pattern: intermediate-*
-          path: intermediate
-
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-          fetch-depth: 2
-          path: nixpkgs
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - name: Combine all output paths and eval stats
-        run: |
-          nix-build nixpkgs/ci -A eval.combine \
-            --arg resultsDir ./intermediate \
-            -o prResult
-
-      - name: Upload the combined results
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: result
-          path: prResult/*
-
-      - name: Get target run id
-        if: needs.attrs.outputs.targetSha
-        id: targetRunId
-        run: |
-          # Get the latest eval.yml workflow run for the PR's target commit
-          if ! run=$(gh api --method GET /repos/"$REPOSITORY"/actions/workflows/eval.yml/runs \
-            -f head_sha="$TARGET_SHA" -f event=push \
-            --jq '.workflow_runs | sort_by(.run_started_at) | .[-1]') \
-            || [[ -z "$run" ]]; then
-            echo "Could not find an eval.yml workflow run for $TARGET_SHA, cannot make comparison"
-            exit 1
-          fi
-          echo "Comparing against $(jq .html_url <<< "$run")"
-          runId=$(jq .id <<< "$run")
-          conclusion=$(jq -r .conclusion <<< "$run")
-
-          while [[ "$conclusion" == null || "$conclusion" == "" ]]; do
-            echo "Workflow not done, waiting 10 seconds before checking again"
-            sleep 10
-            conclusion=$(gh api /repos/"$REPOSITORY"/actions/runs/"$runId" --jq '.conclusion')
-          done
-
-          if [[ "$conclusion" != "success" ]]; then
-            echo "Workflow was not successful (conclusion: $conclusion), cannot make comparison"
-            exit 1
-          fi
-
-          echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"
-        env:
-          REPOSITORY: ${{ github.repository }}
-          TARGET_SHA: ${{ needs.attrs.outputs.targetSha }}
-          GH_TOKEN: ${{ github.token }}
-
-      - uses: actions/download-artifact@v4
-        if: steps.targetRunId.outputs.targetRunId
-        with:
-          name: result
-          path: targetResult
-          github-token: ${{ github.token }}
-          run-id: ${{ steps.targetRunId.outputs.targetRunId }}
-
-      - name: Compare against the target branch
-        if: steps.targetRunId.outputs.targetRunId
-        run: |
-          git -C nixpkgs worktree add ../target ${{ needs.attrs.outputs.targetSha }}
-          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.targetSha }} \
-            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
-
-          # Use the target branch to get accurate maintainer info
-          nix-build target/ci -A eval.compare \
-            --arg beforeResultDir ./targetResult \
-            --arg afterResultDir ./prResult \
-            --arg touchedFilesJson ./touched-files.json \
-            -o comparison
-
-          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload the combined results
-        if: steps.targetRunId.outputs.targetRunId
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: comparison
-          path: comparison/*
-
-  # Separate job to have a very tightly scoped PR write token
-  tag:
-    name: Tag
-    runs-on: ubuntu-24.04
-    needs: [ attrs, process ]
-    if: needs.process.outputs.targetRunId
-    permissions:
-      pull-requests: write
-      statuses: write
-    steps:
-      # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
-      # Can't use the token received from permissions above, because it can't get enough permissions
-      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_APP_ID }}
-          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
-
-      - name: Download process result
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
-        with:
-          name: comparison
-          path: comparison
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-
-      # Important: This workflow job runs with extra permissions,
-      # so we need to make sure to not run untrusted code from PRs
-      - name: Check out Nixpkgs at the base commit
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.attrs.outputs.targetSha }}
-          path: base
-          sparse-checkout: ci
-
-      - name: Build the requestReviews derivation
-        run: nix-build base/ci -A requestReviews
-
-      - name: Labelling pull request
-        run: |
-          # Get all currently set rebuild labels
-          gh api \
-            /repos/"$REPOSITORY"/issues/"$NUMBER"/labels \
-            --jq '.[].name | select(startswith("10.rebuild"))' \
-            | sort > before
-
-          # And the labels that should be there
-          jq -r '.labels[]' comparison/changed-paths.json \
-            | sort > after
-
-          # Remove the ones not needed anymore
-          while read -r toRemove; do
-            echo "Removing label $toRemove"
-            gh api \
-              --method DELETE \
-              /repos/"$REPOSITORY"/issues/"$NUMBER"/labels/"$toRemove"
-          done < <(comm -23 before after)
-
-          # And add the ones that aren't set already
-          while read -r toAdd; do
-            echo "Adding label $toAdd"
-            gh api \
-              --method POST \
-              /repos/"$REPOSITORY"/issues/"$NUMBER"/labels \
-              -f "labels[]=$toAdd"
-          done < <(comm -13 before after)
-
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          NUMBER: ${{ github.event.number }}
-
-      - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' }}
-        run: |
-          description=$(jq -r '
-          "Package: added " + (.attrdiff.added | length | tostring) +
-          ", removed " + (.attrdiff.removed | length | tostring) +
-          ", changed " + (.attrdiff.changed | length | tostring) +
-          ", Rebuild: linux " + (.rebuildCountByKernel.linux | tostring) +
-          ", darwin " + (.rebuildCountByKernel.darwin | tostring)
-          ' <comparison/changed-paths.json)
-          target_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID?pr=$NUMBER"
-          gh api --method POST \
-            -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" \
-            "/repos/$GITHUB_REPOSITORY/statuses/$PR_HEAD_SHA" \
-            -f "context=Eval / Summary" -f "state=success" -f "description=$description" -f "target_url=$target_url"
-        env:
-          GH_TOKEN: ${{ github.token }}
-          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          NUMBER: ${{ github.event.number }}
-
-      - name: Requesting maintainer reviews
-        run: |
-          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
-          # There appears to be no API to request reviews based on GitHub IDs
-          jq -r 'keys[]' comparison/maintainers.json \
-            | while read -r id; do gh api /user/"$id" --jq .login; done \
-            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
-
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          NUMBER: ${{ github.event.number }}
-          AUTHOR: ${{ github.event.pull_request.user.login }}
-          # Don't request reviewers on draft PRs
-          DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}

.github/workflows/get-merge-commit.yml

@@ -1,43 +0,0 @@
-name: Get merge commit
-
-on:
-  workflow_call:
-    outputs:
-      mergedSha:
-        description: "The merge commit SHA"
-        value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}
-
-permissions: {}
-
-jobs:
-  resolve-merge-commit:
-    runs-on: ubuntu-24.04
-    outputs:
-      mergedSha: ${{ steps.merged.outputs.mergedSha }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          path: base
-          sparse-checkout: ci
-
-      - name: Check if the PR can be merged and get the test merge commit
-        id: merged
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_EVENT: ${{ github.event_name }}
-        run: |
-          case "$GH_EVENT" in
-            push)
-              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
-              ;;
-            pull_request_target)
-              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-                echo "Checking the merge commit $mergedSha"
-                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
-              else
-                # Skipping so that no notifications are sent
-                echo "Skipping the rest..."
-              fi
-              ;;
-          esac
-          rm -rf base

.github/workflows/keep-sorted.yml

@@ -1,40 +0,0 @@
-name: Check that files are sorted
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-
-permissions: {}
-
-jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  nixos:
-    name: keep-sorted
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-
-      - name: Get Nixpkgs revision for keep-sorted
-        run: |
-          # Pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt from staging.
-          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
-          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
-          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-          nix_path: nixpkgs=${{ env.url }}
-
-      - name: Install keep-sorted
-        run: "nix-env -f '<nixpkgs>' -iAP keep-sorted jq"
-
-      - name: Check that Nix files are sorted
-        run: |
-          git ls-files | xargs keep-sorted --mode lint | jq --raw-output '.[] | "Please make sure any new entries in \(.path) are sorted alphabetically."'

.github/workflows/labels.yml

@@ -1,31 +1,24 @@
-# WARNING:
-# When extending this action, be aware that $GITHUB_TOKEN allows some write
-# access to the GitHub API. This means that it should not evaluate user input in
-# a way that allows code injection.
-
 name: "Label PR"
 
 on:
   pull_request_target:
     types: [edited, opened, synchronize, reopened]
 
+# WARNING:
+# When extending this action, be aware that $GITHUB_TOKEN allows some write
+# access to the GitHub API. This means that it should not evaluate user input in
+# a way that allows code injection.
+
 permissions:
   contents: read
   pull-requests: write
 
 jobs:
   labels:
-    name: label-pr
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          configuration-path: .github/labeler.yml # default
-          sync-labels: true
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          configuration-path: .github/labeler-no-sync.yml
-          sync-labels: false
+    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        sync-labels: true

.github/workflows/lint-actions.sh

@@ -1,7 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash actionlint shellcheck -I nixpkgs=../..
-set -euo pipefail
-
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-cd "$SCRIPT_DIR/../.."
-actionlint

.github/workflows/manual-nixos-v2.yml

@@ -1,56 +0,0 @@
-name: "Build NixOS manual v2"
-
-on:
-  pull_request_target:
-    branches:
-      - master
-    paths:
-      - "nixos/**"
-      # Also build when the nixpkgs doc changed, since we take things like
-      # the release notes and some css and js files from there.
-      # See nixos/doc/manual/default.nix
-      - "doc/**"
-      # Build when something in lib changes
-      # Since the lib functions are used to 'massage' the options before producing the manual
-      - "lib/**"
-
-permissions: {}
-
-jobs:
-  nixos:
-    name: nixos-manual-build
-    strategy:
-      fail-fast: false
-      matrix:
-        system:
-          - x86_64-linux
-          - aarch64-linux
-    runs-on: >-
-      ${{ (matrix.system == 'x86_64-linux' && 'ubuntu-24.04')
-      || (matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm') }}
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        if: github.repository_owner == 'NixOS'
-        with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-
-      - name: Build NixOS manual
-        id: build-manual
-        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.${{ matrix.system }}
-
-      - name: Upload NixOS manual
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: nixos-manual-${{ matrix.system }}
-          path: result/
-          if-no-files-found: error

.github/workflows/manual-nixos.yml

@@ -0,0 +1,31 @@
+name: "Build NixOS manual"
+
+permissions: read-all
+
+on:
+  pull_request_target:
+    branches:
+      - master
+    paths:
+      - 'nixos/**'
+
+jobs:
+  nixos:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        with:
+          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+          name: nixpkgs-ci
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      - name: Building NixOS manual
+        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,35 +0,0 @@
-name: "Build Nixpkgs manual v2"
-
-on:
-  pull_request_target:
-    branches:
-      - master
-    paths:
-      - 'doc/**'
-      - 'lib/**'
-      - 'pkgs/tools/nix/nixdoc/**'
-
-permissions: {}
-
-jobs:
-  nixpkgs:
-    name: nixpkgs-manual-build
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: refs/pull/${{ github.event.pull_request.number }}/merge
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-
-      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
-        if: github.repository_owner == 'NixOS'
-        with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
-      - name: Building Nixpkgs manual
-        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests

.github/workflows/manual-nixpkgs.yml

@@ -0,0 +1,33 @@
+name: "Build Nixpkgs manual"
+
+permissions: read-all
+
+on:
+  pull_request_target:
+    branches:
+      - master
+    paths:
+      - 'doc/**'
+      - 'lib/**'
+      - 'pkgs/tools/nix/nixdoc/**'
+
+jobs:
+  nixpkgs:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        with:
+          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+          name: nixpkgs-ci
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      - name: Building Nixpkgs manual
+        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests

.github/workflows/nix-parse-v2.yml

@@ -1,47 +0,0 @@
-name: "Check whether nix files are parseable v2"
-
-on:
-  pull_request_target:
-
-permissions: {}
-
-jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  tests:
-    name: nix-files-parseable-check
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    if: "needs.get-merge-commit.outputs.mergedSha && !contains(github.event.pull_request.title, '[skip treewide]')"
-    steps:
-      - name: Get list of changed files from PR
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh api \
-            repos/${{ github.repository }}/pulls/${{github.event.number}}/files --paginate \
-            | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
-            > "$HOME/changed_files"
-          if [[ -s "$HOME/changed_files" ]]; then
-            echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
-          fi
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-        with:
-          extra_nix_config: sandbox = true
-          nix_path: nixpkgs=channel:nixpkgs-unstable
-
-      - name: Parse all changed or added nix files
-        run: |
-          ret=0
-          while IFS= read -r file; do
-            out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
-          done < "$HOME/changed_files"
-          exit "$ret"
-        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

.github/workflows/nix-parse.yml

@@ -0,0 +1,42 @@
+name: "Check whether nix files are parseable"
+
+permissions: read-all
+
+on:
+  # avoids approving first time contributors
+  pull_request_target:
+    branches-ignore:
+      - 'release-**'
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    steps:
+    - name: Get list of changed files from PR
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        gh api \
+          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
+          | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
+          > "$HOME/changed_files"
+        if [[ -s "$HOME/changed_files" ]]; then
+          echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
+        fi
+    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      with:
+        # pull_request_target checks out the base branch by default
+        ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
+    - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      with:
+        nix_path: nixpkgs=channel:nixpkgs-unstable
+    - name: Parse all changed or added nix files
+      run: |
+        ret=0
+        while IFS= read -r file; do
+          out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
+        done < "$HOME/changed_files"
+        exit "$ret"
+      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

.github/workflows/nixpkgs-vet.yml

@@ -1,73 +0,0 @@
-# `nixpkgs-vet` is a tool to vet Nixpkgs: its architecture, package structure, and more.
-# Among other checks, it makes sure that `pkgs/by-name` (see `../../pkgs/by-name/README.md`) follows the validity rules outlined in [RFC 140](https://github.com/NixOS/rfcs/pull/140).
-# When you make changes to this workflow, please also update `ci/nixpkgs-vet.sh` to reflect the impact of your work to the CI.
-# See https://github.com/NixOS/nixpkgs-vet for details on the tool and its checks.
-
-name: Vet nixpkgs
-
-on:
-  pull_request_target:
-    # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
-    # Instead it causes an `edited` event, so we need to add it explicitly here.
-    # While `edited` is also triggered when the PR title/body is changed, this PR action is fairly quick, and PRs don't get edited **that** often, so it shouldn't be a problem.
-    # There is a feature request for adding a `base_changed` event: https://github.com/orgs/community/discussions/35058
-    types: [opened, synchronize, reopened, edited]
-
-permissions: {}
-
-# We don't use a concurrency group here, because the action is triggered quite often (due to the PR edit trigger), and contributors would get notified on any canceled run.
-# There is a feature request for suppressing notifications on concurrency-canceled runs: https://github.com/orgs/community/discussions/13015
-
-jobs:
-  get-merge-commit:
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  check:
-    name: nixpkgs-vet
-    # This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases.
-    runs-on: ubuntu-24.04
-    # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
-    timeout-minutes: 10
-    needs: get-merge-commit
-    if: needs.get-merge-commit.outputs.mergedSha
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-          # Fetches the merge commit and its parents
-          fetch-depth: 2
-
-      - name: Checking out target branch
-        run: |
-          target=$(mktemp -d)
-          git worktree add "$target" "$(git rev-parse HEAD^1)"
-          echo "target=$target" >> "$GITHUB_ENV"
-
-      - uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
-
-      - name: Fetching the pinned tool
-        # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh
-        run: |
-          # The pinned version of the tooling to use.
-          toolVersion=$(<ci/nixpkgs-vet/pinned-version.txt)
-
-          # Fetch the x86_64-linux-specific release artifact containing the gzipped NAR of the pre-built tool.
-          toolPath=$(curl -sSfL https://github.com/NixOS/nixpkgs-vet/releases/download/"$toolVersion"/x86_64-linux.nar.gz \
-            | gzip -cd | nix-store --import | tail -1)
-
-          # Adds a result symlink as a GC root.
-          nix-store --realise "$toolPath" --add-root result
-
-      - name: Running nixpkgs-vet
-        env:
-          # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
-          CLICOLOR_FORCE: 1
-        run: |
-          if result/bin/nixpkgs-vet --base "$target" .; then
-            exit 0
-          else
-            exitCode=$?
-            echo "To run locally: ./ci/nixpkgs-vet.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
-            echo "If you're having trouble, ping @NixOS/nixpkgs-vet"
-            exit "$exitCode"
-          fi

.github/workflows/no-channel.yml

@@ -1,25 +1,26 @@
 name: "No channel PR"
 
 on:
-  pull_request_target:
-    # Re-run should be triggered when the base branch is updated, instead of silently failing
-    types: [opened, synchronize, reopened, edited]
+  pull_request:
     branches:
       - 'nixos-**'
       - 'nixpkgs-**'
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   fail:
+    permissions:
+      contents: none
     name: "This PR is is targeting a channel branch"
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     steps:
-      - run: |
-          cat <<EOF
-          The nixos-* and nixpkgs-* branches are pushed to by the channel
-          release script and should not be merged into directly.
+    - run: |
+        cat <<EOF
+        The nixos-* and nixpkgs-* branches are pushed to by the channel
+        release script and should not be merged into directly.
 
-          Please target the equivalent release-* branch or master instead.
-          EOF
-          exit 1
+        Please target the equivalent release-* branch or master instead.
+        EOF
+        exit 1

.github/workflows/ofborg-pending.yml

@@ -0,0 +1,33 @@
+name: "Set pending OfBorg status"
+on:
+  pull_request_target:
+
+# Sets the ofborg-eval status to "pending" to signal that we are waiting for
+# OfBorg even if it is running late. The status will be overwritten by OfBorg
+# once it starts evaluation.
+
+# WARNING:
+# When extending this action, be aware that $GITHUB_TOKEN allows (restricted) write access to
+# the GitHub repository. This means that it should not evaluate user input in a
+# way that allows code injection.
+
+permissions:
+  contents: read
+
+jobs:
+  action:
+    if: github.repository_owner == 'NixOS'
+    permissions:
+      statuses: write
+    runs-on: ubuntu-latest
+    steps:
+    - name: "Set pending OfBorg status"
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        curl \
+          -X POST \
+          -H "Accept: application/vnd.github.v3+json" \
+          -H "Authorization: Bearer $GITHUB_TOKEN" \
+          -d '{"context": "ofborg-eval", "state": "pending", "description": "Waiting for OfBorg..."}' \
+          "https://api.github.com/repos/NixOS/nixpkgs/commits/${{ github.event.pull_request.head.sha }}/statuses"

.github/workflows/periodic-merge-24h.yml

@@ -7,6 +7,7 @@
 
 name: "Periodic Merges (24h)"
 
+
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string
@@ -14,11 +15,16 @@ on:
     - cron:  '0 0 * * *'
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   periodic-merge:
+    permissions:
+      contents: write  # for devmasx/merge-branch to merge branches
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
     if: github.repository_owner == 'NixOS'
+    runs-on: ubuntu-latest
     strategy:
       # don't fail fast, so that all pairs are tried
       fail-fast: false
@@ -27,14 +33,32 @@ jobs:
       max-parallel: 1
       matrix:
         pairs:
-          - from: release-24.11
-            into: staging-next-24.11
-          - from: staging-next-24.11
-            into: staging-24.11
-          - from: master staging
+          - from: master
             into: haskell-updates
-    uses: ./.github/workflows/periodic-merge.yml
-    with:
-      from: ${{ matrix.pairs.from }}
-      into: ${{ matrix.pairs.into }}
-    secrets: inherit
+          - from: release-23.11
+            into: staging-next-23.11
+          - from: staging-next-23.11
+            into: staging-23.11
+          - from: release-24.05
+            into: staging-next-24.05
+          - from: staging-next-24.05
+            into: staging-24.05
+    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+
+      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
+        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
+        with:
+          type: now
+          from_branch: ${{ matrix.pairs.from }}
+          target_branch: ${{ matrix.pairs.into }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on failure
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        if: ${{ failure() }}
+        with:
+          issue-number: 105153
+          body: |
+            Periodic merge from `${{ matrix.pairs.from }}` into `${{ matrix.pairs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).

.github/workflows/periodic-merge-6h.yml

@@ -7,6 +7,7 @@
 
 name: "Periodic Merges (6h)"
 
+
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string
@@ -14,11 +15,16 @@ on:
     - cron:  '0 */6 * * *'
   workflow_dispatch:
 
-permissions: {}
+permissions:
+  contents: read
 
 jobs:
   periodic-merge:
+    permissions:
+      contents: write  # for devmasx/merge-branch to merge branches
+      pull-requests: write  # for peter-evans/create-or-update-comment to create or update comment
     if: github.repository_owner == 'NixOS'
+    runs-on: ubuntu-latest
     strategy:
       # don't fail fast, so that all pairs are tried
       fail-fast: false
@@ -31,8 +37,22 @@ jobs:
             into: staging-next
           - from: staging-next
             into: staging
-    uses: ./.github/workflows/periodic-merge.yml
-    with:
-      from: ${{ matrix.pairs.from }}
-      into: ${{ matrix.pairs.into }}
-    secrets: inherit
+    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+
+      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
+        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
+        with:
+          type: now
+          from_branch: ${{ matrix.pairs.from }}
+          target_branch: ${{ matrix.pairs.into }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on failure
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        if: ${{ failure() }}
+        with:
+          issue-number: 105153
+          body: |
+            Periodic merge from `${{ matrix.pairs.from }}` into `${{ matrix.pairs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).

.github/workflows/periodic-merge.yml

@@ -1,58 +0,0 @@
-name: "Merge"
-
-on:
-  workflow_call:
-    inputs:
-      from:
-        description: Branch to merge into target branch. Can also be two branches separated by space to find the merge base between them.
-        required: true
-        type: string
-      into:
-        description: Target branch to merge into.
-        required: true
-        type: string
-
-jobs:
-  merge:
-    runs-on: ubuntu-24.04
-    name: ${{ inputs.from }} → ${{ inputs.into }}
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2
-        id: app-token
-        with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-
-      - name: Find merge base between two branches
-        if: contains(inputs.from, ' ')
-        id: merge_base
-        env:
-          branches: ${{ inputs.from }}
-        run: |
-          # turn into bash array, split on space
-          read -ra branches <<< "$branches"
-          git fetch --shallow-since="1 month ago" origin "${branches[@]}"
-          merge_base="$(git merge-base "refs/remotes/origin/${branches[0]}" "refs/remotes/origin/${branches[1]}")"
-          echo "Found merge base: $merge_base" >&2
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-
-      - name: ${{ inputs.from }} → ${{ inputs.into }}
-        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
-        with:
-          type: now
-          from_branch: ${{ steps.merge_base.outputs.merge_base || inputs.from }}
-          target_branch: ${{ inputs.into }}
-          github_token: ${{ steps.app-token.outputs.token }}
-
-      - name: Comment on failure
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
-        if: ${{ failure() }}
-        with:
-          issue-number: 105153
-          body: |
-            Periodic merge from `${{ inputs.from }}` into `${{ inputs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
-          token: ${{ steps.app-token.outputs.token }}

.github/workflows/update-terraform-providers.yml

@@ -0,0 +1,69 @@
+name: "Update terraform-providers"
+
+on:
+  #schedule:
+  #  - cron: "0 3 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  tf-providers:
+    permissions:
+      contents: write # for peter-evans/create-pull-request to create branch
+      pull-requests: write # for peter-evans/create-pull-request to create a PR
+    if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+        with:
+          nix_path: nixpkgs=channel:nixpkgs-unstable
+      - name: setup
+        id: setup
+        run: |
+          echo "title=terraform-providers: update $(date -u +"%Y-%m-%d")" >> $GITHUB_OUTPUT
+      - name: update terraform-providers
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          echo | nix-shell \
+            maintainers/scripts/update.nix \
+            --argstr commit true \
+            --argstr keep-going true \
+            --argstr max-workers 2 \
+            --argstr path terraform-providers
+      - name: get failed updates
+        run: |
+          echo 'FAILED<<EOF' >> $GITHUB_ENV
+          git ls-files --others >> $GITHUB_ENV
+          echo 'EOF' >> $GITHUB_ENV
+      # cleanup logs of failed updates so they aren't included in the PR
+      - name: clean repo
+        run: |
+          git clean -f
+      - name: create PR
+        uses: peter-evans/create-pull-request@9153d834b60caba6d51c9b9510b087acf9f33f83 # v6.0.4
+        with:
+          body: |
+            Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
+
+            https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}
+
+            These providers failed to update:
+            ```
+            ${{ env.FAILED }}
+            ```
+
+            Check that all providers build with:
+            ```
+            @ofborg build opentofu.full
+            ```
+            If there is more than ten commits in the PR `ofborg` won't build it automatically and you will need to use the above command.
+          branch: terraform-providers-update
+          delete-branch: false
+          title: ${{ steps.setup.outputs.title }}
+          token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -7,7 +7,6 @@
 .idea/
 .nixos-test-history
 .vscode/
-.helix/
 outputs/
 result-*
 result
@@ -20,8 +19,6 @@ tags
 /doc/manual.pdf
 /source/
 .version-suffix
-.direnv
-.envrc
 
 .DS_Store
 .mypy_cache
@@ -33,10 +30,6 @@ __pycache__
 
 # generated by pkgs/common-updater/update-script.nix
 update-git-commits.txt
-/*.log
 
 # JetBrains IDEA module declaration file
 /nixpkgs.iml
-
-# Usually used for manual backports
-.worktree/

.mailmap

@@ -1,24 +1,10 @@
 ajs124 <git@ajs124.de> <ajs124@users.noreply.github.com>
 Anderson Torres <torres.anderson.85@protonmail.com>
-Atemu <git@atemu.net> <atemu.main@gmail.com>
-Christina Sørensen <christina@cafkafk.com>
-Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
-Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
-Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
 Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
-Fiona Behrens <me@kloenk.dev>
-Fiona Behrens <me@kloenk.dev> <me@kloenk.de>
-goatastronaut0212 <goatastronaut0212@outlook.com> <goatastronaut0212@proton.me>
 Janne Heß <janne@hess.ooo> <dasJ@users.noreply.github.com>
-jopejoe1 <nixpkgs@missing.ninja>
-jopejoe1 <nixpkgs@missing.ninja> <johannes@joens.email>
-jopejoe1 <nixpkgs@missing.ninja> <34899572+jopejoe1@users.noreply.github.com>
 Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
-Lin Jian <me@linj.tech> <linj.dev@outlook.com>
-Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
 Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>
-moni <lythe1107@gmail.com> <lythe1107@icloud.com>
 R. RyanTM <ryantm-bot@ryantm.com>
 Robert Hensing <robert@roberthensing.nl> <roberth@users.noreply.github.com>
 Sandro Jäckel <sandro.jaeckel@gmail.com>

.mergify.yml

@@ -1,21 +0,0 @@
-queue_rules:
-  # This rule is for https://docs.mergify.com/commands/queue/
-  # and can be triggered with: @mergifyio queue
-  - name: default
-    merge_conditions:
-      # all github action checks in this list are required to merge a pull request
-      - check-success=Attributes
-      - check-success=Check
-      - check-success=Outpaths (aarch64-darwin)
-      - check-success=Outpaths (aarch64-linux)
-      - check-success=Outpaths (x86_64-darwin)
-      - check-success=Outpaths (x86_64-linux)
-      - check-success=Process
-      - check-success=Request
-      - check-success=editorconfig-check
-      - check-success=label-pr
-      - check-success=nix-files-parseable-check
-      - check-success=nixfmt-check
-      - check-success=nixpkgs-vet
-    # queue up to 5 pull requests at a time
-    batch_size: 5

CONTRIBUTING.md

@@ -93,8 +93,6 @@ This section describes in some detail how changes can be made and proposed with
 7. Respond to review comments, potential CI failures and potential merge conflicts by updating the pull request.
    Always keep the pull request in a mergeable state.
 
-   This process is covered in more detail from the non-technical side in [I opened a PR, how do I get it merged?](#i-opened-a-pr-how-do-i-get-it-merged).
-
    The custom [OfBorg](https://github.com/NixOS/ofborg) CI system will perform various checks to help ensure code quality, whose results you can see at the bottom of the pull request.
    See [the OfBorg Readme](https://github.com/NixOS/ofborg#readme) for more details.
 
@@ -195,12 +193,19 @@ The last checkbox is about whether it fits the guidelines in this `CONTRIBUTING.
 [rebase]: #rebasing-between-branches-ie-from-master-to-staging
 
 From time to time, changes between branches must be rebased, for example, if the
-number of new rebuilds they would cause is too large for the target branch.
+number of new rebuilds they would cause is too large for the target branch. When
+rebasing, care must be taken to include only the intended changes, otherwise
+many CODEOWNERS will be inadvertently requested for review. To achieve this,
+rebasing should not be performed directly on the target branch, but on the merge
+base between the current and target branch. As an additional precautionary measure,
+you should temporarily mark the PR as draft for the duration of the operation.
+This reduces the probability of mass-pinging people. (OfBorg might still
+request a couple of persons for reviews though.)
 
 In the following example, we assume that the current branch, called `feature`,
 is based on `master`, and we rebase it onto the merge base between
-`master` and `staging` so that the PR can be retargeted to
-`staging`. The example uses `upstream` as the remote for `NixOS/nixpkgs.git`
+`master` and `staging` so that the PR can eventually be retargeted to
+`staging` without causing a mess. The example uses `upstream` as the remote for `NixOS/nixpkgs.git`
 while `origin` is the remote you are pushing to.
 
 
@@ -229,6 +234,36 @@ git status
 git push origin feature --force-with-lease
 ```
 
+#### Something went wrong and a lot of people were pinged
+
+It happens. Remember to be kind, especially to new contributors.
+There is no way back, so the pull request should be closed and locked
+(if possible). The changes should be re-submitted in a new PR, in which the people
+originally involved in the conversation need to manually be pinged again.
+No further discussion should happen on the original PR, as a lot of people
+are now subscribed to it.
+
+The following message (or a version thereof) might be left when closing to
+describe the situation, since closing and locking without any explanation
+is kind of rude:
+
+```markdown
+It looks like you accidentally mass-pinged a bunch of people, which are now subscribed
+and getting notifications for everything in this pull request. Unfortunately, they
+cannot be automatically unsubscribed from the issue (removing review request does not
+unsubscribe), therefore development cannot continue in this pull request anymore.
+
+Please open a new pull request with your changes, link back to this one and ping the
+people actually involved in here over there.
+
+In order to avoid this in the future, there are instructions for how to properly
+rebase between branches in our [contribution guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#rebasing-between-branches-ie-from-master-to-staging).
+Setting your pull request to draft prior to rebasing is strongly recommended.
+In draft status, you can preview the list of people that are about to be requested
+for review, which allows you to sidestep this issue.
+This is not a bulletproof method though, as OfBorg still does review requests even on draft PRs.
+```
+
 ## How to backport pull requests
 [pr-backport]: #how-to-backport-pull-requests
 
@@ -280,22 +315,6 @@ When reviewing a pull request, please always be nice and polite. Controversial c
 
 GitHub provides reactions as a simple and quick way to provide feedback to pull requests or any comments. The thumb-down reaction should be used with care and if possible accompanied with some explanation so the submitter has directions to improve their contribution.
 
-When doing a review:
-- Aim to drive the proposal to a timely conclusion.
-- Focus on the proposed changes to keep the scope of the discussion narrow.
-- Help the contributor prioritise their efforts towards getting their change merged.
-
-If you find anything related that could be improved but is not immediately required for acceptance, consider
-- Implementing the changes yourself in a follow-up pull request (and request review from the person who inspired you)
-- Tracking your idea in an issue
-- Offering the original contributor to review a follow-up pull request
-- Making concrete [suggestions](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/incorporating-feedback-in-your-pull-request) in the same pull request.
-
-For example, follow-up changes could involve refactoring code in the affected files.
-
-But please remember not to make such additional considerations a blocker, and communicate that to the contributor, for example by following the [conventional comments](https://conventionalcomments.org/) pattern.
-If the related change is essential for the contribution at hand, make clear why you think it is important to address that first.
-
 Pull request reviews should include a list of what has been reviewed in a comment, so other reviewers and mergers can know the state of the review.
 
 All the review template samples provided in this section are generic and meant as examples. Their usage is optional and the reviewer is free to adapt them to their liking.
@@ -308,18 +327,20 @@ If you consider having enough knowledge and experience in a topic and would like
 
 Container system, boot system and library changes are some examples of the pull requests fitting this category.
 
-## How to merge pull requests yourself
+## How to merge pull requests
 [pr-merge]: #how-to-merge-pull-requests
 
 To streamline automated updates, leverage the nixpkgs-merge-bot by simply commenting `@NixOS/nixpkgs-merge-bot merge`. The bot will verify if the following conditions are met, refusing to merge otherwise:
 
-- the PR author should be @r-ryantm;
 - the commenter that issued the command should be among the package maintainers;
 - the package should reside in `pkgs/by-name`.
 
 Further, nixpkgs-merge-bot will ensure all ofBorg checks (except the Darwin-related ones) are successfully completed before merging the pull request. Should the checks still be underway, the bot patiently waits for ofBorg to finish before attempting the merge again.
 
-For other pull requests, please see [I opened a PR, how do I get it merged?](#i-opened-a-pr-how-do-i-get-it-merged).
+For other pull requests, the *Nixpkgs committers* are people who have been given
+permission to merge.
+
+It is possible for community members that have enough knowledge and experience on a special topic to contribute by merging pull requests.
 
 In case the PR is stuck waiting for the original author to apply a trivial
 change (a typo, capitalisation change, etc.) and the author allowed the members
@@ -333,7 +354,7 @@ The following paragraphs about how to deal with unactive contributors is just a
 Please note that contributors with commit rights unactive for more than three months will have their commit rights revoked.
 -->
 
-Please see the discussion in [GitHub nixpkgs issue #321665](https://github.com/NixOS/nixpkgs/issues/321665) for information on how to proceed to be granted this level of access.
+Please see the discussion in [GitHub nixpkgs issue #50105](https://github.com/NixOS/nixpkgs/issues/50105) for information on how to proceed to be granted this level of access.
 
 In a case a contributor definitively leaves the Nix community, they should create an issue or post on [Discourse](https://discourse.nixos.org) with references of packages and modules they maintain so the maintainership can be taken over by other contributors.
 
@@ -345,7 +366,7 @@ See [Nix Channel Status](https://status.nixos.org/) for the current channels and
 Here's a brief overview of the main Git branches and what channels they're used for:
 
 - `master`: The main branch, used for the unstable channels such as `nixpkgs-unstable`, `nixos-unstable` and `nixos-unstable-small`.
-- `release-YY.MM` (e.g. `release-25.05`): The NixOS release branches, used for the stable channels such as `nixos-25.05`, `nixos-25.05-small` and `nixpkgs-25.05-darwin`.
+- `release-YY.MM` (e.g. `release-24.05`): The NixOS release branches, used for the stable channels such as `nixos-24.05`, `nixos-24.05-small` and `nixpkgs-24.05-darwin`.
 
 When a channel is updated, a corresponding Git branch is also updated to point to the corresponding commit.
 So e.g. the [`nixpkgs-unstable` branch](https://github.com/nixos/nixpkgs/tree/nixpkgs-unstable) corresponds to the Git commit from the [`nixpkgs-unstable` channel](https://channels.nixos.org/nixpkgs-unstable).
@@ -358,12 +379,10 @@ See [this section][branch] to know when to use the release branches.
 [staging]: #staging
 
 The staging workflow exists to batch Hydra builds of many packages together.
-It is coordinated in the [Staging room](https://matrix.to/#/#staging:nixos.org) on Matrix.
 
 It works by directing commits that cause [mass rebuilds][mass-rebuild] to a separate `staging` branch that isn't directly built by Hydra.
 Regularly, the `staging` branch is _manually_ merged into a `staging-next` branch to be built by Hydra using the [`nixpkgs:staging-next` jobset](https://hydra.nixos.org/jobset/nixpkgs/staging-next).
-The `staging-next` branch should then only receive changes that fix Hydra builds;
-**for anything else, ask the [Staging room](https://matrix.to/#/#staging:nixos.org) first**.
+The `staging-next` branch should then only receive direct commits in order to fix Hydra builds.
 Once it is verified that there are no major regressions, it is merged into `master` using [a pull request](https://github.com/NixOS/nixpkgs/pulls?q=head%3Astaging-next).
 This is done manually in order to ensure it's a good use of Hydra's computing resources.
 By keeping the `staging-next` branch separate from `staging`, this batching does not block developers from merging changes into `staging`.
@@ -393,10 +412,14 @@ Here is a Git history diagram showing the flow of commits between the three bran
 } }%%
 gitGraph
     commit id:" "
-    branch staging
-    commit id:"  "
     branch staging-next
+    branch staging
 
+    checkout master
+    checkout staging
+    checkout master
+    commit id:"    "
+    checkout staging-next
     merge master id:"automatic"
     checkout staging
     merge staging-next id:"automatic "
@@ -512,7 +535,6 @@ To get a sense for what changes are considered mass rebuilds, see [previously me
   - [Commit conventions](./doc/README.md#commit-conventions) for changes to `doc`, the Nixpkgs manual.
 
 ### Writing good commit messages
-[writing-good-commit-messages]: #writing-good-commit-messages
 
 In addition to writing properly formatted commit messages, it's important to include relevant information so other developers can later understand *why* a change was made. While this information usually can be found by digging code, mailing list/Discourse archives, pull request discussions or upstream changes, it may require a lot of work.
 
@@ -531,31 +553,141 @@ If you removed packages or made some major NixOS changes, write about it in the
 
 Names of files and directories should be in lowercase, with dashes between words — not in camel case. For instance, it should be `all-packages.nix`, not `allPackages.nix` or `AllPackages.nix`.
 
-### Formatting
-
-CI [enforces](./.github/workflows/check-nix-format.yml) all Nix files to be
-formatted using the [official Nix formatter](https://github.com/NixOS/nixfmt).
-
-You can ensure this locally using either of these commands:
-```
-nix-shell --run treefmt
-nix develop --command treefmt
-nix fmt
-```
-
-If you're starting your editor in `nix-shell` or `nix develop`,
-you can also set it up to automatically format the file with `treefmt` on save.
-
-If you have any problems with formatting, please ping the
-[formatting team](https://nixos.org/community/teams/formatting/) via
-[@NixOS/nix-formatting](https://github.com/orgs/NixOS/teams/nix-formatting).
-
 ### Syntax
 
-- Set up [editorconfig](https://editorconfig.org/) for your editor, such that [the settings](./.editorconfig) are automatically applied.
+- Use 2 spaces of indentation per indentation level in Nix expressions, 4 spaces in shell scripts.
+
+- Do not use tab characters, i.e. configure your editor to use soft tabs. For instance, use `(setq-default indent-tabs-mode nil)` in Emacs. Everybody has different tab settings so it’s asking for trouble.
 
 - Use `lowerCamelCase` for variable names, not `UpperCamelCase`. Note, this rule does not apply to package attribute names, which instead follow the rules in [package naming](./pkgs/README.md#package-naming).
 
+- Function calls with attribute set arguments are written as
+
+  ```nix
+  foo {
+    arg = <...>;
+  }
+  ```
+
+  not
+
+  ```nix
+  foo
+  {
+    arg = <...>;
+  }
+  ```
+
+  Also fine is
+
+  ```nix
+  foo { arg = <...>; }
+  ```
+
+  if it's a short call.
+
+- In attribute sets or lists that span multiple lines, the attribute names or list elements should be aligned:
+
+  ```nix
+  {
+    # A long list.
+    list = [
+      elem1
+      elem2
+      elem3
+    ];
+
+    # A long attribute set.
+    attrs = {
+      attr1 = short_expr;
+      attr2 =
+        if true then big_expr else big_expr;
+    };
+
+    # Combined
+    listOfAttrs = [
+      {
+        attr1 = 3;
+        attr2 = "fff";
+      }
+      {
+        attr1 = 5;
+        attr2 = "ggg";
+      }
+    ];
+  }
+  ```
+
+- Short lists or attribute sets can be written on one line:
+
+  ```nix
+  {
+    # A short list.
+    list = [ elem1 elem2 elem3 ];
+
+    # A short set.
+    attrs = { x = 1280; y = 1024; };
+  }
+  ```
+
+- Breaking in the middle of a function argument can give hard-to-read code, like
+
+  ```nix
+  someFunction { x = 1280;
+    y = 1024; } otherArg
+    yetAnotherArg
+  ```
+
+  (especially if the argument is very large, spanning multiple lines).
+
+  Better:
+
+  ```nix
+  someFunction
+    { x = 1280; y = 1024; }
+    otherArg
+    yetAnotherArg
+  ```
+
+  or
+
+  ```nix
+  let res = { x = 1280; y = 1024; };
+  in someFunction res otherArg yetAnotherArg
+  ```
+
+- The bodies of functions, asserts, and withs are not indented to prevent a lot of superfluous indentation levels, i.e.
+
+  ```nix
+  { arg1, arg2 }:
+  assert system == "i686-linux";
+  stdenv.mkDerivation { /* ... */ }
+  ```
+
+  not
+
+  ```nix
+  { arg1, arg2 }:
+    assert system == "i686-linux";
+      stdenv.mkDerivation { /* ... */ }
+  ```
+
+- Function formal arguments are written as:
+
+  ```nix
+  { arg1, arg2, arg3 }: { /* ... */ }
+  ```
+
+  but if they don't fit on one line they're written as:
+
+  ```nix
+  { arg1, arg2, arg3
+  , arg4
+  # Some comment...
+  ,  argN
+  }: { }
+  ```
+
 - Functions should list their expected arguments as precisely as possible. That is, write
 
   ```nix
@@ -614,7 +746,7 @@ If you have any problems with formatting, please ping the
 
   ```nix
   {
-    buildInputs = lib.optional stdenv.hostPlatform.isDarwin iconv;
+    buildInputs = lib.optional stdenv.isDarwin iconv;
   }
   ```
 
@@ -622,198 +754,9 @@ If you have any problems with formatting, please ping the
 
   ```nix
   {
-    buildInputs = if stdenv.hostPlatform.isDarwin then [ iconv ] else null;
+    buildInputs = if stdenv.isDarwin then [ iconv ] else null;
   }
   ```
 
   As an exception, an explicit conditional expression with null can be used when fixing a important bug without triggering a mass rebuild.
   If this is done a follow up pull request _should_ be created to change the code to `lib.optional(s)`.
-
-# Practical contributing advice
-
-To contribute effectively and efficiently, you need to be aware of how the contributing process generally works.
-This section aims to document the process as we live it in Nixpkgs to set expectations right and give practical tips on how to work with it.
-
-## I opened a PR, how do I get it merged?
-[i-opened-a-pr-how-do-i-get-it-merged]:#i-opened-a-pr-how-do-i-get-it-merged
-
-In order for your PR to be merged, someone with merge permissions on the repository ("committer") needs to review and merge it.
-Because the group of people with merge permissions is mostly a collection of independent unpaid volunteers who do this in their own free time, this can take some time to happen.
-It is entirely normal for your PR to sit around without any feedback for days, weeks or sometimes even months.
-We strive to avoid the latter cases of course but the reality of it is that this does happen quite frequently.
-Even when you get feedback, follow-up feedback may take similarly long.
-Don't be intimidated by this and kindly ask for feedback again every so often.
-If your change is good it will eventually be merged at some point.
-
-There are some things you can do to help speed up the process of your PR being merged though.
-In order to speed the process up, you need to know what needs to happen before a committer will actually hit the merge button.
-This section intends to give a little overview and insight of what happens after you create your PR.
-
-### The committer's perspective
-
-PRs have varying quality and even the best people make mistakes.
-It is the role of the committer team to assess whether any PR's changes are good changes or not.
-In order for any PR to be merged, at least one committer needs to be convinced of its quality enough to merge it.
-
-Committers typically assess three aspects of your PR:
-
-1. Whether the change's intention is necessary and desirable
-2. Whether the code quality of your changes is good
-3. Whether the artefacts produced by the code are good
-
-If you want your PR to get merged quickly and smoothly, it is in your best interest to help convince committers in these three aspects.
-
-### How to help committers assess your PR
-
-For the committer to judge your intention, it's best to explain why you've made your change.
-This does not apply to trivial changes like version updates because the intention is obvious (though linking the changelog is appreciated).
-For any more nuanced changes or even major version upgrades, it helps if you explain the background behind your change a bit.
-E.g. if you're adding a package, explain what it is and why it should be in Nixpkgs.
-This goes hand in hand with [Writing good commit messages](#writing-good-commit-messages).
-
-For the code quality assessment, you cannot do anything yourself as only the committer can do this and they already have your code to look at.
-In order to minimise the need for back and forth though, do take a look over your code changes yourself and try to put yourself into the shoes of someone who didn't just write that code.
-Would you immediately know what the code does or why it is needed by glancing at it?
-If not, reviewers will notice this and will ask you to clarify the code by refactoring it and/or adding a few explanations in code comments.
-Doing this preemptively can save you and the committer a lot of time.
-To better convey the "story" of your change, consider dividing your change into multiple atomic commits.
-There is a balance to strike however: over-fragmentation causes friction.
-
-The code artefacts are the hardest for committers to assess because PRs touch all sorts of components: applications, libraries, NixOS modules, editor plugins and many many other things.
-Any individual committer can only really assess components that they themselves know how to use however and yet they must still be convinced somehow.
-There isn't a good generic solution to this but there are some ways easing the committer's job here:
-
-- Provide smoke tests that the committer can run without much research or setup.
-
-  Committers usually don't have the time or interest to learn how your component works and how they could test its functionality.
-  If you can provide a quick guide on how to use the component in a meaningful way or a ready-made command that demonstrates that the component works as expected, the committer can easily convince themselves that your change is good.
-  If it can be automated, you could even turn this smoke test into an automated NixOS test which reviewers could simply run via Nix.
-- Invite other users of the component to try it out and report their findings.
-
-  If a committer sees the testimonials of other users trying your change and it works as expected for them, that too can convince the committer of your PR's quality.
-- Describe what you have done to test your PR.
-
-  If you can convince the committer that you have done sufficient quality assurance on your changes and they trust your report, this too can convince them of your PR's quality, albeit not as strongly as the methods above.
-- Become a maintainer of the component.
-
-  This isn't something you can do on your first few PRs touching a component but listed maintainers generally receive more trust when it comes to changes to their maintained components and committers may opt to merge changes without deeper review when they see they're done by their respective maintainer.
-
-Even if you adhere to all of these recommendations, it is still quite possible for your PR to be forgotten or abandoned by any given committer.
-Please remain mindful of the fact that they are doing this on their own volition and unpaid in their free time and therefore [owe you nothing](https://mikemcquaid.com/open-source-maintainers-owe-you-nothing/).
-Causing a stink in such a situation is a surefire way to get any other potential committer to not want to look at your PR either.
-Ask them nicely whether they still intend to review your PR and find yourself another committer to look at your PR if not.
-
-### How can I get a committer to look at my PR?
-
-- Improve skimmability: use a simple descriptive PR title (details go in commit titles) outlining _what_ is done and _why_.
-- Improve discoverability: apply all relevant labels, tick all relevant PR body checkboxes.
-- Wait. Reviewers frequently browse open PRs and may happen to run across yours and take a look.
-- Get non-committers to review/approve. Many committers filter open PRs for low-hanging fruit that are already been reviewed.
-- [@-mention](https://github.blog/news-insights/mention-somebody-they-re-notified/) someone and ask them nicely
-- Post in one of the channels made for this purpose if there has been no activity for at least one week
-  - The current "PRs ready for review" or "PRs already reviewed" threads in the [NixOS Discourse](https://discourse.nixos.org/c/dev/14) (of course choose the one that applies to your situation)
-  - The [Nixpkgs Review Requests Matrix room](https://matrix.to/#/#review-requests:nixos.org).
-
-### CI failed or got stuck on my PR, what do I do?
-
-First ensure that the failure is actually related to your change.
-Sometimes, the CI system simply has a hiccup or the check was broken by someone else before you made your changes.
-Read through the error message; it's usually quite easy to tell whether it is caused by anything you did by checking whether it mentions the component you touched anywhere.
-If it is indeed caused by your change, obviously try to fix it.
-Don't be afraid of asking for advice if you're uncertain how to do that, others have likely fixed such issues dozens of times and can help you out.
-Your PR is unlikely to be merged if it has a known issue and it is the purpose of CI to alert you aswell as reviewers to these issues.
-
-ofBorg builds can often get stuck, particularly in PRs targeting `staging` and in builders for the Darwin platform. Reviewers will know how to handle them or when to ignore them.
-Don't worry about it.
-If there is a build failure however and it happened due to a package related to your change, you need to investigate it of course.
-If ofBorg reveals the build to be broken on some platform and you don't have access to that platform, you should set your package's `meta.broken` accordingly.
-
-When in any doubt, please ask via a comment in your PR or through one of the help channels.
-
-## I received a review on my PR, how do I get it over the finish line?
-
-In the review process, the committer will have left some sort of feedback on your PR.
-They may have immediately approved of your PR or even merged it but the more likely case is that they want you to change a few things or that they require further input.
-
-A reviewer may have taken a look at the code and it looked good to them ("Diff LGTM") but they still need to be convinced of the artefact's quality.
-They might also be waiting on input from other users of the component or its listed maintainer on whether the intention of your PR makes sense for the component.
-If you know of people who could help clarify any of this, please bring the PR to their attention.
-The current state of the PR is frequently not clearly communicated, so please don't hesitate to ask about it if it's unclear to you.
-
-It's also possible for the reviewer to not be convinced that your PR is necessary or that the method you've chose to achieve your intention is the right one.
-
-Please explain your intentions and reasoning to the committer in such a case.
-There may be constraints you had to work with which they're not aware of or qualities of your approach that they didn't immediately notice.
-(If these weren't clear to the reviewer, that's a good sign you should explain them in your commit message or code comments!)
-
-There are some further pitfalls and realities which this section intends to make you aware of.
-
-### Aim to reduce cycles
-
-Please be prepared for it to take a while before the reviewer gets back to you after you respond.
-This is simply the reality of community projects at the scale of Nixpkgs.
-As such, make sure to respond to _all_ feedback, either by applying suggested changes or argue in favor of something else or no change.
-It wastes everyone time waiting for a couple of days just for the reviewer to remind you to address something they asked for.
-
-### A reviewer requested a bunch of insubstantial changes on my PR
-
-The people involved in Nixpkgs care about code quality because, once in Nixpkgs, it needs to be maintained for many years to come.
-It is therefore likely that other people will ask you to do some things in another way or adhere to some standard.
-Sometimes however, they also care a bit too much and may ask you to adhere to a personal preference of theirs.
-It's not always easy to tell which is which and whether the requests are critically important to merging the PR.
-Sometimes another reviewer may also come along with totally different opinions on some points too.
-
-It is convention to mark review comments that are not critical to the PR as nitpicks but this is not always followed.
-As the PR author, you should still take a look at these as they will often reveal best practices and unwritten rules that usually have good reasons behind them and you may want to incorporate them into your modus operandi.
-
-Please keep in mind that reviewers almost always mean well here.
-Their intent is not to denounce your code, they want your code to be as good as it can be.
-Through their experience, they may also take notice of a seemingly insignificant issues that have caused significant burden before.
-
-Sometimes however, they can also get a bit carried away and become too perfectionistic.
-If you feel some of the requests are unreasonable, out of scope, or merely a matter of personal preference, try to nicely remind the reviewers that you may not intend this code to be 100% perfect or that you have different taste in some regards and press them on whether they think that these requests are *critical* to the PR's success.
-
-While we do have a set of [official standards for the Nix community](https://github.com/NixOS/rfcs/), we don't have standards for everything and there are often multiple valid ways to achieve the same goal.
-Unless there are standards forbidding the patterns used in your code or there are serious technical, maintainability or readability issues with your code, you can insist to keep the code the way you made it and disregard the requests.
-Please communicate this clearly though; a simple "I prefer it this way and see no major issue with it" can save you a lot of arguing.
-
-If you are unsure about some change requests, please ask reviewers *why* they requested them.
-This will usually reveal how important they deem it to be and will help educate you about standards, best practices, unwritten rules aswell as preferences people have and why.
-
-Some committers may have stronger opinions on some things and therefore (understandably) may not want to merge your PR if you don't follow their requests.
-It is totally fine to get yourself a second or third opinion in such a case.
-
-### Committers work on a push-basis
-
-It's possible for you to get a review but nothing happens afterwards, even if you reply to review comments.
-A committer not following up on your PR does not necessarily mean they're disinterested or unresponsive, they may have simply forgotten to follow up on it or had some other circumstances preventing them from doing so.
-
-Committers typically handle many other PRs besides yours and it is not realistic for them to keep up with all of them to a degree where they could reasonably remember to follow up on all PRs that they had intended following up upon.
-If someone left an approving review on your PR and didn't merge a few days later, the most likely case is that they simply forgot.
-
-Please see it as your responsibility to actively remind reviewers of your open PRs.
-
-The easiest way to do so is to cause them a Github notification.
-Github notifies people involved in the PR whenever you add a comment to your PR, push your PR or re-request their review.
-Doing any of that will get you people's attention again.
-Everyone deserves proper attention, and yes that includes you!
-However please be mindful that committers can sadly not always give everyone the attention they deserve.
-
-It may very well be the case that you have to do this every time you need the committer to follow up upon your PR.
-Again, this is a community project so please be mindful of people's circumstances here; be nice when requesting reviews again.
-
-It may also be the case that the committer has lost interest or isn't familiar enough with the component you're touching to be comfortable merging your PR.
-They will likely not immediately state that fact however, so please ask for clarification and don't hesitate to find yourself another committer to take a look at your PR.
-
-### Nothing helped
-
-If you followed these guidelines but still got no results or if you feel that you have been wronged in some way, please explicitly reach out to the greater community via its communication channels.
-
-The [NixOS Discourse](https://discourse.nixos.org/) is a great place to do this as it has historically been the asynchronous medium with the greatest concentration of committers and other people who are significantly involved in Nixpkgs.
-There is a dedicated discourse thread [PRs in distress](https://discourse.nixos.org/t/prs-in-distress/3604) where you can link your PR if everything else fails.
-The [Nixpkgs / NixOS contributions Matrix channel](https://matrix.to/#/#dev:nixos.org) is the best synchronous channel with the same qualities.
-
-Please reserve these for cases where you've made a serious effort in trying to get the attention of multiple active committers and provided realistic means for them to assess your PR's quality though.
-As mentioned previously, it is unfortunately perfectly normal for a PR to sit around for weeks on end due to the realities of this being a community project.
-Please don't blow up situations where progress is happening but is merely not going fast enough for your tastes.
-Honking in a traffic jam will not make you go any faster.

COPYING

@@ -1,4 +1,4 @@
-Copyright (c) 2003-2025 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2024 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.md

@@ -1,20 +1,20 @@
 <p align="center">
   <a href="https://nixos.org">
     <picture>
-      <source media="(prefers-color-scheme: light)" srcset="https://nixos.org/logo/nixos-hires.png">
+      <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png">
       <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/master/logo/nixos-white.png">
-      <img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="NixOS logo">
+      <img src="https://raw.githubusercontent.com/NixOS/nixos-homepage/main/public/logo/nixos-hires.png" width="500px" alt="NixOS logo">
     </picture>
   </a>
 </p>
 
 <p align="center">
-  <a href="CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
+  <a href="https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
   <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>
 
 [Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over
-120,000 software packages that can be installed with the
+100,000 software packages that can be installed with the
 [Nix](https://nixos.org/nix/) package manager. It also implements
 [NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
 
@@ -27,7 +27,7 @@
 # Community
 
 * [Discourse Forum](https://discourse.nixos.org/)
-* [Matrix Chat](https://matrix.to/#/#space:nixos.org)
+* [Matrix Chat](https://matrix.to/#/#community:nixos.org)
 * [NixOS Weekly](https://weekly.nixos.org/)
 * [Official wiki](https://wiki.nixos.org/)
 * [Community-maintained list of ways to get in touch](https://wiki.nixos.org/wiki/Get_In_Touch#Chat) (Discord, Telegram, IRC, etc.)
@@ -52,14 +52,14 @@ Nixpkgs and NixOS are built and tested by our continuous integration
 system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 24.11 release](https://hydra.nixos.org/jobset/nixos/release-24.11)
+* [Continuous package builds for the NixOS 24.05 release](https://hydra.nixos.org/jobset/nixos/release-24.05)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 24.11 release](https://hydra.nixos.org/job/nixos/release-24.11/tested#tabs-constituents)
+* [Tests for the NixOS 24.05 release](https://hydra.nixos.org/job/nixos/release-24.05/tested#tabs-constituents)
 
 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are
 met, the Nixpkgs expressions are distributed via [Nix
-channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).
+channels](https://nixos.org/manual/nix/stable/package-management/channels.html).
 
 # Contributing
 
@@ -74,7 +74,7 @@ Community contributions are always welcome through GitHub Issues and
 Pull Requests.
 
 For more information about contributing to the project, please visit
-the [contributing page](CONTRIBUTING.md).
+the [contributing page](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
 
 # Donations
 

ci/OWNERS

@@ -1,468 +0,0 @@
-# This file is used to describe who owns what in this repository.
-# Users/teams will get review requests for PRs that change their files.
-#
-# This file does not replace `meta.maintainers`
-# but is instead used for other things than derivations and modules,
-# like documentation, package sets, and other assets.
-#
-# This file uses the same syntax as the natively supported CODEOWNERS file,
-# see https://help.github.com/articles/about-codeowners/ for documentation.
-# However it comes with some notable differences:
-# - There is no need for user/team listed here to have write access.
-# - No reviews will be requested for PRs that target the wrong base branch.
-#
-# Processing of this file is implemented in workflows/codeowners-v2.yml
-
-# CI
-/.github/*_TEMPLATE*                    @SigmaSquadron
-/.github/workflows                      @NixOS/Security @Mic92 @zowoq @infinisil @azuwis @wolfgangwalther
-/.github/workflows/check-nix-format.yml @infinisil @wolfgangwalther
-/.github/workflows/codeowners-v2.yml    @infinisil @wolfgangwalther
-/.github/workflows/nixpkgs-vet.yml      @infinisil @philiptaron @wolfgangwalther
-/ci                                     @infinisil @philiptaron @NixOS/Security @wolfgangwalther
-/ci/OWNERS                              @infinisil @philiptaron
-
-# Development support
-/.editorconfig @Mic92 @zowoq
-/shell.nix @infinisil @NixOS/Security
-
-# Libraries
-/lib                        @infinisil @hsjobeki
-/lib/systems                @alyssais @ericson2314 @NixOS/stdenv
-/lib/generators.nix         @infinisil @hsjobeki @Profpatsch
-/lib/cli.nix                @infinisil @hsjobeki @Profpatsch
-/lib/debug.nix              @infinisil @hsjobeki @Profpatsch
-/lib/asserts.nix            @infinisil @hsjobeki @Profpatsch
-/lib/path/*                 @infinisil @hsjobeki
-/lib/fileset                @infinisil @hsjobeki
-## Libraries / Module system
-/lib/modules.nix            @infinisil @roberth @hsjobeki
-/lib/types.nix              @infinisil @roberth @hsjobeki
-/lib/options.nix            @infinisil @roberth @hsjobeki
-/lib/tests/modules.sh       @infinisil @roberth @hsjobeki
-/lib/tests/modules          @infinisil @roberth @hsjobeki
-
-# Nixpkgs Internals
-/default.nix                                     @Ericson2314
-/pkgs/top-level/default.nix                      @Ericson2314
-/pkgs/top-level/impure.nix                       @Ericson2314
-/pkgs/top-level/stage.nix                        @Ericson2314
-/pkgs/top-level/splice.nix                       @Ericson2314
-/pkgs/top-level/release-cross.nix                @Ericson2314
-/pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
-/pkgs/stdenv                                     @philiptaron @NixOS/stdenv
-/pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
-/pkgs/stdenv/generic/check-meta.nix              @Ericson2314 @NixOS/stdenv
-/pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
-/pkgs/build-support                              @philiptaron
-/pkgs/build-support/cc-wrapper                   @Ericson2314
-/pkgs/build-support/bintools-wrapper             @Ericson2314
-/pkgs/build-support/setup-hooks                  @Ericson2314
-/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
-/pkgs/by-name/au/auto-patchelf                   @layus
-
-## Format generators/serializers
-/pkgs/pkgs-lib                                   @Stunkymonkey @h7x4
-
-# Nixpkgs build-support
-/pkgs/build-support/writers @lassulus @Profpatsch
-
-# Nixpkgs make-disk-image
-/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
-/nixos/lib/make-disk-image.nix                 @raitobezarius
-
-# Nix, the package manager
-# @raitobezarius is not "code owner", but is listed here to be notified of changes
-# pertaining to the Nix package manager.
-# i.e. no authority over those files.
-pkgs/tools/package-management/nix/                    @NixOS/nix-team @raitobezarius
-nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobezarius
-
-# Nixpkgs documentation
-/maintainers/scripts/db-to-md.sh @jtojnar @ryantm
-/maintainers/scripts/doc @jtojnar @ryantm
-
-# Contributor documentation
-/CONTRIBUTING.md @infinisil
-/.github/PULL_REQUEST_TEMPLATE.md @infinisil
-/doc/contributing/ @infinisil
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
-/lib/README.md @infinisil
-/doc/README.md @infinisil
-/nixos/README.md @infinisil
-/pkgs/README.md @infinisil
-/pkgs/by-name/README.md @infinisil
-/maintainers/README.md @infinisil
-
-# User-facing development documentation
-/doc/development.md @infinisil
-/doc/development @infinisil
-
-# NixOS Internals
-/nixos/default.nix                                    @infinisil
-/nixos/lib/from-env.nix                               @infinisil
-/nixos/lib/eval-config.nix                            @infinisil
-/nixos/modules/misc/ids.nix                           @R-VdP
-/nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
-/nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
-
-# NixOS Render Docs
-/pkgs/by-name/ni/nixos-render-docs @fricklerhandwerk @GetPsyched @hsjobeki
-/doc/redirects.json                @fricklerhandwerk @GetPsyched @hsjobeki
-/nixos/doc/manual/redirects.json   @fricklerhandwerk @GetPsyched @hsjobeki
-
-# NixOS integration test driver
-/nixos/lib/test-driver  @tfc
-
-# NixOS QEMU virtualisation
-/nixos/modules/virtualisation/qemu-vm.nix           @raitobezarius
-
-# ACME
-/nixos/modules/security/acme                @NixOS/acme
-
-# Systemd
-/nixos/modules/system/boot/systemd.nix      @NixOS/systemd
-/nixos/modules/system/boot/systemd          @NixOS/systemd
-/nixos/lib/systemd-*.nix                    @NixOS/systemd
-/pkgs/os-specific/linux/systemd             @NixOS/systemd
-
-# Systemd-boot
-/nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
-
-# Limine
-/nixos/modules/system/boot/loader/limine        @lzcunt @phip1611 @programmerlexi
-
-# Images and installer media
-/nixos/modules/profiles/installation-device.nix @ElvishJerricco
-/nixos/modules/installer/cd-dvd/                @ElvishJerricco
-/nixos/modules/installer/sd-card/
-
-# Amazon
-/nixos/modules/virtualisation/amazon-init.nix                  @arianvp
-/nixos/modules/virtualisation/ec2-data.nix                     @arianvp
-/nixos/modules/virtualisation/amazon-options.nix               @arianvp
-/nixos/modules/virtualisation/amazon-image.nix                 @arianvp
-/nixos/maintainers/scripts/ec2/                                @arianvp
-/nixos/modules/services/misc/amazon-ssm-agent.nix              @arianvp
-/nixos/tests/amazon-ssm-agent.nix                              @arianvp
-/nixos/modules/system/boot/grow-partition.nix                  @arianvp
-/nixos/modules/services/monitoring/amazon-cloudwatch-agent.nix @philipmw
-/nixos/tests/amazon-cloudwatch-agent.nix                       @philipmw
-
-# Monitoring
-/nixos/modules/services/monitoring/fluent-bit.nix @arianvp
-/nixos/tests/fluent-bit.nix                       @arianvp
-
-# nixos-rebuild-ng
-/pkgs/by-name/ni/nixos-rebuild-ng                 @thiagokokada
-
-# Updaters
-## update.nix
-/maintainers/scripts/update.nix   @jtojnar
-/maintainers/scripts/update.py    @jtojnar
-## common-updater-scripts
-/pkgs/common-updater/scripts/update-source-version    @jtojnar
-
-# Python-related code and docs
-/doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
-/pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
-/pkgs/development/interpreters/python         @mweinelt @natsukium
-/pkgs/top-level/python-packages.nix                     @natsukium
-/pkgs/top-level/release-python.nix                      @natsukium
-
-# Haskell
-/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @wolfgangwalther
-/maintainers/scripts/haskell                  @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/compilers/ghc               @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/haskell-modules             @sternenseemann @maralorn @wolfgangwalther
-/pkgs/test/haskell                            @sternenseemann @maralorn @wolfgangwalther
-/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @wolfgangwalther
-/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @wolfgangwalther
-
-# Perl
-/pkgs/development/interpreters/perl @stigtsp @zakame @marcusramberg
-/pkgs/top-level/perl-packages.nix   @stigtsp @zakame @marcusramberg
-/pkgs/development/perl-modules      @stigtsp @zakame @marcusramberg
-
-# R
-/pkgs/applications/science/math/R   @jbedo
-/pkgs/development/r-modules         @jbedo
-
-# Rust
-/pkgs/development/compilers/rust @alyssais @Mic92 @zowoq @winterqt @figsoda
-/pkgs/build-support/rust @zowoq @winterqt @figsoda
-/pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
-/doc/languages-frameworks/rust.section.md @zowoq @winterqt @figsoda
-
-# Tcl
-/pkgs/development/interpreters/tcl  @fgaz
-/pkgs/development/libraries/tk      @fgaz
-/pkgs/top-level/tcl-packages.nix    @fgaz
-/pkgs/development/tcl-modules       @fgaz
-/doc/languages-frameworks/tcl.section.md @fgaz
-
-# C compilers
-/pkgs/development/compilers/gcc
-/pkgs/development/compilers/llvm @alyssais @RossComputerGuy @NixOS/llvm
-/pkgs/development/compilers/emscripten @raitobezarius
-/doc/languages-frameworks/emscripten.section.md @raitobezarius
-
-# Audio
-/nixos/modules/services/audio/botamusique.nix @mweinelt
-/nixos/modules/services/audio/snapserver.nix @mweinelt
-/nixos/tests/botamusique.nix @mweinelt
-/nixos/tests/snapcast.nix @mweinelt
-
-# Browsers
-/pkgs/applications/networking/browsers/firefox @mweinelt
-/pkgs/applications/networking/browsers/chromium @emilylange @networkException
-/nixos/tests/chromium.nix @emilylange @networkException
-
-# Certificate Authorities
-pkgs/by-name/ca/cacert @ajs124 @lukegb @mweinelt
-pkgs/development/libraries/nss/ @ajs124 @lukegb @mweinelt
-pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
-
-# Java
-/doc/languages-frameworks/java.section.md @NixOS/java
-/doc/languages-frameworks/gradle.section.md @NixOS/java
-/doc/languages-frameworks/maven.section.md @NixOS/java
-/nixos/modules/programs/java.nix @NixOS/java
-/pkgs/top-level/java-packages.nix @NixOS/java
-
-# Jetbrains
-/pkgs/applications/editors/jetbrains @edwtjo @leona-ya @theCapypara
-
-# Licenses
-/lib/licenses.nix @alyssais
-
-# Qt
-/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# KDE / Plasma 5
-/pkgs/applications/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/desktops/plasma-5 @K900 @NickCao @SuperSandro2000 @ttuegel
-/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# KDE / Plasma 6
-/pkgs/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
-
-# PostgreSQL and related stuff
-/pkgs/by-name/ps/psqlodbc @NixOS/postgres
-/pkgs/servers/sql/postgresql @NixOS/postgres
-/pkgs/development/tools/rust/cargo-pgrx @NixOS/postgres
-/nixos/modules/services/databases/postgresql.md @NixOS/postgres
-/nixos/modules/services/databases/postgresql.nix @NixOS/postgres
-/nixos/tests/postgresql @NixOS/postgres
-
-# MySQL/MariaDB and related stuff
-/nixos/modules/services/databases/mysql.nix     @6543
-/nixos/modules/services/backup/mysql-backup.nix @6543
-
-# Hardened profile & related modules
-/nixos/modules/profiles/hardened.nix                       @joachifm
-/nixos/modules/security/lock-kernel-modules.nix            @joachifm
-/nixos/modules/security/misc.nix                           @joachifm
-/nixos/tests/hardened.nix                                  @joachifm
-/pkgs/os-specific/linux/kernel/hardened/        @fabianhjr @joachifm
-
-# Home Automation
-/nixos/modules/services/home-automation/home-assistant.nix @mweinelt
-/nixos/modules/services/home-automation/zigbee2mqtt.nix @mweinelt
-/nixos/tests/home-assistant.nix @mweinelt
-/nixos/tests/zigbee2mqtt.nix @mweinelt
-/pkgs/servers/home-assistant @mweinelt
-/pkgs/by-name/es/esphome @mweinelt
-
-# Network Time Daemons
-/pkgs/by-name/ch/chrony @thoughtpolice
-/pkgs/by-name/nt/ntp @thoughtpolice
-/pkgs/by-name/op/openntpd @thoughtpolice
-/nixos/modules/services/networking/ntp @thoughtpolice
-
-# Network
-/pkgs/by-name/ke/kea @mweinelt
-/pkgs/by-name/ba/babeld @mweinelt
-/nixos/modules/services/networking/babeld.nix @mweinelt
-/nixos/modules/services/networking/kea.nix @mweinelt
-/nixos/modules/services/networking/knot.nix @mweinelt
-/nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
-/nixos/tests/babeld.nix @mweinelt
-/nixos/tests/kea.nix @mweinelt
-/nixos/tests/knot.nix @mweinelt
-
-# Web servers
-/doc/packages/nginx.section.md @raitobezarius
-/pkgs/servers/http/nginx/ @raitobezarius
-/nixos/modules/services/web-servers/nginx/ @raitobezarius
-
-# D
-/pkgs/build-support/dlang @jtbx @TomaSajt
-
-# Dhall
-/pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
-/pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry
-
-# Idris
-/pkgs/development/idris-modules @Infinisil
-/pkgs/development/compilers/idris2 @mattpolzin
-
-# Bazel
-/pkgs/development/tools/build-managers/bazel @Profpatsch
-
-# NixOS modules for e-mail and dns services
-/nixos/modules/services/mail/mailman.nix    @peti
-/nixos/modules/services/mail/postfix.nix    @peti
-/nixos/modules/services/networking/bind.nix @peti
-/nixos/modules/services/mail/rspamd.nix     @peti
-
-# Emacs
-/pkgs/applications/editors/emacs/elisp-packages @NixOS/emacs
-/pkgs/applications/editors/emacs                @NixOS/emacs
-/pkgs/top-level/emacs-packages.nix              @NixOS/emacs
-/doc/packages/emacs.section.md                  @NixOS/emacs
-/nixos/modules/services/editors/emacs.md        @NixOS/emacs
-
-# Kakoune
-/pkgs/applications/editors/kakoune     @philiptaron
-
-# LuaPackages
-/pkgs/development/lua-modules         @NixOS/lua
-
-# Neovim
-/pkgs/applications/editors/neovim      @NixOS/neovim
-
-# VimPlugins
-/pkgs/applications/editors/vim/plugins         @NixOS/neovim
-
-# VsCode Extensions
-/pkgs/applications/editors/vscode/extensions
-
-# PHP interpreter, packages, extensions, tests and documentation
-/doc/languages-frameworks/php.section.md          @aanderse @drupol @globin @ma27 @talyz
-/nixos/tests/php                                  @aanderse @drupol @globin @ma27 @talyz
-/pkgs/build-support/php/build-pecl.nix            @aanderse @drupol @globin @ma27 @talyz
-/pkgs/build-support/php                                     @drupol
-/pkgs/development/interpreters/php       @jtojnar @aanderse @drupol @globin @ma27 @talyz
-/pkgs/development/php-packages                    @aanderse @drupol @globin @ma27 @talyz
-/pkgs/top-level/php-packages.nix         @jtojnar @aanderse @drupol @globin @ma27 @talyz
-
-# Docker tools
-/pkgs/build-support/docker                   @roberth
-/nixos/tests/docker-tools*                   @roberth
-/doc/build-helpers/images/dockertools.section.md  @roberth
-
-# Blockchains
-/pkgs/applications/blockchains  @mmahut @RaghavSood
-
-# Go
-/doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92 @zowoq
-/pkgs/build-support/go @kalbasit @katexochen @Mic92 @zowoq
-/pkgs/development/compilers/go @kalbasit @katexochen @Mic92 @zowoq
-
-# GNOME
-/pkgs/desktops/gnome                              @jtojnar
-/pkgs/desktops/gnome/extensions                   @jtojnar
-/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
-
-# Cinnamon
-/pkgs/by-name/ci/cinnamon-*    @mkg20001
-/pkgs/by-name/cj/cjs           @mkg20001
-/pkgs/by-name/mu/muffin        @mkg20001
-/pkgs/by-name/ne/nemo          @mkg20001
-/pkgs/by-name/ne/nemo-*        @mkg20001
-
-# Xfce
-/doc/hooks/xfce4-dev-tools.section.md @NixOS/xfce
-
-# nim
-/doc/languages-frameworks/nim.section.md  @ehmry
-/pkgs/build-support/build-nim-package.nix @ehmry
-/pkgs/build-support/build-nim-sbom.nix    @ehmry
-/pkgs/top-level/nim-overrides.nix         @ehmry
-
-# terraform providers
-/pkgs/applications/networking/cluster/terraform-providers @zowoq
-
-# Forgejo
-nixos/modules/services/misc/forgejo.nix @adamcstephens @bendlas @emilylange
-pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
-
-# Dotnet
-/pkgs/build-support/dotnet                  @corngood
-/pkgs/development/compilers/dotnet          @corngood
-/pkgs/test/dotnet                           @corngood
-/doc/languages-frameworks/dotnet.section.md @corngood
-
-# Node.js
-/pkgs/build-support/node/build-npm-package      @winterqt
-/pkgs/build-support/node/fetch-npm-deps         @winterqt
-/doc/languages-frameworks/javascript.section.md @winterqt
-/pkgs/development/tools/pnpm                    @Scrumplex @gepbird
-
-# OCaml
-/pkgs/build-support/ocaml           @ulrikstrid
-/pkgs/development/compilers/ocaml   @ulrikstrid
-/pkgs/development/ocaml-modules     @ulrikstrid
-
-# ZFS
-/nixos/modules/tasks/filesystems/zfs.nix @adamcstephens @amarshall
-/nixos/tests/zfs.nix                     @adamcstephens @amarshall
-/pkgs/os-specific/linux/zfs              @adamcstephens @amarshall
-
-# Zig
-/pkgs/development/compilers/zig @figsoda @RossComputerGuy
-/doc/hooks/zig.section.md       @figsoda @RossComputerGuy
-
-# Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
-nixos/tests/buildbot.nix                               @Mic92 @zowoq
-pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
-
-# Pretix
-pkgs/by-name/pr/pretix/ @mweinelt
-pkgs/by-name/pr/pretalx/ @mweinelt
-nixos/modules/services/web-apps/pretix.nix @mweinelt
-nixos/modules/services/web-apps/pretalx.nix @mweinelt
-nixos/tests/web-apps/pretix.nix @mweinelt
-nixos/tests/web-apps/pretalx.nix @mweinelt
-
-# incus/lxc
-nixos/maintainers/scripts/incus/        @adamcstephens
-nixos/modules/virtualisation/incus.nix  @adamcstephens
-nixos/modules/virtualisation/lxc*       @adamcstephens
-nixos/tests/incus/                      @adamcstephens
-pkgs/by-name/in/incus/                  @adamcstephens
-pkgs/by-name/lx/lxc*                    @adamcstephens
-
-# ExpidusOS, Flutter
-/pkgs/development/compilers/flutter @RossComputerGuy
-/pkgs/desktops/expidus              @RossComputerGuy
-
-# GNU Tar & Zip
-/pkgs/tools/archivers/gnutar        @RossComputerGuy
-/pkgs/by-name/zi/zip           @RossComputerGuy
-
-# SELinux
-/pkgs/by-name/ch/checkpolicy @RossComputerGuy
-/pkgs/by-name/li/libselinux  @RossComputerGuy
-/pkgs/by-name/li/libsepol    @RossComputerGuy
-
-# installShellFiles
-/pkgs/by-name/in/installShellFiles/*     @Ericson2314
-/pkgs/test/install-shell-files/*         @Ericson2314
-/doc/hooks/installShellFiles.section.md  @Ericson2314
-
-# Darwin
-/pkgs/by-name/ap/apple-sdk                     @NixOS/darwin-core
-/pkgs/os-specific/darwin/apple-source-releases @NixOS/darwin-core
-/pkgs/stdenv/darwin                            @NixOS/darwin-core
-
-# BEAM
-pkgs/development/beam-modules/          @NixOS/beam
-pkgs/development/interpreters/erlang/   @NixOS/beam
-pkgs/development/interpreters/elixir/   @NixOS/beam
-pkgs/development/interpreters/lfe/      @NixOS/beam

ci/README.md

@@ -1,85 +0,0 @@
-# CI support files
-
-This directory contains files to support CI, such as [GitHub Actions](https://github.com/NixOS/nixpkgs/tree/master/.github/workflows) and [Ofborg](https://github.com/nixos/ofborg).
-This is in contrast with [`maintainers/scripts`](../maintainers/scripts) which is for human use instead.
-
-## Pinned Nixpkgs
-
-CI may need certain packages from Nixpkgs.
-In order to ensure that the needed packages are generally available without building,
-[`pinned-nixpkgs.json`](./pinned-nixpkgs.json) contains a pinned Nixpkgs version tested by Hydra.
-
-Run [`update-pinned-nixpkgs.sh`](./update-pinned-nixpkgs.sh) to update it.
-
-## `ci/nixpkgs-vet.sh BASE_BRANCH [REPOSITORY]`
-
-Runs the [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) on the HEAD commit, closely matching what CI does. This can't do exactly the same as CI, because CI needs to rely on GitHub's server-side Git history to compute the mergeability of PRs before the check can be started.
-In turn, when contributors are running this tool locally, we don't want to have to push commits to test them, and we can also rely on the local Git history to do the mergeability check.
-
-Arguments:
-
-- `BASE_BRANCH`: The base branch to use, e.g. master or release-24.05
-- `REPOSITORY`: The repository from which to fetch the base branch. Defaults to <https://github.com/NixOS/nixpkgs.git>.
-
-## `ci/nixpkgs-vet`
-
-This directory contains scripts and files used and related to [`nixpkgs-vet`](https://github.com/NixOS/nixpkgs-vet/), which the CI uses to implement `pkgs/by-name` checks, along with many other Nixpkgs architecture rules.
-See also the [CI GitHub Action](../.github/workflows/nixpkgs-vet.yml).
-
-## `ci/nixpkgs-vet/update-pinned-tool.sh`
-
-Updates the pinned [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) in [`ci/nixpkgs-vet/pinned-version.txt`](./nixpkgs-vet/pinned-version.txt) to the latest [release](https://github.com/NixOS/nixpkgs-vet/releases).
-
-Each release contains a pre-built `x86_64-linux` version of the tool which is used by CI.
-
-This script currently needs to be called manually when the CI tooling needs to be updated.
-
-Why not just build the tooling right from the PRs Nixpkgs version?
-
-- Because it allows CI to check all PRs, even if they would break the CI tooling.
-- Because it makes the CI check very fast, since no Nix builds need to be done, even for mass rebuilds.
-- Because it improves security, since we don't have to build potentially untrusted code from PRs.
-  The tool only needs a very minimal Nix evaluation at runtime, which can work with [readonly-mode](https://nixos.org/manual/nix/stable/command-ref/opt-common.html#opt-readonly-mode) and [restrict-eval](https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-restrict-eval).
-
-## `get-merge-commit.sh GITHUB_REPO PR_NUMBER`
-
-Check whether a PR is mergeable and return the test merge commit as
-[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests).
-
-Arguments:
-- `GITHUB_REPO`: The repository of the PR, e.g. `NixOS/nixpkgs`
-- `PR_NUMBER`: The PR number, e.g. `1234`
-
-Exit codes:
-- 0: The PR can be merged, the test merge commit hash is returned on stdout
-- 1: The PR cannot be merged because it's not open anymore
-- 2: The PR cannot be merged because it has a merge conflict
-- 3: The merge commit isn't being computed, GitHub is likely having internal issues, unknown if the PR is mergeable
-
-### Usage
-
-This script is implemented as a reusable GitHub Actions workflow, and can be used as follows:
-
-```yaml
-on: pull_request_target
-
-# We need a token to query the API, but it doesn't need any special permissions
-permissions: {}
-
-jobs:
-  get-merge-commit:
-    # use the relative path of the get-merge-commit workflow yaml here
-    uses: ./.github/workflows/get-merge-commit.yml
-
-  build:
-    name: Build
-    runs-on: ubuntu-24.04
-    needs: get-merge-commit
-    steps:
-      - uses: actions/checkout@<VERSION>
-        # Add this to _all_ subsequent steps to skip them
-        if: needs.get-merge-commit.outputs.mergedSha
-        with:
-          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-      - ...
-```

ci/codeowners-validator/default.nix

@@ -1,31 +0,0 @@
-{
-  buildGoModule,
-  fetchFromGitHub,
-  fetchpatch,
-}:
-buildGoModule {
-  name = "codeowners-validator";
-  src = fetchFromGitHub {
-    owner = "mszostok";
-    repo = "codeowners-validator";
-    rev = "f3651e3810802a37bd965e6a9a7210728179d076";
-    hash = "sha256-5aSmmRTsOuPcVLWfDF6EBz+6+/Qpbj66udAmi1CLmWQ=";
-  };
-  patches = [
-    # https://github.com/mszostok/codeowners-validator/pull/222
-    (fetchpatch {
-      name = "user-write-access-check";
-      url = "https://github.com/mszostok/codeowners-validator/compare/f3651e3810802a37bd965e6a9a7210728179d076...840eeb88b4da92bda3e13c838f67f6540b9e8529.patch";
-      hash = "sha256-t3Dtt8SP9nbO3gBrM0nRE7+G6N/ZIaczDyVHYAG/6mU=";
-    })
-    # Undoes part of the above PR: We don't want to require write access
-    # to the repository, that's only needed for GitHub's native CODEOWNERS.
-    # Furthermore, it removes an unneccessary check from the code
-    # that breaks tokens generated for GitHub Apps.
-    ./permissions.patch
-    # Allows setting a custom CODEOWNERS path using the OWNERS_FILE env var
-    ./owners-file-name.patch
-  ];
-  postPatch = "rm -r docs/investigation";
-  vendorHash = "sha256-R+pW3xcfpkTRqfS2ETVOwG8PZr0iH5ewroiF7u8hcYI=";
-}

ci/codeowners-validator/owners-file-name.patch

@@ -1,15 +0,0 @@
-diff --git a/pkg/codeowners/owners.go b/pkg/codeowners/owners.go
-index 6910bd2..e0c95e9 100644
---- a/pkg/codeowners/owners.go
-+++ b/pkg/codeowners/owners.go
-@@ -39,6 +39,10 @@ func NewFromPath(repoPath string) ([]Entry, error) {
- // openCodeownersFile finds a CODEOWNERS file and returns content.
- // see: https://help.github.com/articles/about-code-owners/#codeowners-file-location
- func openCodeownersFile(dir string) (io.Reader, error) {
-+	if file, ok := os.LookupEnv("OWNERS_FILE"); ok {
-+		return fs.Open(file)
-+	}
-+
- 	var detectedFiles []string
- 	for _, p := range []string{".", "docs", ".github"} {
- 		pth := path.Join(dir, p)

ci/codeowners-validator/permissions.patch

@@ -1,36 +0,0 @@
-diff --git a/internal/check/valid_owner.go b/internal/check/valid_owner.go
-index a264bcc..610eda8 100644
---- a/internal/check/valid_owner.go
-+++ b/internal/check/valid_owner.go
-@@ -16,7 +16,6 @@ import (
- const scopeHeader = "X-OAuth-Scopes"
- 
- var reqScopes = map[github.Scope]struct{}{
--	github.ScopeReadOrg: {},
- }
- 
- type ValidOwnerConfig struct {
-@@ -223,10 +222,7 @@ func (v *ValidOwner) validateTeam(ctx context.Context, name string) *validateErr
- 	for _, t := range v.repoTeams {
- 		// GitHub normalizes name before comparison
- 		if strings.EqualFold(t.GetSlug(), team) {
--			if t.Permissions["push"] {
--				return nil
--			}
--			return newValidateError("Team %q cannot review PRs on %q as neither it nor any parent team has write permissions.", team, v.orgRepoName)
-+			return nil
- 		}
- 	}
- 
-@@ -245,10 +241,7 @@ func (v *ValidOwner) validateGitHubUser(ctx context.Context, name string) *valid
- 	for _, u := range v.repoUsers {
- 		// GitHub normalizes name before comparison
- 		if strings.EqualFold(u.GetLogin(), userName) {
--			if u.Permissions["push"] {
--				return nil
--			}
--			return newValidateError("User %q cannot review PRs on %q as they don't have write permissions.", userName, v.orgRepoName)
-+			return nil
- 		}
- 	}
- 

ci/default.nix

@@ -1,73 +0,0 @@
-let
-  pinnedNixpkgs = builtins.fromJSON (builtins.readFile ./pinned-nixpkgs.json);
-in
-{
-  system ? builtins.currentSystem,
-
-  nixpkgs ? null,
-}:
-let
-  nixpkgs' =
-    if nixpkgs == null then
-      fetchTarball {
-        url = "https://github.com/NixOS/nixpkgs/archive/${pinnedNixpkgs.rev}.tar.gz";
-        sha256 = pinnedNixpkgs.sha256;
-      }
-    else
-      nixpkgs;
-
-  pkgs = import nixpkgs' {
-    inherit system;
-    config = { };
-    overlays = [ ];
-  };
-
-  fmt =
-    let
-      treefmtNixSrc = fetchTarball {
-        # Master at 2025-02-12
-        url = "https://github.com/numtide/treefmt-nix/archive/4f09b473c936d41582dd744e19f34ec27592c5fd.tar.gz";
-        sha256 = "051vh6raskrxw5k6jncm8zbk9fhbzgm1gxpq9gm5xw1b6wgbgcna";
-      };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
-        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-        # which creates trees within the Git repository under `.git-rewrite/t`,
-        # notably without having a `.git` themselves.
-        # So if this projectRootFile were the default `.git/config`,
-        # having the auto-rebase script use treefmt on such a tree would make it
-        # format all files in the _parent_ Git tree as well.
-        projectRootFile = ".git-blame-ignore-revs";
-
-        # Be a bit more verbose by default, so we can see progress happening
-        settings.verbose = 1;
-
-        # By default it's info, which is too noisy since we have many unmatched files
-        settings.on-unmatched = "debug";
-
-        # This uses nixfmt-rfc-style underneath,
-        # the default formatter for Nix code.
-        # See https://github.com/NixOS/nixfmt
-        programs.nixfmt.enable = true;
-      };
-      fs = pkgs.lib.fileset;
-      nixFilesSrc = fs.toSource {
-        root = ../.;
-        fileset = fs.difference (fs.unions [
-          (fs.fileFilter (file: file.hasExt "nix") ../.)
-          ../.git-blame-ignore-revs
-        ]) (fs.maybeMissing ../.git);
-      };
-    in
-    {
-      shell = treefmtEval.config.build.devShell;
-      pkg = treefmtEval.config.build.wrapper;
-      check = treefmtEval.config.build.check nixFilesSrc;
-    };
-
-in
-{
-  inherit pkgs fmt;
-  requestReviews = pkgs.callPackage ./request-reviews { };
-  codeownersValidator = pkgs.callPackage ./codeowners-validator { };
-  eval = pkgs.callPackage ./eval { };
-}

ci/eval/README.md

@@ -1,21 +0,0 @@
-# Nixpkgs CI evaluation
-
-The code in this directory is used by the [eval.yml](../../.github/workflows/eval.yml) GitHub Actions workflow to evaluate the majority of Nixpkgs for all PRs, effectively making sure that when the development branches are processed by Hydra, no evaluation failures are encountered.
-
-Furthermore it also allows local evaluation using
-```
-nix-build ci -A eval.full \
-  --max-jobs 4 \
-  --cores 2 \
-  --arg chunkSize 10000 \
-  --arg evalSystems '["x86_64-linux" "aarch64-darwin"]'
-```
-
-- `--max-jobs`: The maximum number of derivations to run at the same time. Only each [supported system](../supportedSystems.nix) gets a separate derivation, so it doesn't make sense to set this higher than that number.
-- `--cores`: The number of cores to use for each job. Recommended to set this to the amount of cores on your system divided by `--max-jobs`.
-- `chunkSize`: The number of attributes that are evaluated simultaneously on a single core. Lowering this decreases memory usage at the cost of increased evaluation time. If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.
-- `evalSystems`: The set of systems for which `nixpkgs` should be evaluated. Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).
-
-A good default is to set `chunkSize` to 10000, which leads to about 3.6GB max memory usage per core, so suitable for fully utilising machines with 4 cores and 16GB memory, 8 cores and 32GB memory or 16 cores and 64GB memory.
-
-Note that 16GB memory is the recommended minimum, while with less than 8GB memory evaluation time suffers greatly.

ci/eval/compare/default.nix

@@ -1,142 +0,0 @@
-{
-  lib,
-  jq,
-  runCommand,
-  writeText,
-  ...
-}:
-{
-  beforeResultDir,
-  afterResultDir,
-  touchedFilesJson,
-  byName ? false,
-}:
-let
-  /*
-    Derivation that computes which packages are affected (added, changed or removed) between two revisions of nixpkgs.
-    Note: "platforms" are "x86_64-linux", "aarch64-darwin", ...
-
-    ---
-    Inputs:
-    - beforeResultDir, afterResultDir: The evaluation result from before and after the change.
-      They can be obtained by running `nix-build -A ci.eval.full` on both revisions.
-
-    ---
-    Outputs:
-      - changed-paths.json: Various information about the changes:
-        {
-          attrdiff: {
-            added: ["package1"],
-            changed: ["package2", "package3"],
-            removed: ["package4"],
-          },
-          labels: [
-            "10.rebuild-darwin: 1-10",
-            "10.rebuild-linux: 1-10"
-          ],
-          rebuildsByKernel: {
-            darwin: ["package1", "package2"],
-            linux: ["package1", "package2", "package3"]
-          },
-          rebuildCountByKernel: {
-            darwin: 2,
-            linux: 3,
-          },
-          rebuildsByPlatform: {
-            aarch64-darwin: ["package1", "package2"],
-            aarch64-linux: ["package1", "package2"],
-            x86_64-linux: ["package1", "package2", "package3"],
-            x86_64-darwin: ["package1"],
-          },
-        }
-      - step-summary.md: A markdown render of the changes
-
-    ---
-    Implementation details:
-
-    Helper functions can be found in ./utils.nix.
-    Two main "types" are important:
-
-    - `packagePlatformPath`: A string of the form "<PACKAGE_PATH>.<PLATFORM>"
-      Example: "python312Packages.numpy.x86_64-linux"
-
-    - `packagePlatformAttr`: An attrs representation of a packagePlatformPath:
-      Example: { name = "python312Packages.numpy"; platform = "x86_64-linux"; }
-  */
-  inherit (import ./utils.nix { inherit lib; })
-    diff
-    groupByKernel
-    convertToPackagePlatformAttrs
-    groupByPlatform
-    extractPackageNames
-    getLabels
-    ;
-
-  getAttrs =
-    dir:
-    let
-      raw = builtins.readFile "${dir}/outpaths.json";
-      # The file contains Nix paths; we need to ignore them for evaluation purposes,
-      # else there will be a "is not allowed to refer to a store path" error.
-      data = builtins.unsafeDiscardStringContext raw;
-    in
-    builtins.fromJSON data;
-  beforeAttrs = getAttrs beforeResultDir;
-  afterAttrs = getAttrs afterResultDir;
-
-  # Attrs
-  # - keys: "added", "changed" and "removed"
-  # - values: lists of `packagePlatformPath`s
-  diffAttrs = diff beforeAttrs afterAttrs;
-
-  rebuilds = diffAttrs.added ++ diffAttrs.changed;
-  rebuildsPackagePlatformAttrs = convertToPackagePlatformAttrs rebuilds;
-
-  changed-paths =
-    let
-      rebuildsByPlatform = groupByPlatform rebuildsPackagePlatformAttrs;
-      rebuildsByKernel = groupByKernel rebuildsPackagePlatformAttrs;
-      rebuildCountByKernel = lib.mapAttrs (
-        kernel: kernelRebuilds: lib.length kernelRebuilds
-      ) rebuildsByKernel;
-    in
-    writeText "changed-paths.json" (
-      builtins.toJSON {
-        attrdiff = lib.mapAttrs (_: extractPackageNames) diffAttrs;
-        inherit
-          rebuildsByPlatform
-          rebuildsByKernel
-          rebuildCountByKernel
-          ;
-        labels =
-          (getLabels rebuildCountByKernel)
-          # Adds "10.rebuild-*-stdenv" label if the "stdenv" attribute was changed
-          ++ lib.mapAttrsToList (kernel: _: "10.rebuild-${kernel}-stdenv") (
-            lib.filterAttrs (_: kernelRebuilds: kernelRebuilds ? "stdenv") rebuildsByKernel
-          );
-      }
-    );
-
-  maintainers = import ./maintainers.nix {
-    changedattrs = lib.attrNames (lib.groupBy (a: a.name) rebuildsPackagePlatformAttrs);
-    changedpathsjson = touchedFilesJson;
-    inherit byName;
-  };
-in
-runCommand "compare"
-  {
-    nativeBuildInputs = [ jq ];
-    maintainers = builtins.toJSON maintainers;
-    passAsFile = [ "maintainers" ];
-  }
-  ''
-    mkdir $out
-
-    cp ${changed-paths} $out/changed-paths.json
-
-    jq -r -f ${./generate-step-summary.jq} < ${changed-paths} > $out/step-summary.md
-
-    cp "$maintainersPath" "$out/maintainers.json"
-
-    # TODO: Compare eval stats
-  ''

ci/eval/compare/generate-step-summary.jq

@@ -1,30 +0,0 @@
-def truncate(xs; n):
-  if xs | length > n then xs[:n] + ["..."]
-  else xs
-  end;
-
-def itemize_packages(xs):
-  truncate(xs; 2000) |
-    map("- [\(.)](https://search.nixos.org/packages?channel=unstable&show=\(.)&from=0&size=50&sort=relevance&type=packages&query=\(.))")  |
-    join("\n");
-
-def get_title(s; xs):
-  s + " (" + (xs | length | tostring) + ")";
-
-def section(title; xs):
-  "<details> <summary>" + get_title(title; xs) + "</summary>\n\n" + itemize_packages(xs) + "</details>";
-
-def fallback_document(content; n):
-  if content | utf8bytelength > n then
-    get_title("Added packages"; .attrdiff.added) + "\n\n" +
-    get_title("Removed packages"; .attrdiff.removed) + "\n\n" +
-    get_title("Changed packages"; .attrdiff.changed)
-  else content
-  end;
-
-# we truncate the list to stay below the GitHub limit of 1MB per step summary.
-fallback_document(
-  section("Added packages"; .attrdiff.added) + "\n\n" +
-  section("Removed packages"; .attrdiff.removed) + "\n\n" +
-  section("Changed packages"; .attrdiff.changed); 1000 * 1000
-)

ci/eval/compare/maintainers.nix

@@ -1,113 +0,0 @@
-# Almost directly vendored from https://github.com/NixOS/ofborg/blob/5a4e743f192fb151915fcbe8789922fa401ecf48/ofborg/src/maintainers.nix
-{
-  changedattrs,
-  changedpathsjson,
-  byName ? false,
-}:
-let
-  pkgs = import ../../.. {
-    system = "x86_64-linux";
-    config = { };
-    overlays = [ ];
-  };
-  inherit (pkgs) lib;
-
-  changedpaths = builtins.fromJSON (builtins.readFile changedpathsjson);
-
-  anyMatchingFile =
-    filename: builtins.any (changed: lib.strings.hasSuffix changed filename) changedpaths;
-
-  anyMatchingFiles = files: builtins.any anyMatchingFile files;
-
-  enrichedAttrs = builtins.map (name: {
-    path = lib.splitString "." name;
-    name = name;
-  }) changedattrs;
-
-  validPackageAttributes = builtins.filter (
-    pkg:
-    if (lib.attrsets.hasAttrByPath pkg.path pkgs) then
-      (
-        let
-          value = lib.attrsets.attrByPath pkg.path null pkgs;
-        in
-        if (builtins.tryEval value).success then
-          if value != null then true else builtins.trace "${pkg.name} exists but is null" false
-        else
-          builtins.trace "Failed to access ${pkg.name} even though it exists" false
-      )
-    else
-      builtins.trace "Failed to locate ${pkg.name}." false
-  ) enrichedAttrs;
-
-  attrsWithPackages = builtins.map (
-    pkg: pkg // { package = lib.attrsets.attrByPath pkg.path null pkgs; }
-  ) validPackageAttributes;
-
-  attrsWithMaintainers = builtins.map (
-    pkg:
-    let
-      meta = pkg.package.meta or { };
-    in
-    pkg
-    // {
-      # TODO: Refactor this so we can ping entire teams instead of the individual members.
-      # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
-      maintainers =
-        meta.maintainers or [ ]
-        ++ lib.flatten (map (team: team.members or [ ]) (meta.teams or [ ]));
-    }
-  ) attrsWithPackages;
-
-  relevantFilenames =
-    drv:
-    (lib.lists.unique (
-      builtins.map (pos: lib.strings.removePrefix (toString ../..) pos.file) (
-        builtins.filter (x: x != null) [
-          (builtins.unsafeGetAttrPos "maintainers" (drv.meta or { }))
-          (builtins.unsafeGetAttrPos "src" drv)
-          # broken because name is always set by stdenv:
-          #    # A hack to make `nix-env -qa` and `nix search` ignore broken packages.
-          #    # TODO(@oxij): remove this assert when something like NixOS/nix#1771 gets merged into nix.
-          #    name = assert validity.handled; name + lib.optionalString
-          #(builtins.unsafeGetAttrPos "name" drv)
-          (builtins.unsafeGetAttrPos "pname" drv)
-          (builtins.unsafeGetAttrPos "version" drv)
-
-          # Use ".meta.position" for cases when most of the package is
-          # defined in a "common" section and the only place where
-          # reference to the file with a derivation the "pos"
-          # attribute.
-          #
-          # ".meta.position" has the following form:
-          #   "pkgs/tools/package-management/nix/default.nix:155"
-          # We transform it to the following:
-          #   { file = "pkgs/tools/package-management/nix/default.nix"; }
-          { file = lib.head (lib.splitString ":" (drv.meta.position or "")); }
-        ]
-      )
-    ));
-
-  attrsWithFilenames = builtins.map (
-    pkg: pkg // { filenames = relevantFilenames pkg.package; }
-  ) attrsWithMaintainers;
-
-  attrsWithModifiedFiles = builtins.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
-
-  listToPing = lib.concatMap (
-    pkg:
-    builtins.map (maintainer: {
-      id = maintainer.githubId;
-      inherit (maintainer) github;
-      packageName = pkg.name;
-      dueToFiles = pkg.filenames;
-    }) pkg.maintainers
-  ) attrsWithModifiedFiles;
-
-  byMaintainer = lib.groupBy (ping: toString ping.${if byName then "github" else "id"}) listToPing;
-
-  packagesPerMaintainer = lib.attrsets.mapAttrs (
-    maintainer: packages: builtins.map (pkg: pkg.packageName) packages
-  ) byMaintainer;
-in
-packagesPerMaintainer

ci/eval/compare/utils.nix

@@ -1,238 +0,0 @@
-{ lib, ... }:
-rec {
-  # Borrowed from https://github.com/NixOS/nixpkgs/pull/355616
-  uniqueStrings = list: builtins.attrNames (builtins.groupBy lib.id list);
-
-  /*
-    Converts a `packagePlatformPath` into a `packagePlatformAttr`
-
-    Turns
-      "hello.aarch64-linux"
-    into
-      {
-        name = "hello";
-        packagePath = [ "hello" ];
-        platform = "aarch64-linux";
-      }
-  */
-  convertToPackagePlatformAttr =
-    packagePlatformPath:
-    let
-      # python312Packages.numpy.aarch64-linux -> ["python312Packages" "numpy" "aarch64-linux"]
-      splittedPath = lib.splitString "." packagePlatformPath;
-
-      # ["python312Packages" "numpy" "aarch64-linux"] -> ["python312Packages" "numpy"]
-      packagePath = lib.sublist 0 (lib.length splittedPath - 1) splittedPath;
-
-      # "python312Packages.numpy"
-      name = lib.concatStringsSep "." packagePath;
-    in
-    if name == "" then
-      null
-    else
-      {
-        # [ "python312Packages" "numpy" ]
-        inherit packagePath;
-
-        # python312Packages.numpy
-        inherit name;
-
-        # "aarch64-linux"
-        platform = lib.last splittedPath;
-      };
-
-  /*
-    Converts a list of `packagePlatformPath`s into a list of `packagePlatformAttr`s
-
-    Turns
-      [
-        "hello.aarch64-linux"
-        "hello.x86_64-linux"
-        "hello.aarch64-darwin"
-        "hello.x86_64-darwin"
-        "bye.x86_64-darwin"
-        "bye.aarch64-darwin"
-        "release-checks"  <- Will be dropped
-      ]
-    into
-      [
-        { name = "hello"; platform = "aarch64-linux"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "x86_64-linux"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "aarch64-darwin"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "x86_64-darwin"; packagePath = [ "hello" ]; }
-        { name = "bye"; platform = "aarch64-darwin"; packagePath = [ "hello" ]; }
-        { name = "bye"; platform = "x86_64-darwin"; packagePath = [ "hello" ]; }
-      ]
-  */
-  convertToPackagePlatformAttrs =
-    packagePlatformPaths:
-    builtins.filter (x: x != null) (builtins.map convertToPackagePlatformAttr packagePlatformPaths);
-
-  /*
-    Converts a list of `packagePlatformPath`s directly to a list of (unique) package names
-
-    Turns
-      [
-        "hello.aarch64-linux"
-        "hello.x86_64-linux"
-        "hello.aarch64-darwin"
-        "hello.x86_64-darwin"
-        "bye.x86_64-darwin"
-        "bye.aarch64-darwin"
-      ]
-    into
-      [
-        "hello"
-        "bye"
-      ]
-  */
-  extractPackageNames =
-    packagePlatformPaths:
-    let
-      packagePlatformAttrs = convertToPackagePlatformAttrs (uniqueStrings packagePlatformPaths);
-    in
-    uniqueStrings (builtins.map (p: p.name) packagePlatformAttrs);
-
-  /*
-    Computes the key difference between two attrs
-
-    {
-      added: [ <keys only in the second object> ],
-      removed: [ <keys only in the first object> ],
-      changed: [ <keys with different values between the two objects> ],
-    }
-  */
-  diff =
-    let
-      filterKeys = cond: attrs: lib.attrNames (lib.filterAttrs cond attrs);
-    in
-    old: new: {
-      added = filterKeys (n: _: !(old ? ${n})) new;
-      removed = filterKeys (n: _: !(new ? ${n})) old;
-      changed = filterKeys (
-        n: v:
-        # Filter out attributes that don't exist anymore
-        (new ? ${n})
-
-        # Filter out attributes that are the same as the new value
-        && (v != (new.${n}))
-      ) old;
-    };
-
-  /*
-    Group a list of `packagePlatformAttr`s by platforms
-
-    Turns
-      [
-        { name = "hello"; platform = "aarch64-linux"; ... }
-        { name = "hello"; platform = "x86_64-linux"; ... }
-        { name = "hello"; platform = "aarch64-darwin"; ... }
-        { name = "hello"; platform = "x86_64-darwin"; ... }
-        { name = "bye"; platform = "aarch64-darwin"; ... }
-        { name = "bye"; platform = "x86_64-darwin"; ... }
-      ]
-    into
-      {
-        aarch64-linux = [ "hello" ];
-        x86_64-linux = [ "hello" ];
-        aarch64-darwin = [ "hello" "bye" ];
-        x86_64-darwin = [ "hello" "bye" ];
-      }
-  */
-  groupByPlatform =
-    packagePlatformAttrs:
-    let
-      packagePlatformAttrsByPlatform = builtins.groupBy (p: p.platform) packagePlatformAttrs;
-      extractPackageNames = map (p: p.name);
-    in
-    lib.mapAttrs (_: extractPackageNames) packagePlatformAttrsByPlatform;
-
-  # Turns
-  # [
-  #   { name = "hello"; platform = "aarch64-linux"; ... }
-  #   { name = "hello"; platform = "x86_64-linux"; ... }
-  #   { name = "hello"; platform = "aarch64-darwin"; ... }
-  #   { name = "hello"; platform = "x86_64-darwin"; ... }
-  #   { name = "bye"; platform = "aarch64-darwin"; ... }
-  #   { name = "bye"; platform = "x86_64-darwin"; ... }
-  # ]
-  #
-  # into
-  #
-  # {
-  #   linux = [ "hello" ];
-  #   darwin = [ "hello" "bye" ];
-  # }
-  groupByKernel =
-    packagePlatformAttrs:
-    let
-      filterKernel =
-        kernel:
-        builtins.attrNames (
-          builtins.groupBy (p: p.name) (
-            builtins.filter (p: lib.hasSuffix kernel p.platform) packagePlatformAttrs
-          )
-        );
-    in
-    lib.genAttrs [ "linux" "darwin" ] filterKernel;
-
-  /*
-    Maps an attrs of `kernel - rebuild counts` mappings to a list of labels
-
-    Turns
-      {
-        linux = 56;
-        darwin = 1;
-      }
-    into
-      [
-        "10.rebuild-darwin: 1"
-        "10.rebuild-darwin: 1-10"
-        "10.rebuild-linux: 11-100"
-      ]
-  */
-  getLabels =
-    rebuildCountByKernel:
-    lib.concatLists (
-      lib.mapAttrsToList (
-        kernel: rebuildCount:
-        let
-          numbers =
-            if rebuildCount == 0 then
-              [ "0" ]
-            else if rebuildCount == 1 then
-              [
-                "1"
-                "1-10"
-              ]
-            else if rebuildCount <= 10 then
-              [ "1-10" ]
-            else if rebuildCount <= 100 then
-              [ "11-100" ]
-            else if rebuildCount <= 500 then
-              [ "101-500" ]
-            else if rebuildCount <= 1000 then
-              [
-                "501-1000"
-                "501+"
-              ]
-            else if rebuildCount <= 2500 then
-              [
-                "1001-2500"
-                "501+"
-              ]
-            else if rebuildCount <= 5000 then
-              [
-                "2501-5000"
-                "501+"
-              ]
-            else
-              [
-                "5001+"
-                "501+"
-              ];
-        in
-        lib.forEach numbers (number: "10.rebuild-${kernel}: ${number}")
-      ) rebuildCountByKernel
-    );
-}

ci/eval/default.nix

@@ -1,302 +0,0 @@
-{
-  lib,
-  runCommand,
-  writeShellScript,
-  writeText,
-  linkFarm,
-  time,
-  procps,
-  nixVersions,
-  jq,
-  sta,
-}:
-
-let
-  nixpkgs =
-    with lib.fileset;
-    toSource {
-      root = ../..;
-      fileset = unions (
-        map (lib.path.append ../..) [
-          "default.nix"
-          "doc"
-          "lib"
-          "maintainers"
-          "nixos"
-          "pkgs"
-          ".version"
-          "ci/supportedSystems.nix"
-        ]
-      );
-    };
-
-  nix = nixVersions.nix_2_24;
-
-  supportedSystems = import ../supportedSystems.nix;
-
-  attrpathsSuperset =
-    runCommand "attrpaths-superset.json"
-      {
-        src = nixpkgs;
-        nativeBuildInputs = [
-          nix
-          time
-        ];
-        env.supportedSystems = builtins.toJSON supportedSystems;
-        passAsFile = [ "supportedSystems" ];
-      }
-      ''
-        export NIX_STATE_DIR=$(mktemp -d)
-        mkdir $out
-        export GC_INITIAL_HEAP_SIZE=4g
-        command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
-          nix-instantiate --eval --strict --json --show-trace \
-            "$src/pkgs/top-level/release-attrpaths-superset.nix" \
-            -A paths \
-            -I "$src" \
-            --option restrict-eval true \
-            --option allow-import-from-derivation false \
-            --arg enableWarnings false > $out/paths.json
-        mv "$supportedSystemsPath" $out/systems.json
-      '';
-
-  singleSystem =
-    {
-      # The system to evaluate.
-      # Note that this is intentionally not called `system`,
-      # because `--argstr system` would only be passed to the ci/default.nix file!
-      evalSystem,
-      # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile,
-      # The number of attributes per chunk, see ./README.md for more info.
-      chunkSize,
-      checkMeta ? true,
-      includeBroken ? true,
-      # Whether to just evaluate a single chunk for quick testing
-      quickTest ? false,
-    }:
-    let
-      singleChunk = writeShellScript "single-chunk" ''
-        set -euo pipefail
-        chunkSize=$1
-        myChunk=$2
-        system=$3
-        outputDir=$4
-
-        export NIX_SHOW_STATS=1
-        export NIX_SHOW_STATS_PATH="$outputDir/stats/$myChunk"
-        echo "Chunk $myChunk on $system start"
-        set +e
-        command time -o "$outputDir/timestats/$myChunk" \
-          -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
-          nix-env -f "${nixpkgs}/pkgs/top-level/release-attrpaths-parallel.nix" \
-          --eval-system "$system" \
-          --option restrict-eval true \
-          --option allow-import-from-derivation false \
-          --query --available \
-          --no-name --attr-path --out-path \
-          --show-trace \
-          --arg chunkSize "$chunkSize" \
-          --arg myChunk "$myChunk" \
-          --arg attrpathFile "${attrpathFile}" \
-          --arg systems "[ \"$system\" ]" \
-          --arg checkMeta ${lib.boolToString checkMeta} \
-          --arg includeBroken ${lib.boolToString includeBroken} \
-          -I ${nixpkgs} \
-          -I ${attrpathFile} \
-          > "$outputDir/result/$myChunk" \
-          2> "$outputDir/stderr/$myChunk"
-        exitCode=$?
-        set -e
-        cat "$outputDir/stderr/$myChunk"
-        cat "$outputDir/timestats/$myChunk"
-        if (( exitCode != 0 )); then
-          echo "Evaluation failed with exit code $exitCode"
-          # This immediately halts all xargs processes
-          kill $PPID
-        elif [[ -s "$outputDir/stderr/$myChunk" ]]; then
-          echo "Nixpkgs on $system evaluated with warnings, aborting"
-          kill $PPID
-        fi
-      '';
-    in
-    runCommand "nixpkgs-eval-${evalSystem}"
-      {
-        nativeBuildInputs = [
-          nix
-          time
-          procps
-          jq
-        ];
-        env = {
-          inherit evalSystem chunkSize;
-        };
-      }
-      ''
-        export NIX_STATE_DIR=$(mktemp -d)
-        nix-store --init
-
-        echo "System: $evalSystem"
-        cores=$NIX_BUILD_CORES
-        echo "Cores: $cores"
-        attrCount=$(jq length "${attrpathFile}")
-        echo "Attribute count: $attrCount"
-        echo "Chunk size: $chunkSize"
-        # Same as `attrCount / chunkSize` but rounded up
-        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-        echo "Chunk count: $chunkCount"
-
-        mkdir $out
-
-        # Record and print stats on free memory and swap in the background
-        (
-          while true; do
-            availMemory=$(free -b | grep Mem | awk '{print $7}')
-            freeSwap=$(free -b | grep Swap | awk '{print $4}')
-            echo "Available memory: $(( availMemory / 1024 / 1024 )) MiB, free swap: $(( freeSwap / 1024 / 1024 )) MiB"
-
-            if [[ ! -f "$out/min-avail-memory" ]] || (( availMemory < $(<$out/min-avail-memory) )); then
-              echo "$availMemory" > $out/min-avail-memory
-            fi
-            if [[ ! -f $out/min-free-swap ]] || (( availMemory < $(<$out/min-free-swap) )); then
-              echo "$freeSwap" > $out/min-free-swap
-            fi
-            sleep 4
-          done
-        ) &
-
-        seq_end=$(( chunkCount - 1 ))
-
-        ${lib.optionalString quickTest ''
-          seq_end=0
-        ''}
-
-        chunkOutputDir=$(mktemp -d)
-        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
-
-        seq -w 0 "$seq_end" |
-          command time -f "%e" -o "$out/total-time" \
-          xargs -I{} -P"$cores" \
-          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
-
-        if (( chunkSize * chunkCount != attrCount )); then
-          # A final incomplete chunk would mess up the stats, don't include it
-          rm "$chunkOutputDir"/stats/"$seq_end"
-        fi
-
-        # Make sure the glob doesn't break when there's no files
-        shopt -s nullglob
-        cat "$chunkOutputDir"/result/* > $out/paths
-        cat "$chunkOutputDir"/stats/* > $out/stats.jsonstream
-      '';
-
-  combine =
-    {
-      resultsDir,
-    }:
-    runCommand "combined-result"
-      {
-        nativeBuildInputs = [
-          jq
-          sta
-        ];
-      }
-      ''
-        mkdir -p $out
-
-        # Transform output paths to JSON
-        cat ${resultsDir}/*/paths |
-          jq --sort-keys --raw-input --slurp '
-            split("\n") |
-            map(select(. != "") | split(" ") | map(select(. != ""))) |
-            map(
-              {
-                key: .[0],
-                value: .[1] | split(";") | map(split("=") |
-                  if length == 1 then
-                    { key: "out", value: .[0] }
-                  else
-                    { key: .[0], value: .[1] }
-                  end) | from_entries}
-            ) | from_entries
-          ' > $out/outpaths.json
-
-        # Computes min, mean, error, etc. for a list of values and outputs a JSON from that
-        statistics() {
-          local stat=$1
-          sta --transpose |
-            jq --raw-input --argjson stat "$stat" -n '
-              [
-                inputs |
-                  split("\t") |
-                  { key: .[0], value: (.[1] | fromjson) }
-              ] |
-                from_entries |
-                {
-                  key: ($stat | join(".")),
-                  value: .
-                }'
-        }
-
-        # Gets all available number stats (without .sizes because those are constant and not interesting)
-        readarray -t stats < <(jq -cs '.[0] | del(.sizes) | paths(type == "number")' ${resultsDir}/*/stats.jsonstream)
-
-        # Combines the statistics from all evaluations
-        {
-          echo "{ \"key\": \"minAvailMemory\", \"value\": $(cat ${resultsDir}/*/min-avail-memory | sta --brief --min) }"
-          echo "{ \"key\": \"minFreeSwap\", \"value\": $(cat ${resultsDir}/*/min-free-swap | sta --brief --min) }"
-          cat ${resultsDir}/*/total-time | statistics '["totalTime"]'
-          for stat in "''${stats[@]}"; do
-            cat ${resultsDir}/*/stats.jsonstream |
-              jq --argjson stat "$stat" 'getpath($stat)' |
-              statistics "$stat"
-          done
-        } |
-          jq -s from_entries > $out/stats.json
-      '';
-
-  compare = import ./compare {
-    inherit
-      lib
-      jq
-      runCommand
-      writeText
-      supportedSystems
-      ;
-  };
-
-  full =
-    {
-      # Whether to evaluate on a specific set of systems, by default all are evaluated
-      evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
-      # The number of attributes per chunk, see ./README.md for more info.
-      chunkSize,
-      quickTest ? false,
-    }:
-    let
-      results = linkFarm "results" (
-        map (evalSystem: {
-          name = evalSystem;
-          path = singleSystem {
-            inherit quickTest evalSystem chunkSize;
-            attrpathFile = attrpathsSuperset + "/paths.json";
-          };
-        }) evalSystems
-      );
-    in
-    combine {
-      resultsDir = results;
-    };
-
-in
-{
-  inherit
-    attrpathsSuperset
-    singleSystem
-    combine
-    compare
-    # The above three are used by separate VMs in a GitHub workflow,
-    # while the below is intended for testing on a single local machine
-    full
-    ;
-}

ci/get-merge-commit.sh

@@ -1,62 +0,0 @@
-#!/usr/bin/env bash
-# See ./README.md for docs
-
-set -euo pipefail
-
-log() {
-    echo "$@" >&2
-}
-
-if (( $# < 2 )); then
-    log "Usage: $0 GITHUB_REPO PR_NUMBER"
-    exit 99
-fi
-repo=$1
-prNumber=$2
-
-# Retry the API query this many times
-retryCount=5
-# Start with 5 seconds, but double every retry
-retryInterval=5
-
-while true; do
-    log "Checking whether the pull request can be merged"
-    prInfo=$(gh api \
-        -H "Accept: application/vnd.github+json" \
-        -H "X-GitHub-Api-Version: 2022-11-28" \
-        "/repos/$repo/pulls/$prNumber")
-
-    # Non-open PRs won't have their mergeability computed no matter what
-    state=$(jq -r .state <<< "$prInfo")
-    if [[ "$state" != open ]]; then
-        log "PR is not open anymore"
-        exit 1
-    fi
-
-    mergeable=$(jq -r .mergeable <<< "$prInfo")
-    if [[ "$mergeable" == "null" ]]; then
-        if (( retryCount == 0 )); then
-            log "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com/"
-            exit 3
-        else
-            (( retryCount -= 1 )) || true
-
-            # null indicates that GitHub is still computing whether it's mergeable
-            # Wait a couple seconds before trying again
-            log "GitHub is still computing whether this PR can be merged, waiting $retryInterval seconds before trying again ($retryCount retries left)"
-            sleep "$retryInterval"
-
-            (( retryInterval *= 2 )) || true
-        fi
-    else
-        break
-    fi
-done
-
-if [[ "$mergeable" == "true" ]]; then
-    log "The PR can be merged"
-    jq -r .merge_commit_sha <<< "$prInfo"
-else
-    log "The PR has a merge conflict"
-    exit 2
-fi

ci/nixpkgs-vet.sh

@@ -1,71 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq
-
-set -o pipefail -o errexit -o nounset
-
-trace() { echo >&2 "$@"; }
-
-tmp=$(mktemp -d)
-cleanup() {
-    # Don't exit early if anything fails to cleanup
-    set +o errexit
-
-    trace -n "Cleaning up.. "
-
-    [[ -e "$tmp/base" ]] && git worktree remove --force "$tmp/base"
-    [[ -e "$tmp/merged" ]] && git worktree remove --force "$tmp/merged"
-
-    rm -rf "$tmp"
-
-    trace "Done"
-}
-trap cleanup exit
-
-
-repo=https://github.com/NixOS/nixpkgs.git
-
-if (( $# != 0 )); then
-    baseBranch=$1
-    shift
-else
-    trace "Usage: $0 BASE_BRANCH [REPOSITORY]"
-    trace "BASE_BRANCH: The base branch to use, e.g. master or release-23.11"
-    trace "REPOSITORY: The repository to fetch the base branch from, defaults to $repo"
-    exit 1
-fi
-
-if (( $# != 0 )); then
-    repo=$1
-    shift
-fi
-
-if [[ -n "$(git status --porcelain)" ]]; then
-    trace -e "\e[33mWarning: Dirty tree, uncommitted changes won't be taken into account\e[0m"
-fi
-headSha=$(git rev-parse HEAD)
-trace -e "Using HEAD commit \e[34m$headSha\e[0m"
-
-trace -n "Creating Git worktree for the HEAD commit in $tmp/merged.. "
-git worktree add --detach -q "$tmp/merged" HEAD
-trace "Done"
-
-trace -n "Fetching base branch $baseBranch to compare against.. "
-git fetch -q "$repo" refs/heads/"$baseBranch"
-baseSha=$(git rev-parse FETCH_HEAD)
-trace -e "\e[34m$baseSha\e[0m"
-
-trace -n "Creating Git worktree for the base branch in $tmp/base.. "
-git worktree add -q "$tmp/base" "$baseSha"
-trace "Done"
-
-trace -n "Merging base branch into the HEAD commit in $tmp/merged.. "
-git -C "$tmp/merged" merge -q --no-edit "$baseSha"
-trace -e "\e[34m$(git -C "$tmp/merged" rev-parse HEAD)\e[0m"
-trace -n "Reading pinned nixpkgs-vet version from pinned-version.txt.. "
-toolVersion=$(<"$tmp/merged/ci/nixpkgs-vet/pinned-version.txt")
-trace -e "\e[34m$toolVersion\e[0m"
-
-trace -n "Building tool.. "
-nix-build https://github.com/NixOS/nixpkgs-vet/tarball/"$toolVersion" -o "$tmp/tool" -A build
-trace "Running nixpkgs-vet.."
-"$tmp/tool/bin/nixpkgs-vet" --base "$tmp/base" "$tmp/merged"

ci/nixpkgs-vet/pinned-version.txt

@@ -1 +0,0 @@
-0.1.4

ci/pinned-nixpkgs.json

@@ -1,4 +0,0 @@
-{
-  "rev": "573c650e8a14b2faa0041645ab18aed7e60f0c9a",
-  "sha256": "0qg99zj0gb0pc6sjlkmwhk1c1xz14qxmk6gamgfmcxpsfdp5vn72"
-}

ci/request-reviews/default.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  makeWrapper,
-  coreutils,
-  codeowners,
-  jq,
-  curl,
-  github-cli,
-  gitMinimal,
-}:
-stdenvNoCC.mkDerivation {
-  name = "request-reviews";
-  src = lib.fileset.toSource {
-    root = ./.;
-    fileset = lib.fileset.unions [
-      ./get-code-owners.sh
-      ./request-reviewers.sh
-      ./request-code-owner-reviews.sh
-      ./verify-base-branch.sh
-      ./dev-branches.txt
-    ];
-  };
-  nativeBuildInputs = [ makeWrapper ];
-  dontBuild = true;
-  installPhase = ''
-    mkdir -p $out/bin
-    mv dev-branches.txt $out/bin
-    for bin in *.sh; do
-      mv "$bin" "$out/bin"
-      wrapProgram "$out/bin/$bin" \
-        --set PATH ${
-          lib.makeBinPath [
-            coreutils
-            codeowners
-            jq
-            curl
-            github-cli
-            gitMinimal
-          ]
-        }
-    done
-  '';
-}

ci/request-reviews/dev-branches.txt

@@ -1,9 +0,0 @@
-# Trusted development branches:
-# These generally require PRs to update and are built by Hydra.
-# Keep this synced with the branches in .github/workflows/eval.yml
-master
-staging
-release-*
-staging-*
-haskell-updates
-python-updates

ci/request-reviews/get-code-owners.sh

@@ -1,97 +0,0 @@
-#!/usr/bin/env bash
-
-# Get the code owners of the files changed by a PR, returning one username per line
-
-set -euo pipefail
-
-log() {
-    echo "$@" >&2
-}
-
-if (( "$#" < 4 )); then
-    log "Usage: $0 GIT_REPO OWNERS_FILE BASE_REF HEAD_REF"
-    exit 1
-fi
-
-gitRepo=$1
-ownersFile=$2
-baseRef=$3
-headRef=$4
-
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-
-git -C "$gitRepo" diff --name-only --merge-base "$baseRef" "$headRef" > "$tmp/touched-files"
-readarray -t touchedFiles < "$tmp/touched-files"
-log "This PR touches ${#touchedFiles[@]} files"
-
-# Get the owners file from the base, because we don't want to allow PRs to
-# remove code owners to avoid pinging them
-git -C "$gitRepo" show "$baseRef":"$ownersFile" > "$tmp"/codeowners
-
-# Associative array with the user as the key for easy de-duplication
-# Make sure to always lowercase keys to avoid duplicates with different casings
-declare -A users=()
-
-for file in "${touchedFiles[@]}"; do
-    result=$(codeowners --file "$tmp"/codeowners "$file")
-
-    # Remove the file prefix and trim the surrounding spaces
-    read -r owners <<< "${result#"$file"}"
-    if [[ "$owners" == "(unowned)" ]]; then
-        log "File $file is unowned"
-        continue
-    fi
-    log "File $file is owned by $owners"
-
-    # Split up multiple owners, separated by arbitrary amounts of spaces
-    IFS=" " read -r -a entries <<< "$owners"
-
-    for entry in "${entries[@]}"; do
-        # GitHub technically also supports Emails as code owners,
-        # but we can't easily support that, so let's not
-        if [[ ! "$entry" =~ @(.*) ]]; then
-            warn -e "\e[33mCodeowner \"$entry\" for file $file is not valid: Must start with \"@\"\e[0m" >&2
-            # Don't fail, because the PR for which this script runs can't fix it,
-            # it has to be fixed in the base branch
-            continue
-        fi
-        # The first regex match is everything after the @
-        entry=${BASH_REMATCH[1]}
-
-        if [[ "$entry" =~ (.*)/(.*) ]]; then
-            # Teams look like $org/$team
-            org=${BASH_REMATCH[1]}
-            team=${BASH_REMATCH[2]}
-
-            # Instead of requesting a review from the team itself,
-            # we request reviews from the individual users.
-            # This is because once somebody from a team reviewed the PR,
-            # the API doesn't expose that the team was already requested for a review,
-            # so we wouldn't be able to avoid rerequesting reviews
-            # without saving some some extra state somewhere
-
-            # We could also consider implementing a more advanced heuristic
-            # in the future that e.g. only pings one team member,
-            # but escalates to somebody else if that member doesn't respond in time.
-            gh api \
-                --cache=1h \
-                -H "Accept: application/vnd.github+json" \
-                -H "X-GitHub-Api-Version: 2022-11-28" \
-                "/orgs/$org/teams/$team/members" \
-                --jq '.[].login' > "$tmp/team-members"
-            readarray -t members < "$tmp/team-members"
-            log "Team $entry has these members: ${members[*]}"
-
-            for user in "${members[@]}"; do
-                users[${user,,}]=
-            done
-        else
-            # Everything else is a user
-            users[${entry,,}]=
-        fi
-    done
-
-done
-
-printf "%s\n" "${!users[@]}"

ci/request-reviews/request-code-owner-reviews.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-
-# Requests reviews for a PR after verifying that the base branch is correct
-
-set -euo pipefail
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-SCRIPT_DIR=$(dirname "$0")
-
-log() {
-    echo "$@" >&2
-}
-
-effect() {
-    if [[ -n "${DRY_MODE:-}" ]]; then
-        log "Skipping in dry mode:" "${@@Q}"
-    else
-        "$@"
-    fi
-}
-
-if (( $# < 3 )); then
-    log "Usage: $0 GITHUB_REPO PR_NUMBER OWNERS_FILE"
-    exit 1
-fi
-baseRepo=$1
-prNumber=$2
-ownersFile=$3
-
-log "Fetching PR info"
-prInfo=$(gh api \
-  -H "Accept: application/vnd.github+json" \
-  -H "X-GitHub-Api-Version: 2022-11-28" \
-  "/repos/$baseRepo/pulls/$prNumber")
-
-baseBranch=$(jq -r .base.ref <<< "$prInfo")
-log "Base branch: $baseBranch"
-prRepo=$(jq -r .head.repo.full_name <<< "$prInfo")
-log "PR repo: $prRepo"
-prBranch=$(jq -r .head.ref <<< "$prInfo")
-log "PR branch: $prBranch"
-prAuthor=$(jq -r .user.login <<< "$prInfo")
-log "PR author: $prAuthor"
-
-extraArgs=()
-if pwdRepo=$(git rev-parse --show-toplevel 2>/dev/null); then
-    # Speedup for local runs
-    extraArgs+=(--reference-if-able "$pwdRepo")
-fi
-
-log "Fetching Nixpkgs commit history"
-# We only need the commit history, not the contents, so we can do a tree-less clone using tree:0
-# https://github.blog/open-source/git/get-up-to-speed-with-partial-clone-and-shallow-clone/#user-content-quick-summary
-git clone --bare --filter=tree:0 --no-tags --origin upstream "${extraArgs[@]}" https://github.com/"$baseRepo".git "$tmp"/nixpkgs.git
-
-log "Fetching the PR commit history"
-# Fetch the PR
-git -C "$tmp/nixpkgs.git" remote add fork https://github.com/"$prRepo".git
-# This remote config is the same as --filter=tree:0 when cloning
-git -C "$tmp/nixpkgs.git" config remote.fork.partialclonefilter tree:0
-git -C "$tmp/nixpkgs.git" config remote.fork.promisor true
-
-git -C "$tmp/nixpkgs.git" fetch --no-tags fork "$prBranch"
-headRef=$(git -C "$tmp/nixpkgs.git" rev-parse refs/remotes/fork/"$prBranch")
-
-log "Checking correctness of the base branch"
-if ! "$SCRIPT_DIR"/verify-base-branch.sh "$tmp/nixpkgs.git" "$headRef" "$baseRepo" "$baseBranch" "$prRepo" "$prBranch" | tee "$tmp/invalid-base-error" >&2; then
-    log "Posting error as comment"
-    if ! response=$(effect gh api \
-        --method POST \
-        -H "Accept: application/vnd.github+json" \
-        -H "X-GitHub-Api-Version: 2022-11-28" \
-        "/repos/$baseRepo/issues/$prNumber/comments" \
-        -F "body=@$tmp/invalid-base-error"); then
-        log "Failed to post the comment: $response"
-    fi
-    exit 1
-fi
-
-log "Requesting reviews from code owners"
-"$SCRIPT_DIR"/get-code-owners.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseBranch" "$headRef" | \
-    "$SCRIPT_DIR"/request-reviewers.sh "$baseRepo" "$prNumber" "$prAuthor"

ci/request-reviews/request-reviewers.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-
-# Request reviewers for a PR, reading line-separated usernames on stdin,
-# filtering for valid reviewers before using the API endpoint to request reviews:
-# https://docs.github.com/en/rest/pulls/review-requests?apiVersion=2022-11-28#request-reviewers-for-a-pull-request
-
-set -euo pipefail
-
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-
-log() {
-    echo "$@" >&2
-}
-
-effect() {
-    if [[ -n "${DRY_MODE:-}" ]]; then
-        log "Skipping in dry mode:" "${@@Q}"
-    else
-        "$@"
-    fi
-}
-
-if (( "$#" < 3 )); then
-    log "Usage: $0 BASE_REPO PR_NUMBER PR_AUTHOR"
-    exit 1
-fi
-
-baseRepo=$1
-prNumber=$2
-prAuthor=$3
-
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-
-declare -A users=()
-while read -r handle && [[ -n "$handle" ]]; do
-    users[${handle,,}]=
-done
-
-# Cannot request a review from the author
-if [[ -v users[${prAuthor,,}] ]]; then
-    log "One or more files are owned by the PR author, ignoring"
-    unset 'users[${prAuthor,,}]'
-fi
-
-gh api \
-    -H "Accept: application/vnd.github+json" \
-    -H "X-GitHub-Api-Version: 2022-11-28" \
-    "/repos/$baseRepo/pulls/$prNumber/reviews" \
-    --jq '.[].user.login' > "$tmp/already-reviewed-by"
-
-# And we don't want to rerequest reviews from people who already reviewed
-while read -r user; do
-    if [[ -v users[${user,,}] ]]; then
-        log "User $user is a potential reviewer, but has already left a review, ignoring"
-        unset 'users[${user,,}]'
-    fi
-done < "$tmp/already-reviewed-by"
-
-for user in "${!users[@]}"; do
-    if ! gh api \
-        -H "Accept: application/vnd.github+json" \
-        -H "X-GitHub-Api-Version: 2022-11-28" \
-        "/repos/$baseRepo/collaborators/$user" >&2; then
-        log "User $user is not a repository collaborator, probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>), ignoring"
-        unset 'users[$user]'
-    fi
-done
-
-if [[ "${#users[@]}" -gt 10 ]]; then
-    log "Too many reviewers (${!users[*]}), skipping review requests"
-    exit 0
-fi
-
-for user in "${!users[@]}"; do
-    log "Requesting review from: $user"
-
-    if ! response=$(jq -n --arg user "$user" '{ reviewers: [ $user ] }' | \
-        effect gh api \
-            --method POST \
-            -H "Accept: application/vnd.github+json" \
-            -H "X-GitHub-Api-Version: 2022-11-28" \
-            "/repos/$baseRepo/pulls/$prNumber/requested_reviewers" \
-            --input -); then
-        log "Failed to request review from $user: $response"
-    fi
-done

ci/request-reviews/verify-base-branch.sh

@@ -1,104 +0,0 @@
-#!/usr/bin/env bash
-
-# Check that a PR doesn't include commits from other development branches.
-# Fails with next steps if it does
-
-set -euo pipefail
-tmp=$(mktemp -d)
-trap 'rm -rf "$tmp"' exit
-SCRIPT_DIR=$(dirname "$0")
-
-log() {
-    echo "$@" >&2
-}
-
-# Small helper to check whether an element is in a list
-# Usage: `elementIn foo "${list[@]}"`
-elementIn() {
-    local e match=$1
-    shift
-    for e; do
-        if [[ "$e" == "$match" ]]; then
-            return 0
-        fi
-    done
-    return 1
-}
-
-if (( $# < 6 )); then
-    log "Usage: $0 LOCAL_REPO HEAD_REF BASE_REPO BASE_BRANCH PR_REPO PR_BRANCH"
-    exit 1
-fi
-localRepo=$1
-headRef=$2
-baseRepo=$3
-baseBranch=$4
-prRepo=$5
-prBranch=$6
-
-# All development branches
-devBranchPatterns=()
-while read -r pattern; do
-    if [[ "$pattern" != '#'* ]]; then
-        devBranchPatterns+=("$pattern")
-    fi
-done < "$SCRIPT_DIR/dev-branches.txt"
-
-git -C "$localRepo" branch --list --format "%(refname:short)" "${devBranchPatterns[@]}" > "$tmp/dev-branches"
-readarray -t devBranches < "$tmp/dev-branches"
-
-if [[ "$baseRepo" == "$prRepo" ]] && elementIn "$prBranch" "${devBranches[@]}"; then
-    log "This PR merges $prBranch into $baseBranch, no commit check necessary"
-    exit 0
-fi
-
-# The current merge base of the PR
-prMergeBase=$(git -C "$localRepo" merge-base "$baseBranch" "$headRef")
-log "The PR's merge base with the base branch $baseBranch is $prMergeBase"
-
-# This is purely for debugging
-git -C "$localRepo" rev-list --reverse "$baseBranch".."$headRef" > "$tmp/pr-commits"
-log "The PR includes these $(wc -l < "$tmp/pr-commits") commits:"
-cat <"$tmp/pr-commits" >&2
-
-for testBranch in "${devBranches[@]}"; do
-
-    if [[ -z "$(git -C "$localRepo" rev-list -1 --since="1 month ago" "$testBranch")" ]]; then
-        log "Not checking $testBranch, was inactive for the last month"
-        continue
-    fi
-    log "Checking if commits from $testBranch are included in the PR"
-
-    # We need to check for any commits that are in the PR which are also in the test branch.
-    # We could check each commit from the PR individually, but that's unnecessarily slow.
-    #
-    # This does _almost_ what we want: `git rev-list --count headRef testBranch ^baseBranch`,
-    # except that it includes commits that are reachable from _either_ headRef or testBranch,
-    # instead of restricting it to ones reachable by both
-
-    # Easily fixable though, because we can use `git merge-base testBranch headRef`
-    # to get the least common ancestor (aka merge base) commit reachable by both.
-    # If the branch being tested is indeed the right base branch,
-    # this is then also the commit from that branch that the PR is based on top of.
-    testMergeBase=$(git -C "$localRepo" merge-base "$testBranch" "$headRef")
-
-    # And then use the `git rev-list --count`, but replacing the non-working
-    # `headRef testBranch` with the merge base of the two.
-    extraCommits=$(git -C "$localRepo" rev-list --count "$testMergeBase" ^"$baseBranch")
-
-    if (( extraCommits != 0 )); then
-        log -e "\e[33m"
-        echo "The PR's base branch is set to $baseBranch, but $extraCommits commits from the $testBranch branch are included. Make sure you know the [right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions), then:"
-        echo "- If the changes should go to the $testBranch branch, [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to $testBranch"
-        echo "- If the changes should go to the $baseBranch branch, rebase your PR onto the merge base with the $baseBranch branch:"
-        echo "  \`\`\`bash"
-        echo "  # git rebase --onto \$(git merge-base upstream/$baseBranch HEAD) \$(git merge-base upstream/$testBranch HEAD)"
-        echo "  git rebase --onto $prMergeBase $testMergeBase"
-        echo "  git push --force-with-lease"
-        echo "  \`\`\`"
-        log -e "\e[m"
-        exit 1
-    fi
-done
-
-log "Base branch is correct, no commits from development branches are included"

ci/supportedSystems.nix

@@ -1,6 +0,0 @@
-[
-  "aarch64-linux"
-  "aarch64-darwin"
-  "x86_64-linux"
-  "x86_64-darwin"
-]

ci/update-pinned-nixpkgs.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq
-
-set -euo pipefail
-
-# https://stackoverflow.com/a/246128
-SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-
-repo=https://github.com/nixos/nixpkgs
-branch=nixpkgs-unstable
-file=$SCRIPT_DIR/pinned-nixpkgs.json
-
-defaultRev=$(git ls-remote "$repo" refs/heads/"$branch" | cut -f1)
-rev=${1:-$defaultRev}
-sha256=$(nix-prefetch-url --unpack "$repo/archive/$rev.tar.gz" --name source)
-
-jq -n --arg rev "$rev" --arg sha256 "$sha256" '$ARGS.named' | tee /dev/stderr > $file

default.nix

@@ -1,8 +1,6 @@
-let
-  requiredVersion = import ./lib/minver.nix;
-in
+let requiredVersion = import ./lib/minver.nix; in
 
-if !builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
+if ! builtins ? nixVersion || builtins.compareVersions requiredVersion builtins.nixVersion == 1 then
 
   abort ''
 

doc/README.md

@@ -2,26 +2,16 @@
 
 This directory houses the sources files for the Nixpkgs reference manual.
 
-> [!IMPORTANT]
-> We are actively restructuring our documentation to follow the [Diátaxis framework](https://diataxis.fr/)
->
-> Going forward, this directory should **only** contain [reference documentation](https://nix.dev/contributing/documentation/diataxis#reference).
-> For tutorials, guides and explanations, contribute to <https://nix.dev/> instead.
->
-> We are actively working to generate **all** reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code.
-> This also provides the benefit of using `:doc` in the `nix repl` to view reference documentation locally on the fly.
+Going forward, it should only contain [reference](https://nix.dev/contributing/documentation/diataxis#reference) documentation.
+For tutorials, guides and explanations, contribute to <https://nix.dev/> instead.
 
-For documentation only relevant for contributors, use Markdown files next to the source and regular code comments.
-
-> [!TIP]
-> Feedback for improving support for parsing and rendering doc-comments is highly appreciated.
-> [Open an issue](https://github.com/NixOS/nixpkgs/issues/new?labels=6.topic%3A+documentation&title=Doc%3A+) to request bugfixes or new features.
+For documentation only relevant for contributors, use Markdown files and code comments in the source code.
 
 Rendered documentation:
 - [Unstable (from master)](https://nixos.org/manual/nixpkgs/unstable/)
 - [Stable (from latest release)](https://nixos.org/manual/nixpkgs/stable/)
 
-The rendering tool is [nixos-render-docs](../pkgs/by-name/ni/nixos-render-docs), sometimes abbreviated `nrd`.
+The rendering tool is [nixos-render-docs](../pkgs/tools/nix/nixos-render-docs/src/nixos_render_docs), sometimes abbreviated `nrd`.
 
 ## Contributing to this documentation
 
@@ -42,12 +32,6 @@ It is a daemon, that:
 2. HTTP serves the manual, injecting a script that triggers reload on changes
 3. opens the manual in the default browser
 
-### Testing redirects
-
-Once you have a successful build, you can open the relevant HTML (path mentioned above) in a browser along with the anchor, and observe the redirection.
-
-Note that if you already loaded the page and *then* input the anchor, you will need to perform a reload. This is because browsers do not re-run client JS code when only the anchor has changed.
-
 ## Syntax
 
 As per [RFC 0072](https://github.com/NixOS/rfcs/pull/72), all new documentation content should be written in [CommonMark](https://commonmark.org/) Markdown dialect.
@@ -95,7 +79,6 @@ Inlining HTML is not allowed. Parts of the documentation gets rendered to variou
 #### Roles
 
 If you want to link to a man page, you can use `` {manpage}`nix.conf(5)` ``. The references will turn into links when a mapping exists in [`doc/manpage-urls.json`](./manpage-urls.json).
-Please keep the `manpage-urls.json` file alphabetically sorted.
 
 A few markups for other kinds of literals are also available:
 
@@ -108,7 +91,6 @@ A few markups for other kinds of literals are also available:
 These literal kinds are used mostly in NixOS option documentation.
 
 This syntax is taken from [MyST](https://myst-parser.readthedocs.io/en/latest/syntax/syntax.html#roles-an-in-line-extension-point). Though, the feature originates from [reStructuredText](https://www.sphinx-doc.org/en/master/usage/restructuredtext/roles.html#role-manpage) with slightly different syntax.
-They are handled by `myst_role` defined per renderer. <!-- reverse references in code -->
 
 #### Admonitions
 
@@ -184,138 +166,109 @@ When needed, each convention explain why it exists, so you can make a decision w
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
-### One sentence per line
+- Put each sentence in its own line.
+  This makes reviews and suggestions much easier, since GitHub's review system is based on lines.
+  It also helps identifying long sentences at a glance.
 
-Put each sentence in its own line.
-This makes reviews and suggestions much easier, since GitHub's review system is based on lines.
-It also helps identifying long sentences at a glance.
+- Use the [admonition syntax](#admonitions) for callouts and examples.
 
-### Callouts and examples
+- Provide at least one example per function, and make examples self-contained.
+  This is easier to understand for beginners.
+  It also helps with testing that it actually works – especially once we introduce automation.
 
-Use the [admonition syntax](#admonitions) for callouts and examples.
+  Example code should be such that it can be passed to `pkgs.callPackage`.
+  Instead of something like:
 
-### Provide self-contained examples
+  ```nix
+  pkgs.dockerTools.buildLayeredImage {
+    name = "hello";
+    contents = [ pkgs.hello ];
+  }
+  ```
 
-Provide at least one example per function, and make examples self-contained.
-This is easier to understand for beginners.
-It also helps with testing that it actually works – especially once we introduce automation.
+  Write something like:
 
-Example code should be such that it can be passed to `pkgs.callPackage`.
-Instead of something like:
+  ```nix
+  { dockerTools, hello }:
+  dockerTools.buildLayeredImage {
+    name = "hello";
+    contents = [ hello ];
+  }
+  ```
 
-```nix
-pkgs.dockerTools.buildLayeredImage {
-  name = "hello";
-  contents = [ pkgs.hello ];
-}
-```
+- When showing inputs/outputs of any [REPL](https://en.wikipedia.org/wiki/Read%E2%80%93eval%E2%80%93print_loop), such as a shell or the Nix REPL, use a format as you'd see in the REPL, while trying to visually separate inputs from outputs.
+  This means that for a shell, you should use a format like the following:
+  ```shell
+  $ nix-build -A hello '<nixpkgs>' \
+    --option require-sigs false \
+    --option trusted-substituters file:///tmp/hello-cache \
+    --option substituters file:///tmp/hello-cache
+  /nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1
+  ```
+  Note how the input is preceded by `$` on the first line and indented on subsequent lines, and how the output is provided as you'd see on the shell.
 
-Write something like:
+  For the Nix REPL, you should use a format like the following:
+  ```shell
+  nix-repl> builtins.attrNames { a = 1; b = 2; }
+  [ "a" "b" ]
+  ```
+  Note how the input is preceded by `nix-repl>` and the output is provided as you'd see on the Nix REPL.
 
-```nix
-{ dockerTools, hello }:
-dockerTools.buildLayeredImage {
-  name = "hello";
-  contents = [ hello ];
-}
-```
+- When documenting functions or anything that has inputs/outputs and example usage, use nested headings to clearly separate inputs, outputs, and examples.
+  Keep examples as the last nested heading, and link to the examples wherever applicable in the documentation.
 
-### REPLs
+  The purpose of this convention is to provide a familiar structure for navigating the manual, so any reader can expect to find content related to inputs in an "inputs" heading, examples in an "examples" heading, and so on.
+  An example:
+  ```
+  ## buildImage
 
-When showing inputs/outputs of any [REPL](https://en.wikipedia.org/wiki/Read%E2%80%93eval%E2%80%93print_loop), such as a shell or the Nix REPL, use a format as you'd see in the REPL, while trying to visually separate inputs from outputs.
-This means that for a shell, you should use a format like the following:
-```shell
-$ nix-build -A hello '<nixpkgs>' \
-  --option require-sigs false \
-  --option trusted-substituters file:///tmp/hello-cache \
-  --option substituters file:///tmp/hello-cache
-/nix/store/zhl06z4lrfrkw5rp0hnjjfrgsclzvxpm-hello-2.12.1
-```
-Note how the input is preceded by `$` on the first line and indented on subsequent lines, and how the output is provided as you'd see on the shell.
+  Some explanation about the function here.
+  Describe a particular scenario, and point to [](#ex-dockerTools-buildImage), which is an example demonstrating it.
 
-For the Nix REPL, you should use a format like the following:
-```shell
-nix-repl> builtins.attrNames { a = 1; b = 2; }
-[ "a" "b" ]
-```
-Note how the input is preceded by `nix-repl>` and the output is provided as you'd see on the Nix REPL.
+  ### Inputs
 
-### Headings for inputs, outputs and examples
+  Documentation for the inputs of `buildImage`.
+  Perhaps even point to [](#ex-dockerTools-buildImage) again when talking about something specifically linked to it.
 
-When documenting functions or anything that has inputs/outputs and example usage, use nested headings to clearly separate inputs, outputs, and examples.
-Keep examples as the last nested heading, and link to the examples wherever applicable in the documentation.
+  ### Passthru outputs
 
-The purpose of this convention is to provide a familiar structure for navigating the manual, so any reader can expect to find content related to inputs in an "inputs" heading, examples in an "examples" heading, and so on.
-An example:
-```
-## buildImage
+  Documentation for any passthru outputs of `buildImage`.
 
-Some explanation about the function here.
-Describe a particular scenario, and point to [](#ex-dockerTools-buildImage), which is an example demonstrating it.
+  ### Examples
 
-### Inputs
+  Note that this is the last nested heading in the `buildImage` section.
 
-Documentation for the inputs of `buildImage`.
-Perhaps even point to [](#ex-dockerTools-buildImage) again when talking about something specifically linked to it.
+  :::{.example #ex-dockerTools-buildImage}
 
-### Passthru outputs
+  # Using `buildImage`
 
-Documentation for any passthru outputs of `buildImage`.
+  Example of how to use `buildImage` goes here.
 
-### Examples
+  :::
+  ```
 
-Note that this is the last nested heading in the `buildImage` section.
+- Use [definition lists](#definition-lists) to document function arguments, and the attributes of such arguments as well as their [types](https://nixos.org/manual/nix/stable/language/values).
+  For example:
 
-:::{.example #ex-dockerTools-buildImage}
+  ```markdown
+  # pkgs.coolFunction
 
-# Using `buildImage`
+  Description of what `coolFunction` does.
 
-Example of how to use `buildImage` goes here.
+  ## Inputs
 
-:::
-```
+  `coolFunction` expects a single argument which should be an attribute set, with the following possible attributes:
 
-### Function arguments
+  `name` (String)
 
-Use [definition lists](#definition-lists) to document function arguments, and the attributes of such arguments as well as their [types](https://nixos.org/manual/nix/stable/language/values).
-For example:
+  : The name of the resulting image.
 
-```markdown
-# pkgs.coolFunction {#pkgs.coolFunction}
+  `tag` (String; _optional_)
 
-`pkgs.coolFunction` *`name`* *`config`*
+  : Tag of the generated image.
 
-Description of what `callPackage` does.
-
-
-## Inputs {#pkgs-coolFunction-inputs}
-
-If something's special about `coolFunction`'s general argument handling, you can say so here.
-Otherwise, just describe the single argument or start the arguments' definition list without introduction.
-
-*`name`* (String)
-
-: The name of the resulting image.
-
-*`config`* (Attribute set)
-
-: Introduce the parameter. Maybe you have a test to make sure `{ }` is a sensible default; then you can say: these attributes are optional; `{ }` is a valid argument.
-
-  `outputHash` (String; _optional_)
-
-  : A brief explanation including when and when not to pass this attribute.
-
-  : _Default:_ the output path's hash.
-```
-
-Checklist:
-- Start with a synopsis, to show the order of positional arguments.
-- Metavariables are in emphasized code spans: ``` *`arg1`* ```. Metavariables are placeholders where users may write arbitrary expressions. This includes positional arguments.
-- Attribute names are regular code spans: ``` `attr1` ```. These identifiers can _not_ be picked freely by users, so they are _not_ metavariables.
-- _optional_ attributes have a _`Default:`_ if it's easily described as a value.
-- _optional_ attributes have a _`Default behavior:`_ if it's not easily described using a value.
-- Nix types aren't in code spans, because they are not code
-- Nix types are capitalized, to distinguish them from the camelCase Module System types, which _are_ code and behave like functions.
+    _Default:_ the output path's hash.
+  ```
 
 #### Examples
 
@@ -340,7 +293,7 @@ Though this is not shown in the rendered documentation on nixos.org.
 
 #### Figures
 
-To define a referenceable figure use the following fencing:
+To define a referencable figure use the following fencing:
 
 ```markdown
 ::: {.figure #nixos-logo}

doc/build-helpers.md

@@ -17,11 +17,9 @@ There is no uniform interface for build helpers.
 [Language- or framework-specific build helpers](#chap-language-support) usually follow the style of `stdenv.mkDerivation`, which accepts an attribute set or a fixed-point function taking an attribute set.
 
 ```{=include=} chapters
-build-helpers/fixed-point-arguments.chapter.md
 build-helpers/fetchers.chapter.md
 build-helpers/trivial-build-helpers.chapter.md
 build-helpers/testers.chapter.md
-build-helpers/dev-shell-tools.chapter.md
 build-helpers/special.md
 build-helpers/images.md
 hooks/index.md

doc/build-helpers/dev-shell-tools.chapter.md

@@ -1,84 +0,0 @@
-# Development Shell helpers {#chap-devShellTools}
-
-The `nix-shell` command has popularized the concept of transient shell environments for development or testing purposes.
-<!--
-  We should try to document the product, not its development process in the Nixpkgs reference manual,
-  but *something* needs to be said to provide context for this library.
-  This is the most future proof sentence I could come up with while Nix itself does yet make use of this.
-  Relevant is the current status of the devShell attribute "project": https://github.com/NixOS/nix/issues/7501
-  -->
-However, `nix-shell` is not the only way to create such environments, and even `nix-shell` itself can indirectly benefit from this library.
-
-This library provides a set of functions that help create such environments.
-
-## `devShellTools.valueToString` {#sec-devShellTools-valueToString}
-
-Converts Nix values to strings in the way the [`derivation` built-in function](https://nix.dev/manual/nix/2.23/language/derivations) does.
-
-:::{.example}
-## `valueToString` usage examples
-
-```nix
-devShellTools.valueToString (builtins.toFile "foo" "bar")
-# => "/nix/store/...-foo"
-```
-
-```nix
-devShellTools.valueToString false
-# => ""
-```
-
-:::
-
-## `devShellTools.unstructuredDerivationInputEnv` {#sec-devShellTools-unstructuredDerivationInputEnv}
-
-Convert a set of derivation attributes (as would be passed to [`derivation`]) to a set of environment variables that can be used in a shell script.
-This function does not support `__structuredAttrs`, but does support `passAsFile`.
-
-:::{.example}
-## `unstructuredDerivationInputEnv` usage example
-
-```nix
-devShellTools.unstructuredDerivationInputEnv {
-  drvAttrs = {
-    name = "foo";
-    buildInputs = [
-      hello
-      figlet
-    ];
-    builder = bash;
-    args = [
-      "-c"
-      "${./builder.sh}"
-    ];
-  };
-}
-# => {
-#  name = "foo";
-#  buildInputs = "/nix/store/...-hello /nix/store/...-figlet";
-#  builder = "/nix/store/...-bash";
-#}
-```
-
-Note that `args` is not included, because Nix does not added it to the builder process environment.
-
-:::
-
-## `devShellTools.derivationOutputEnv` {#sec-devShellTools-derivationOutputEnv}
-
-Takes the relevant parts of a derivation and returns a set of environment variables, that would be present in the derivation.
-
-:::{.example}
-## `derivationOutputEnv` usage example
-
-```nix
-let
-  pkg = hello;
-in
-devShellTools.derivationOutputEnv {
-  outputList = pkg.outputs;
-  outputMap = pkg;
-}
-```
-
-:::

doc/build-helpers/fetchers.chapter.md

@@ -157,12 +157,6 @@ Here are security considerations for this scenario:
 
   In more concrete terms, if you use any other hash, the [`--insecure` flag](https://curl.se/docs/manpage.html#-k) will be passed to the underlying call to `curl` when downloading content.
 
-## Proxy usage {#sec-pkgs-fetchers-proxy}
-
-Nixpkgs fetchers can make use of a http(s) proxy. Each fetcher will automatically inherit proxy-related environment variables (`http_proxy`, `https_proxy`, etc) via [impureEnvVars](https://nixos.org/manual/nix/stable/language/advanced-attributes#adv-attr-impureEnvVars).
-
-The environment variable `NIX_SSL_CERT_FILE` is also inherited in fetchers, and can be used to provide a custom certificate bundle to fetchers. This is usually required for a https proxy to work without certificate validation errors.
-
 []{#fetchurl}
 ## `fetchurl` {#sec-pkgs-fetchers-fetchurl}
 
@@ -491,11 +485,7 @@ It might be useful to manipulate the content downloaded by `fetchurl` directly i
 In this example, we'll adapt [](#ex-fetchers-fetchurl-nixpkgs-version) to append the result of running the `hello` package to the contents we download, purely to illustrate how to manipulate the content.
 
 ```nix
-{
-  fetchurl,
-  hello,
-  lib,
-}:
+{ fetchurl, hello, lib }:
 fetchurl {
   url = "https://raw.githubusercontent.com/NixOS/nixpkgs/23.11/.version";
 
@@ -718,10 +708,9 @@ A wrapper around `fetchpatch`, which takes:
 Here is an example of `fetchDebianPatch` in action:
 
 ```nix
-{
-  lib,
-  fetchDebianPatch,
-  buildPythonPackage,
+{ lib
+, fetchDebianPatch
+, buildPythonPackage
 }:
 
 buildPythonPackage rec {
@@ -733,7 +722,7 @@ buildPythonPackage rec {
     (fetchDebianPatch {
       inherit pname version;
       debianRevision = "5";
-      patch = "Add-quotes-to-SOAPAction-header-in-SoapClient.patch";
+      name = "Add-quotes-to-SOAPAction-header-in-SoapClient.patch";
       hash = "sha256-xA8Wnrpr31H8wy3zHSNfezFNjUJt1HbSXn3qUMzeKc0=";
     })
   ];
@@ -760,66 +749,25 @@ Used with Subversion. Expects `url` to a Subversion directory, `rev`, and `hash`
 
 Used with Git. Expects `url` to a Git repo, `rev`, and `hash`. `rev` in this case can be full the git commit id (SHA1 hash) or a tag name like `refs/tags/v1.0`.
 
-If you want to fetch a tag you should pass the `tag` parameter instead of `rev` which has the same effect as setting `rev = "refs/tags"/${version}"`.
-This is safer than just setting `rev = version` w.r.t. possible branch and tag name conflicts.
+Additionally, the following optional arguments can be given: `fetchSubmodules = true` makes `fetchgit` also fetch the submodules of a repository. If `deepClone` is set to true, the entire repository is cloned as opposing to just creating a shallow clone. `deepClone = true` also implies `leaveDotGit = true` which means that the `.git` directory of the clone won't be removed after checkout.
 
-Additionally, the following optional arguments can be given:
+If only parts of the repository are needed, `sparseCheckout` can be used. This will prevent git from fetching unnecessary blobs from server, see [git sparse-checkout](https://git-scm.com/docs/git-sparse-checkout) for more information:
 
-*`fetchSubmodules`* (Boolean)
+```nix
+{ stdenv, fetchgit }:
 
-: Whether to also fetch the submodules of a repository.
-
-*`fetchLFS`* (Boolean)
-
-: Whether to fetch LFS objects.
-
-*`postFetch`* (String)
-
-: Shell code executed after the file has been fetched successfully.
-  This can do things like check or transform the file.
-
-*`leaveDotGit`* (Boolean)
-
-: Whether the `.git` directory of the clone should *not* be removed after checkout.
-
-  Be warned though that the git repository format is not stable and this flag is therefore not suitable for actual use by itself.
-  Only use this for testing purposes or in conjunction with removing the `.git` directory in `postFetch`.
-
-*`deepClone`* (Boolean)
-
-: Clone the entire repository as opposing to just creating a shallow clone.
-  This implies `leaveDotGit`.
-
-*`sparseCheckout`* (List of String)
-
-: Prevent git from fetching unnecessary blobs from server.
-  This is useful if only parts of the repository are needed.
-
-  ::: {.example #ex-fetchgit-sparseCheckout}
-
-  # Use `sparseCheckout` to only include some directories:
-
-  ```nix
-  { stdenv, fetchgit }:
-
-  stdenv.mkDerivation {
-    name = "hello";
-    src = fetchgit {
-      url = "https://...";
-      sparseCheckout = [
-        "directory/to/be/included"
-        "another/directory"
-      ];
-      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-    };
-  }
-  ```
-  :::
-
-  See [git sparse-checkout](https://git-scm.com/docs/git-sparse-checkout) for more information.
-
-Some additional parameters for niche use-cases can be found listed in the function parameters in the declaration of `fetchgit`: `pkgs/build-support/fetchgit/default.nix`.
-Future parameters additions might also happen without immediately being documented here.
+stdenv.mkDerivation {
+  name = "hello";
+  src = fetchgit {
+    url = "https://...";
+    sparseCheckout = [
+      "directory/to/be/included"
+      "another/directory"
+    ];
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+}
+```
 
 ## `fetchfossil` {#fetchfossil}
 
@@ -841,7 +789,7 @@ A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are m
 
 ## `fetchFromGitHub` {#fetchfromgithub}
 
-`fetchFromGitHub` expects four arguments. `owner` is a string corresponding to the GitHub user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. If you need to fetch a tag however, you should prefer to use the `tag` parameter which achieves this in a safer way with less boilerplate. Finally, `hash` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available, but `hash` is currently preferred.
+`fetchFromGitHub` expects four arguments. `owner` is a string corresponding to the GitHub user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `hash` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available, but `hash` is currently preferred.
 
 To use a different GitHub instance, use `githubBase` (defaults to `"github.com"`).
 
@@ -919,11 +867,9 @@ It produces packages that cannot be built automatically.
 { fetchtorrent }:
 
 fetchtorrent {
-  config = {
-    peer-limit-global = 100;
-  };
+  config = { peer-limit-global = 100; };
   url = "magnet:?xt=urn:btih:dd8255ecdc7ca55fb0bbf81323d87062db1f6d1c";
-  hash = "";
+  sha256 = "";
 }
 ```
 

doc/build-helpers/fixed-point-arguments.chapter.md

@@ -1,74 +0,0 @@
-# Fixed-point arguments of build helpers {#chap-build-helpers-finalAttrs}
-
-As mentioned in the beginning of this part, `stdenv.mkDerivation` could alternatively accept a fixed-point function. The input of such function, typically named `finalAttrs`, is expected to be the final state of the attribute set.
-A build helper like this is said to accept **fixed-point arguments**.
-
-Build helpers don't always support fixed-point arguments yet, as support in [`stdenv.mkDerivation`](#mkderivation-recursive-attributes) was first included in Nixpkgs 22.05.
-
-## Defining a build helper with `lib.extendMkDerivation` {#sec-build-helper-extendMkDerivation}
-
-Developers can use the Nixpkgs library function [`lib.customisation.extendMkDerivation`](#function-library-lib.customisation.extendMkDerivation) to define a build helper supporting fixed-point arguments from an existing one with such support, with an attribute overlay similar to the one taken by [`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs).
-
-Beside overriding, `lib.extendMkDerivation` also supports `excludeDrvArgNames` to optionally exclude some arguments in the input fixed-point arguments from passing down the base build helper (specified as `constructDrv`).
-
-:::{.example #ex-build-helpers-extendMkDerivation}
-
-# Example definition of `mkLocalDerivation` extended from `stdenv.mkDerivation` with `lib.extendMkDerivation`
-
-We want to define a build helper named `mkLocalDerivation` that builds locally without using substitutes by default.
-
-Instead of taking a plain attribute set,
-
-```nix
-{
-  preferLocalBuild ? true,
-  allowSubstitute ? false,
-  specialArg ? (_: false),
-  ...
-}@args:
-
-stdenv.mkDerivation (
-  removeAttrs [
-    # Don't pass specialArg into mkDerivation.
-    "specialArg"
-  ] args
-  // {
-    # Arguments to pass
-    inherit preferLocalBuild allowSubstitute;
-    # Some expressions involving specialArg
-    greeting = if specialArg "hi" then "hi" else "hello";
-  }
-)
-```
-
-we could define with `lib.extendMkDerivation` an attribute overlay to make the result build helper also accepts the the attribute set's fixed point passing to the underlying `stdenv.mkDerivation`, named `finalAttrs` here:
-
-```nix
-lib.extendMkDerivation {
-  constructDrv = stdenv.mkDerivation;
-  excludeDrvArgNames = [
-    # Don't pass specialArg into mkDerivation.
-    "specialArg"
-  ];
-  extendDrvArgs =
-    finalAttrs:
-    {
-      preferLocalBuild ? true,
-      allowSubstitute ? false,
-      specialArg ? (_: false),
-      ...
-    }@args:
-    {
-      # Arguments to pass
-      inherit
-        preferLocalBuild
-        allowSubstitute
-        ;
-      # Some expressions involving specialArg
-      greeting = if specialArg "hi" then "hi" else "hello";
-    };
-}
-```
-:::
-
-If one needs to apply extra changes to the result derivation, pass the derivation transformation function to `lib.extendMkDerivation` as `lib.customisation.extendMkDerivation { transformDrv = drv: ...; }`.

doc/build-helpers/images/appimagetools.section.md

@@ -33,7 +33,7 @@ let
   version = "0.6.30";
 
   src = fetchurl {
-    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/nuclear-v${version}.AppImage";
+    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${pname}-v${version}.AppImage";
     hash = "sha256-he1uGC1M/nFcKpMM9JKY4oeexJcnzV0ZRxhTjtJz6xw=";
   };
 in
@@ -64,10 +64,9 @@ let
 
   src = fetchurl {
     url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
-in
-appimageTools.wrapType2 {
+in appimageTools.wrapType2 {
   inherit pname version src;
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 }
@@ -101,14 +100,13 @@ let
 
   src = fetchurl {
     url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
   appimageContents = appimageTools.extract {
     inherit pname version src;
   };
-in
-appimageTools.wrapType2 {
+in appimageTools.wrapType2 {
   inherit pname version src;
 
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];
@@ -119,7 +117,7 @@ appimageTools.wrapType2 {
     install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/irccloud.png \
       $out/share/icons/hicolor/512x512/apps/irccloud.png
     substituteInPlace $out/share/applications/irccloud.desktop \
-      --replace-fail 'Exec=AppRun' 'Exec=${pname}'
+      --replace 'Exec=AppRun' 'Exec=${pname}'
   '';
 }
 ```
@@ -143,17 +141,16 @@ let
 
   src = fetchurl {
     url = "https://github.com/irccloud/irccloud-desktop/releases/download/v${version}/IRCCloud-${version}-linux-x86_64.AppImage";
-    hash = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
+    sha256 = "sha256-/hMPvYdnVB1XjKgU2v47HnVvW4+uC3rhRjbucqin4iI=";
   };
 
   appimageContents = appimageTools.extract {
     inherit pname version src;
     postExtract = ''
-      substituteInPlace $out/irccloud.desktop --replace-fail 'Exec=AppRun' 'Exec=${pname}'
+      substituteInPlace $out/irccloud.desktop --replace 'Exec=AppRun' 'Exec=${pname}'
     '';
   };
-in
-appimageTools.wrapType2 {
+in appimageTools.wrapType2 {
   inherit pname version src;
 
   extraPkgs = pkgs: [ pkgs.at-spi2-core ];

doc/build-helpers/images/binarycache.section.md

@@ -11,14 +11,6 @@ It can also be a convenient way to make some Nix packages available inside a con
 `rootPaths` must be a list of derivations.
 The transitive closure of these derivations' outputs will be copied into the cache.
 
-## Optional arguments {#sec-pkgs-binary-cache-arguments}
-
-`compression` (`"none"` or `"xz"` or `"zstd"`; _optional_)
-
-: The compression algorithm to use.
-
-  _Default value:_ `zstd`.
-
 ::: {.note}
 This function is meant for advanced use cases.
 The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command.
@@ -35,7 +27,7 @@ The following derivation will construct a flat-file binary cache containing the
 ```nix
 { mkBinaryCache, hello }:
 mkBinaryCache {
-  rootPaths = [ hello ];
+  rootPaths = [hello];
 }
 ```
 

doc/build-helpers/images/dockertools.section.md

@@ -50,10 +50,6 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
   If specified, the layer created by `buildImage` will be appended to the layers defined in the base image, resulting in an image with at least two layers (one or more layers from the base image, and the layer created by `buildImage`).
   Otherwise, the resulting image with contain the single layer created by `buildImage`.
 
-  :::{.note}
-  Only **Env** configuration is inherited from the base image.
-  :::
-
   _Default value:_ `null`.
 
 `fromImageName` (String or Null; _optional_)
@@ -189,19 +185,6 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
   _Default value:_ `"gz"`.\
   _Possible values:_ `"none"`, `"gz"`, `"zstd"`.
 
-`includeNixDB` (Boolean; _optional_)
-
-: Populate the nix database in the image with the dependencies of `copyToRoot`.
-  The main purpose is to be able to use nix commands in the container.
-
-  :::{.caution}
-  Be careful since this doesn't work well in combination with `fromImage`. In particular, in a multi-layered image, only the Nix paths from the lower image will be in the database.
-
-  This also neglects to register the store paths that are pulled into the image as a dependency of one of the other values, but aren't a dependency of `copyToRoot`.
-  :::
-
-  _Default value:_ `false`.
-
 `contents` **DEPRECATED**
 
 : This attribute is deprecated, and users are encouraged to use `copyToRoot` instead.
@@ -235,11 +218,7 @@ The following package builds a Docker image that runs the `redis-server` executa
 The Docker image will have name `redis` and tag `latest`.
 
 ```nix
-{
-  dockerTools,
-  buildEnv,
-  redis,
-}:
+{ dockerTools, buildEnv, redis }:
 dockerTools.buildImage {
   name = "redis";
   tag = "latest";
@@ -257,9 +236,7 @@ dockerTools.buildImage {
   config = {
     Cmd = [ "/bin/redis-server" ];
     WorkingDir = "/data";
-    Volumes = {
-      "/data" = { };
-    };
+    Volumes = { "/data" = { }; };
   };
 }
 ```
@@ -292,11 +269,7 @@ It uses `runAsRoot` to create a directory and a file inside the image.
 This works the same as [](#ex-dockerTools-buildImage-extraCommands), but uses `runAsRoot` instead of `extraCommands`.
 
 ```nix
-{
-  dockerTools,
-  buildEnv,
-  hello,
-}:
+{ dockerTools, buildEnv, hello }:
 dockerTools.buildImage {
   name = "hello";
   tag = "latest";
@@ -330,11 +303,7 @@ This works the same as [](#ex-dockerTools-buildImage-runAsRoot), but uses `extra
 Note that with `extraCommands`, we can't directly reference `/` and must create files and directories as if we were already on `/`.
 
 ```nix
-{
-  dockerTools,
-  buildEnv,
-  hello,
-}:
+{ dockerTools, buildEnv, hello }:
 dockerTools.buildImage {
   name = "hello";
   tag = "latest";
@@ -364,11 +333,7 @@ dockerTools.buildImage {
 Note that using a value of `"now"` in the `created` attribute will break reproducibility.
 
 ```nix
-{
-  dockerTools,
-  buildEnv,
-  hello,
-}:
+{ dockerTools, buildEnv, hello }:
 dockerTools.buildImage {
   name = "hello";
   tag = "latest";
@@ -471,7 +436,7 @@ See [](#ex-dockerTools-streamLayeredImage-exploringlayers) to understand how the
 `streamLayeredImage` allows scripts to be run when creating the additional layer with symlinks, allowing custom behaviour to affect the final results of the image (see the documentation of the `extraCommands` and `fakeRootCommands` attributes).
 
 The resulting repository tarball will list a single image as specified by the `name` and `tag` attributes.
-By default, that image will use a static creation date (see documentation for the `created` and `mtime` attributes).
+By default, that image will use a static creation date (see documentation for the `created` attribute).
 This allows the function to produce reproducible images.
 
 ### Inputs {#ssec-pkgs-dockerTools-streamLayeredImage-inputs}
@@ -534,7 +499,6 @@ This allows the function to produce reproducible images.
 `created` (String; _optional_)
 
 : Specifies the time of creation of the generated image.
-  This date will be used for the image metadata.
   This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.
 
   :::{.caution}
@@ -543,18 +507,6 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `"1970-01-01T00:00:01Z"`.
 
-`mtime` (String; _optional_)
-
-: Specifies the time used for the modification timestamp of files within the layers of the generated image.
-  This should be either a date and time formatted according to [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601) or `"now"`, in which case the current date will be used.
-
-  :::{.caution}
-  Using a non-constant date will cause built layers to have a different hash each time, preventing deduplication.
-  Using `"now"` also means that the generated image will not be reproducible anymore (because the date will always change whenever it's built).
-  :::
-
-  _Default value:_ `"1970-01-01T00:00:01Z"`.
-
 `uid` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-uid}
 `gid` (Number; _optional_) []{#dockerTools-buildLayeredImage-arg-gid}
 `uname` (String; _optional_) []{#dockerTools-buildLayeredImage-arg-uname}
@@ -622,19 +574,6 @@ This allows the function to produce reproducible images.
 
   _Default value:_ `true`
 
-`includeNixDB` (Boolean; _optional_)
-
-: Populate the nix database in the image with the dependencies of `copyToRoot`.
-  The main purpose is to be able to use nix commands in the container.
-
-  :::{.caution}
-  Be careful since this doesn't work well in combination with `fromImage`. In particular, in a multi-layered image, only the Nix paths from the lower image will be in the database.
-
-  This also neglects to register the store paths that are pulled into the image as a dependency of one of the other values, but aren't a dependency of `copyToRoot`.
-  :::
-
-  _Default value:_ `false`.
-
 `passthru` (Attribute Set; _optional_)
 
 : Use this to pass any attributes as [`passthru`](#chap-passthru) for the resulting derivation.
@@ -784,11 +723,7 @@ The closure of `config` is automatically included in the generated image.
 The following package shows a more compact way to create the same output generated in [](#ex-dockerTools-streamLayeredImage-hello).
 
 ```nix
-{
-  dockerTools,
-  hello,
-  lib,
-}:
+{ dockerTools, hello, lib }:
 dockerTools.streamLayeredImage {
   name = "hello";
   tag = "latest";
@@ -903,7 +838,7 @@ dockerTools.pullImage {
   imageDigest = "sha256:b8ea88f763f33dfda2317b55eeda3b1a4006692ee29e60ee54ccf6d07348c598";
   finalImageName = "nix";
   finalImageTag = "2.19.3";
-  hash = "sha256-zRwlQs1FiKrvHPaf8vWOR/Tlp1C5eLn1d9pE4BZg3oA=";
+  sha256 = "zRwlQs1FiKrvHPaf8vWOR/Tlp1C5eLn1d9pE4BZg3oA=";
 }
 ```
 :::
@@ -920,7 +855,7 @@ dockerTools.pullImage {
   imageDigest = "sha256:24a23053f29266fb2731ebea27f915bb0fb2ae1ea87d42d890fe4e44f2e27c5d";
   finalImageName = "etcd";
   finalImageTag = "v3.5.11";
-  hash = "sha256-Myw+85f2/EVRyMB3axECdmQ5eh9p1q77FWYKy8YpRWU=";
+  sha256 = "Myw+85f2/EVRyMB3axECdmQ5eh9p1q77FWYKy8YpRWU=";
 }
 ```
 :::
@@ -944,7 +879,7 @@ Writing manifest to image destination
 {
   imageName = "nixos/nix";
   imageDigest = "sha256:498fa2d7f2b5cb3891a4edf20f3a8f8496e70865099ba72540494cd3e2942634";
-  hash = "sha256-OEgs3uRPMb4Y629FJXAWZW9q9LqHS/A/GUqr3K5wzOA=";
+  sha256 = "1q6cf2pdrasa34zz0jw7pbs6lvv52rq2aibgxccbwcagwkg2qj1q";
   finalImageName = "nixos/nix";
   finalImageTag = "latest";
 }
@@ -1569,15 +1504,11 @@ The Docker image generated will have a name like `hello-<version>-env` and tag `
 This example uses [](#ex-dockerTools-streamNixShellImage-hello) as a starting point.
 
 ```nix
-{
-  dockerTools,
-  cowsay,
-  hello,
-}:
+{ dockerTools, cowsay, hello }:
 dockerTools.streamNixShellImage {
   tag = "latest";
   drv = hello.overrideAttrs (old: {
-    nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [
+    nativeBuildInputs = old.nativeBuildInputs or [] ++ [
       cowsay
     ];
   });

doc/build-helpers/images/makediskimage.section.md

@@ -52,23 +52,23 @@ A `deterministic` flag is available for best efforts determinism.
 To produce a Nix-store only image:
 ```nix
 let
-  pkgs = import <nixpkgs> { };
+  pkgs = import <nixpkgs> {};
   lib = pkgs.lib;
   make-disk-image = import <nixpkgs/nixos/lib/make-disk-image.nix>;
 in
-make-disk-image {
-  inherit pkgs lib;
-  config = { };
-  additionalPaths = [ ];
-  format = "qcow2";
-  onlyNixStore = true;
-  partitionTableType = "none";
-  installBootLoader = false;
-  touchEFIVars = false;
-  diskSize = "auto";
-  additionalSpace = "0M"; # Defaults to 512M.
-  copyChannel = false;
-}
+  make-disk-image {
+    inherit pkgs lib;
+    config = {};
+    additionalPaths = [ ];
+    format = "qcow2";
+    onlyNixStore = true;
+    partitionTableType = "none";
+    installBootLoader = false;
+    touchEFIVars = false;
+    diskSize = "auto";
+    additionalSpace = "0M"; # Defaults to 512M.
+    copyChannel = false;
+  }
 ```
 
 Some arguments can be left out, they are shown explicitly for the sake of the example.
@@ -78,36 +78,29 @@ Building this derivation will provide a QCOW2 disk image containing only the Nix
 To produce a NixOS installation image disk with UEFI and bootloader installed:
 ```nix
 let
-  pkgs = import <nixpkgs> { };
+  pkgs = import <nixpkgs> {};
   lib = pkgs.lib;
   make-disk-image = import <nixpkgs/nixos/lib/make-disk-image.nix>;
   evalConfig = import <nixpkgs/nixos/lib/eval-config.nix>;
 in
-make-disk-image {
-  inherit pkgs lib;
-  inherit
-    (evalConfig {
+  make-disk-image {
+    inherit pkgs lib;
+    inherit (evalConfig {
       modules = [
         {
-          fileSystems."/" = {
-            device = "/dev/vda";
-            fsType = "ext4";
-            autoFormat = true;
-          };
+          fileSystems."/" = { device = "/dev/vda"; fsType = "ext4"; autoFormat = true; };
           boot.grub.device = "/dev/vda";
         }
       ];
-    })
-    config
-    ;
-  format = "qcow2";
-  onlyNixStore = false;
-  partitionTableType = "legacy+gpt";
-  installBootLoader = true;
-  touchEFIVars = true;
-  diskSize = "auto";
-  additionalSpace = "0M"; # Defaults to 512M.
-  copyChannel = false;
-  memSize = 2048; # Qemu VM memory size in megabytes. Defaults to 1024M.
-}
+    }) config;
+    format = "qcow2";
+    onlyNixStore = false;
+    partitionTableType = "legacy+gpt";
+    installBootLoader = true;
+    touchEFIVars = true;
+    diskSize = "auto";
+    additionalSpace = "0M"; # Defaults to 512M.
+    copyChannel = false;
+    memSize = 2048; # Qemu VM memory size in megabytes. Defaults to 1024M.
+  }
 ```

doc/build-helpers/images/ocitools.section.md

@@ -76,11 +76,7 @@ Note that no user namespace is created, which means that you won't be able to ru
 This example uses `ociTools.buildContainer` to create a simple container that runs `bash`.
 
 ```nix
-{
-  ociTools,
-  lib,
-  bash,
-}:
+{ ociTools, lib, bash }:
 ociTools.buildContainer {
   args = [
     (lib.getExe bash)

doc/build-helpers/images/portableservice.section.md

@@ -91,12 +91,7 @@ See [](#ex-portableService-hello) to understand how to use the output of `portab
 The following example builds a Portable Service image with the `hello` package, along with a service unit that runs it.
 
 ```nix
-{
-  lib,
-  writeText,
-  portableService,
-  hello,
-}:
+{ lib, writeText, portableService, hello }:
 let
   hello-service = writeText "hello.service" ''
     [Unit]
@@ -156,13 +151,7 @@ To make things available globally, you must specify the `symlinks` attribute whe
 The following package builds on the package from [](#ex-portableService-hello) to make `/etc/ssl` available globally (this is only for illustrative purposes, because `hello` doesn't use `/etc/ssl`).
 
 ```nix
-{
-  lib,
-  writeText,
-  portableService,
-  hello,
-  cacert,
-}:
+{ lib, writeText, portableService, hello, cacert }:
 let
   hello-service = writeText "hello.service" ''
     [Unit]
@@ -178,10 +167,7 @@ portableService {
   inherit (hello) version;
   units = [ hello-service ];
   symlinks = [
-    {
-      object = "${cacert}/etc/ssl";
-      symlink = "/etc/ssl";
-    }
+    { object = "${cacert}/etc/ssl"; symlink = "/etc/ssl"; }
   ];
 }
 ```

doc/build-helpers/special/checkpoint-build.section.md

@@ -26,9 +26,7 @@ To change a normal derivation to a checkpoint based build, these steps must be t
 
 ## Example {#sec-checkpoint-build-example}
 ```nix
-{
-  pkgs ? import <nixpkgs> { },
-}:
+{ pkgs ? import <nixpkgs> {} }:
 let
   inherit (pkgs.checkpointBuildTools)
     prepareCheckpointBuild
@@ -41,6 +39,5 @@ let
       sed -i 's/Hello, world!/Hello, Nix!/g' src/hello.c
     '';
   });
-in
-mkCheckpointBuild changedHello helloCheckpoint
+in mkCheckpointBuild changedHello helloCheckpoint
 ```

doc/build-helpers/special/fakenss.section.md

@@ -48,19 +48,12 @@ It is useful with functions in `dockerTools` to allow building Docker images tha
 This example includes the `hello` binary in the image so it can do something besides just have the extra files.
 
 ```nix
-{
-  dockerTools,
-  fakeNss,
-  hello,
-}:
+{ dockerTools, fakeNss, hello }:
 dockerTools.buildImage {
   name = "image-with-passwd";
   tag = "latest";
 
-  copyToRoot = [
-    fakeNss
-    hello
-  ];
+  copyToRoot = [ fakeNss hello ];
 
   config = {
     Cmd = [ "/bin/hello" ];
@@ -77,8 +70,8 @@ The following code uses `override` to add extra lines to `/etc/passwd` and `/etc
 ```nix
 { fakeNss }:
 fakeNss.override {
-  extraPasswdLines = [ "newuser:x:9001:9001:new user:/var/empty:/bin/sh" ];
-  extraGroupLines = [ "newuser:x:9001:" ];
+  extraPasswdLines = ["newuser:x:9001:9001:new user:/var/empty:/bin/sh"];
+  extraGroupLines = ["newuser:x:9001:"];
 }
 ```
 :::