workflows: self-test on change

All workflows where it's remotely useful now trigger on a pull_request
event when the workflow file itself is changed. This gives us basic
sanity testing of changes to workflow files itself and reduces the need
for manual tests in forks.

(cherry picked from commit 65315e5400)

.github/workflows/check-cherry-picks.yml

@@ -1,6 +1,9 @@
 name: "Check cherry-picks"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-cherry-picks.yml
   pull_request_target:
     branches:
       - 'release-**'

.github/workflows/check-format.yml

@@ -1,6 +1,9 @@
 name: Check that files are formatted
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-format.yml
   pull_request_target:
     types: [opened, synchronize, reopened, edited]
 

.github/workflows/check-shell.yml

@@ -1,6 +1,9 @@
 name: "Check shell"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/check-shell.yml
   pull_request_target:
     paths:
       - 'shell.nix'

.github/workflows/codeowners-v2.yml

@@ -23,6 +23,9 @@
 name: Codeowners v2
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/codeowners-v2.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
 
@@ -64,6 +67,7 @@ jobs:
         run: nix-build base/ci -A codeownersValidator
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_RO_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_RO_APP_ID }}
@@ -77,6 +81,7 @@ jobs:
           path: pr
 
       - name: Validate codeowners
+        if: steps.app-token.outputs.token
         run: result/bin/codeowners-validator
         env:
           OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
@@ -99,6 +104,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -111,6 +117,7 @@ jobs:
         run: nix-build ci -A requestReviews
 
       - name: Request reviews
+        if: steps.app-token.outputs.token
         run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/eval-aliases.yml

@@ -1,6 +1,9 @@
 name: Eval aliases
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/eval-aliases.yml
   pull_request_target:
 
 permissions: {}

.github/workflows/eval.yml

@@ -1,6 +1,9 @@
 name: Eval
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/eval.yml
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened]
   push:
@@ -175,6 +178,7 @@ jobs:
       # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
       # Can't use the token received from permissions above, because it can't get enough permissions
       - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
         id: app-token
         with:
           app-id: ${{ vars.OWNER_APP_ID }}
@@ -205,6 +209,7 @@ jobs:
         run: nix-build base/ci -A requestReviews
 
       - name: Labelling pull request
+        if: ${{ github.event_name == 'pull_request_target' }}
         run: |
           # Get all currently set rebuild labels
           gh api \
@@ -259,6 +264,7 @@ jobs:
           NUMBER: ${{ github.event.number }}
 
       - name: Requesting maintainer reviews
+        if: steps.app-token.outputs.token
         run: |
           # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
           # There appears to be no API to request reviews based on GitHub IDs

.github/workflows/get-merge-commit.yml

@@ -1,6 +1,9 @@
 name: Get merge commit
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/get-merge-commit.yml
   workflow_call:
     outputs:
       mergedSha:
@@ -38,7 +41,7 @@ jobs:
             push)
               echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
               ;;
-            pull_request_target)
+            pull_request*)
               if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
                 echo -e "Checking the commits:\n$commits"
                 echo "$commits" >> "$GITHUB_OUTPUT"

.github/workflows/lib-tests.yml

@@ -1,6 +1,9 @@
 name: "Building Nixpkgs lib-tests"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/lib-tests.yml
   pull_request_target:
     paths:
       - 'lib/**'

.github/workflows/manual-nixos-v2.yml

@@ -1,6 +1,9 @@
 name: "Build NixOS manual v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/manual-nixos-v2.yml
   pull_request_target:
     branches:
       - master

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,6 +1,9 @@
 name: "Build Nixpkgs manual v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/manual-nixpkgs-v2.yml
   pull_request_target:
     branches:
       - master

.github/workflows/nix-parse-v2.yml

@@ -1,6 +1,9 @@
 name: "Check whether nix files are parseable v2"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/nix-parse-v2.yml
   pull_request_target:
 
 permissions: {}

.github/workflows/nixpkgs-vet.yml

@@ -6,6 +6,9 @@
 name: Vet nixpkgs
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/nixpkgs-vet.yml
   pull_request_target:
     # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
     # Instead it causes an `edited` event, so we need to add it explicitly here.

.github/workflows/no-channel.yml

@@ -1,6 +1,9 @@
 name: "No channel PR"
 
 on:
+  pull_request:
+    paths:
+      - .github/workflows/no-channel.yml
   pull_request_target:
     # Re-run should be triggered when the base branch is updated, instead of silently failing
     types: [opened, synchronize, reopened, edited]