diff --git a/.github/workflows/codeowners.yml b/.github/workflows/codeowners-v2.yml similarity index 73% rename from .github/workflows/codeowners.yml rename to .github/workflows/codeowners-v2.yml index 56588d45c9cd..862681fb53b8 100644 --- a/.github/workflows/codeowners.yml +++ b/.github/workflows/codeowners-v2.yml @@ -1,17 +1,32 @@ -name: Codeowners +name: Codeowners v2 -# This workflow depends on a GitHub App with the following permissions: -# - Repository > Administration: read-only -# - Organization > Members: read-only -# - Repository > Pull Requests: read-write -# The App needs to be installed on this repository -# the OWNER_APP_ID repository variable needs to be set -# the OWNER_APP_PRIVATE_KEY repository secret needs to be set +# This workflow depends on two GitHub Apps with the following permissions: +# - For checking code owners: +# - Permissions: +# - Repository > Administration: read-only +# - Organization > Members: read-only +# - Install App on this repository, setting these variables: +# - OWNER_RO_APP_ID (variable) +# - OWNER_RO_APP_PRIVATE_KEY (secret) +# - For requesting code owners: +# - Permissions: +# - Repository > Administration: read-only +# - Organization > Members: read-only +# - Repository > Pull Requests: read-write +# - Install App on this repository, setting these variables: +# - OWNER_APP_ID (variable) +# - OWNER_APP_PRIVATE_KEY (secret) +# +# This split is done because checking code owners requires handling untrusted PR input, +# while requesting code owners requires PR write access, and those shouldn't be mixed. on: pull_request_target: types: [opened, ready_for_review, synchronize, reopened, edited] +# We don't need any default GitHub token +permissions: {} + env: OWNERS_FILE: ci/OWNERS # Don't do anything on draft PRs @@ -45,8 +60,8 @@ jobs: - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0 id: app-token with: - app-id: ${{ vars.OWNER_APP_ID }} - private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }} + app-id: ${{ vars.OWNER_RO_APP_ID }} + private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }} - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 with: diff --git a/.github/workflows/editorconfig.yml b/.github/workflows/editorconfig-v2.yml similarity index 95% rename from .github/workflows/editorconfig.yml rename to .github/workflows/editorconfig-v2.yml index b2b96722993b..e9cb35fbfb8d 100644 --- a/.github/workflows/editorconfig.yml +++ b/.github/workflows/editorconfig-v2.yml @@ -1,6 +1,8 @@ -name: "Checking EditorConfig" +name: "Checking EditorConfig v2" -permissions: read-all +permissions: + pull-requests: read + contents: read on: # avoids approving first time contributors diff --git a/.github/workflows/manual-nixos.yml b/.github/workflows/manual-nixos-v2.yml similarity index 94% rename from .github/workflows/manual-nixos.yml rename to .github/workflows/manual-nixos-v2.yml index a72b1adfeac0..49871d61bdfb 100644 --- a/.github/workflows/manual-nixos.yml +++ b/.github/workflows/manual-nixos-v2.yml @@ -1,6 +1,7 @@ -name: "Build NixOS manual" +name: "Build NixOS manual v2" -permissions: read-all +permissions: + contents: read on: pull_request_target: diff --git a/.github/workflows/manual-nixpkgs.yml b/.github/workflows/manual-nixpkgs-v2.yml similarity index 94% rename from .github/workflows/manual-nixpkgs.yml rename to .github/workflows/manual-nixpkgs-v2.yml index 52aefa8472ed..35409d8e106a 100644 --- a/.github/workflows/manual-nixpkgs.yml +++ b/.github/workflows/manual-nixpkgs-v2.yml @@ -1,6 +1,7 @@ -name: "Build Nixpkgs manual" +name: "Build Nixpkgs manual v2" -permissions: read-all +permissions: + contents: read on: pull_request_target: diff --git a/.github/workflows/nix-parse.yml b/.github/workflows/nix-parse-v2.yml similarity index 93% rename from .github/workflows/nix-parse.yml rename to .github/workflows/nix-parse-v2.yml index ffccf9d53de1..09cd162817ba 100644 --- a/.github/workflows/nix-parse.yml +++ b/.github/workflows/nix-parse-v2.yml @@ -1,6 +1,8 @@ -name: "Check whether nix files are parseable" +name: "Check whether nix files are parseable v2" -permissions: read-all +permissions: + pull-requests: read + contents: read on: # avoids approving first time contributors diff --git a/.mailmap b/.mailmap index ba9bcefb55e1..cac77e9d319a 100644 --- a/.mailmap +++ b/.mailmap @@ -1,5 +1,6 @@ ajs124 Anderson Torres +Atemu Daniel Løvbrøtte Olsen Fabian Affolter Janne Heß diff --git a/ci/OWNERS b/ci/OWNERS index 8904c846e816..b90b8b7699b3 100644 --- a/ci/OWNERS +++ b/ci/OWNERS @@ -11,12 +11,12 @@ # - There is no need for user/team listed here to have write access. # - No reviews will be requested for PRs that target the wrong base branch. # -# Processing of this file is implemented in workflows/codeowners.yml +# Processing of this file is implemented in workflows/codeowners-v2.yml # CI /.github/workflows @NixOS/Security @Mic92 @zowoq /.github/workflows/check-nix-format.yml @infinisil -/.github/workflows/codeowners.yml @infinisil +/.github/workflows/codeowners-v2.yml @infinisil /ci/OWNERS @infinisil /ci @infinisil @philiptaron @NixOS/Security @@ -367,4 +367,3 @@ nixos/tests/lxd/ @adamcstephens pkgs/by-name/in/incus/ @adamcstephens pkgs/by-name/lx/lxc* @adamcstephens pkgs/by-name/lx/lxd* @adamcstephens -pkgs/os-specific/linux/lxc/ @adamcstephens diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 03ad4d45ad5d..1ef671942192 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -1860,7 +1860,7 @@ }; atemu = { name = "Atemu"; - email = "atemu.main+nixpkgs@gmail.com"; + email = "nixpkgs@mail.atemu.net"; github = "Atemu"; githubId = 18599032; }; diff --git a/pkgs/by-name/ar/arc-browser/package.nix b/pkgs/by-name/ar/arc-browser/package.nix index 00e3e6757d83..8a45049cbf09 100644 --- a/pkgs/by-name/ar/arc-browser/package.nix +++ b/pkgs/by-name/ar/arc-browser/package.nix @@ -10,11 +10,11 @@ stdenvNoCC.mkDerivation (finalAttrs: { pname = "arc-browser"; - version = "1.65.0-54911"; + version = "1.66.0-55166"; src = fetchurl { url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg"; - hash = "sha256-7p1FizITL4GVvlDTV91nwYQZ7LKEd4snJQX0NvB81Qo="; + hash = "sha256-up+ScCjFgxlATUbCeWZcVF2jZGfCw018MfT6kAqAHO4="; }; nativeBuildInputs = [ undmg ]; diff --git a/pkgs/by-name/le/legcord/package.nix b/pkgs/by-name/le/legcord/package.nix index 453c42c8bbf5..6298f75f6e3d 100644 --- a/pkgs/by-name/le/legcord/package.nix +++ b/pkgs/by-name/le/legcord/package.nix @@ -38,7 +38,7 @@ stdenv.mkDerivation rec { pname = "legcord"; - version = "1.0.1"; + version = "1.0.2"; src = let @@ -47,11 +47,11 @@ stdenv.mkDerivation rec { { x86_64-linux = fetchurl { url = "${base}/v${version}/Legcord-${version}-linux-amd64.deb"; - hash = "sha256-kZ9dhSJjhYmpZJLbWP8nPP6Lxw+wLe3d9cCahfIomNM="; + hash = "sha256-MvSnYE6JLnZUA/Td0XuvOAENEtMGWSQuFFDa8cnBB1s="; }; aarch64-linux = fetchurl { url = "${base}/v${version}/Legcord-${version}-linux-arm64.deb"; - hash = "sha256-Ikyjmlt1F7f6WaYWuAgyzLP3zvQPCvMRZ1D9e79umgM="; + hash = "sha256-+HD162RfcNxNXpjW5HPAmhCQIFRXuPXdC/jQgT0aV1k="; }; }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");