nixpkgs/ci
Lin Jian f4c6e1174c
ci/request-reviews: fix headRef to point to the PR head
Previously, headRef points to the master branch of Nixpkgs, which
basically means no code owner review will be requested.

The problem can be verified using the following command.

$ DRY_MODE=1 ./ci/request-reviews/request-reviews.sh NixOS/nixpkgs 347973 ci/OWNERS
[...]
This PR touches 0 files
Requesting reviews from: {
  "reviewers": []
}
[...]

Additionally, the comment about conflicts is removed thanks to the
unambiguous way of specifying ref.
2024-10-12 06:10:17 +08:00
..
codeowners-validator ci: Add codeowners validator 2024-10-08 22:14:59 +02:00
nixpkgs-vet nixpkgs-vet: update CI, docs, and release to 0.1.4 2024-09-03 13:53:25 -07:00
request-reviews ci/request-reviews: fix headRef to point to the PR head 2024-10-12 06:10:17 +08:00
default.nix ci: Add codeowners validator 2024-10-08 22:14:59 +02:00
nixpkgs-vet.sh nixpkgs-vet: update CI, docs, and release to 0.1.4 2024-09-03 13:53:25 -07:00
OWNERS OWNERS: reference the ACME team directly (#347832) 2024-10-11 03:55:31 +02:00
pinned-nixpkgs.json ci: Update pinned Nixpkgs 2024-08-22 16:42:30 +02:00
README.md treewide: Fix or remove some markdown links 2024-09-03 23:37:05 +02:00
update-pinned-nixpkgs.sh ci/update-pinned-nixpkgs.sh: Allow setting the rev 2024-07-18 15:51:02 +02:00

CI support files

This directory contains files to support CI, such as GitHub Actions and Ofborg. This is in contrast with maintainers/scripts which is for human use instead.

Pinned Nixpkgs

CI may need certain packages from Nixpkgs. In order to ensure that the needed packages are generally available without building, pinned-nixpkgs.json contains a pinned Nixpkgs version tested by Hydra.

Run update-pinned-nixpkgs.sh to update it.

ci/nixpkgs-vet.sh BASE_BRANCH [REPOSITORY]

Runs the nixpkgs-vet tool on the HEAD commit, closely matching what CI does. This can't do exactly the same as CI, because CI needs to rely on GitHub's server-side Git history to compute the mergeability of PRs before the check can be started. In turn, when contributors are running this tool locally, we don't want to have to push commits to test them, and we can also rely on the local Git history to do the mergeability check.

Arguments:

  • BASE_BRANCH: The base branch to use, e.g. master or release-24.05
  • REPOSITORY: The repository from which to fetch the base branch. Defaults to https://github.com/NixOS/nixpkgs.git.

ci/nixpkgs-vet

This directory contains scripts and files used and related to nixpkgs-vet, which the CI uses to implement pkgs/by-name checks, along with many other Nixpkgs architecture rules. See also the CI GitHub Action.

ci/nixpkgs-vet/update-pinned-tool.sh

Updates the pinned nixpkgs-vet tool in ci/nixpkgs-vet/pinned-version.txt to the latest release.

Each release contains a pre-built x86_64-linux version of the tool which is used by CI.

This script currently needs to be called manually when the CI tooling needs to be updated.

Why not just build the tooling right from the PRs Nixpkgs version?

  • Because it allows CI to check all PRs, even if they would break the CI tooling.
  • Because it makes the CI check very fast, since no Nix builds need to be done, even for mass rebuilds.
  • Because it improves security, since we don't have to build potentially untrusted code from PRs. The tool only needs a very minimal Nix evaluation at runtime, which can work with readonly-mode and restrict-eval.