From fa3c98ed3c77cdf63577f37e59b08e271d7fe148 Mon Sep 17 00:00:00 2001 From: Wolfgang Walther Date: Tue, 13 May 2025 21:13:31 +0200 Subject: [PATCH] workflows: self-test on change All workflows where it's remotely useful now trigger on a pull_request event when the workflow file itself is changed. This gives us basic sanity testing of changes to workflow files itself and reduces the need for manual tests in forks. (cherry picked from commit 65315e54005197076a492dc5563d7195e659abb6) --- .github/workflows/check-cherry-picks.yml | 3 +++ .github/workflows/check-format.yml | 3 +++ .github/workflows/check-shell.yml | 3 +++ .github/workflows/codeowners-v2.yml | 7 +++++++ .github/workflows/eval-aliases.yml | 3 +++ .github/workflows/eval.yml | 6 ++++++ .github/workflows/get-merge-commit.yml | 5 ++++- .github/workflows/lib-tests.yml | 3 +++ .github/workflows/manual-nixos-v2.yml | 3 +++ .github/workflows/manual-nixpkgs-v2.yml | 3 +++ .github/workflows/nix-parse-v2.yml | 3 +++ .github/workflows/nixpkgs-vet.yml | 3 +++ .github/workflows/no-channel.yml | 3 +++ 13 files changed, 47 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-cherry-picks.yml b/.github/workflows/check-cherry-picks.yml index f74c83cb6ddf..d539bb568d36 100644 --- a/.github/workflows/check-cherry-picks.yml +++ b/.github/workflows/check-cherry-picks.yml @@ -1,6 +1,9 @@ name: "Check cherry-picks" on: + pull_request: + paths: + - .github/workflows/check-cherry-picks.yml pull_request_target: branches: - 'release-**' diff --git a/.github/workflows/check-format.yml b/.github/workflows/check-format.yml index caa6db054e15..01312cd8f170 100644 --- a/.github/workflows/check-format.yml +++ b/.github/workflows/check-format.yml @@ -1,6 +1,9 @@ name: Check that files are formatted on: + pull_request: + paths: + - .github/workflows/check-format.yml pull_request_target: types: [opened, synchronize, reopened, edited] diff --git a/.github/workflows/check-shell.yml b/.github/workflows/check-shell.yml index c8ecf553f107..c26bea7761bc 100644 --- a/.github/workflows/check-shell.yml +++ b/.github/workflows/check-shell.yml @@ -1,6 +1,9 @@ name: "Check shell" on: + pull_request: + paths: + - .github/workflows/check-shell.yml pull_request_target: paths: - 'shell.nix' diff --git a/.github/workflows/codeowners-v2.yml b/.github/workflows/codeowners-v2.yml index 3c0e49afb5c7..28b0ef43d5ac 100644 --- a/.github/workflows/codeowners-v2.yml +++ b/.github/workflows/codeowners-v2.yml @@ -23,6 +23,9 @@ name: Codeowners v2 on: + pull_request: + paths: + - .github/workflows/codeowners-v2.yml pull_request_target: types: [opened, ready_for_review, synchronize, reopened, edited] @@ -64,6 +67,7 @@ jobs: run: nix-build base/ci -A codeownersValidator - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 + if: vars.OWNER_RO_APP_ID id: app-token with: app-id: ${{ vars.OWNER_RO_APP_ID }} @@ -77,6 +81,7 @@ jobs: path: pr - name: Validate codeowners + if: steps.app-token.outputs.token run: result/bin/codeowners-validator env: OWNERS_FILE: pr/${{ env.OWNERS_FILE }} @@ -99,6 +104,7 @@ jobs: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 + if: vars.OWNER_APP_ID id: app-token with: app-id: ${{ vars.OWNER_APP_ID }} @@ -111,6 +117,7 @@ jobs: run: nix-build ci -A requestReviews - name: Request reviews + if: steps.app-token.outputs.token run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE" env: GH_TOKEN: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/eval-aliases.yml b/.github/workflows/eval-aliases.yml index 8dfb298c6da8..d3561468e9f0 100644 --- a/.github/workflows/eval-aliases.yml +++ b/.github/workflows/eval-aliases.yml @@ -1,6 +1,9 @@ name: Eval aliases on: + pull_request: + paths: + - .github/workflows/eval-aliases.yml pull_request_target: permissions: {} diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml index 55f58bf9cbac..017a3e942eb0 100644 --- a/.github/workflows/eval.yml +++ b/.github/workflows/eval.yml @@ -1,6 +1,9 @@ name: Eval on: + pull_request: + paths: + - .github/workflows/eval.yml pull_request_target: types: [opened, ready_for_review, synchronize, reopened] push: @@ -175,6 +178,7 @@ jobs: # See ./codeowners-v2.yml, reuse the same App because we need the same permissions # Can't use the token received from permissions above, because it can't get enough permissions - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6 + if: vars.OWNER_APP_ID id: app-token with: app-id: ${{ vars.OWNER_APP_ID }} @@ -205,6 +209,7 @@ jobs: run: nix-build base/ci -A requestReviews - name: Labelling pull request + if: ${{ github.event_name == 'pull_request_target' }} run: | # Get all currently set rebuild labels gh api \ @@ -259,6 +264,7 @@ jobs: NUMBER: ${{ github.event.number }} - name: Requesting maintainer reviews + if: steps.app-token.outputs.token run: | # maintainers.json contains GitHub IDs. Look up handles to request reviews from. # There appears to be no API to request reviews based on GitHub IDs diff --git a/.github/workflows/get-merge-commit.yml b/.github/workflows/get-merge-commit.yml index d39e2ad3acfc..edbda3e040eb 100644 --- a/.github/workflows/get-merge-commit.yml +++ b/.github/workflows/get-merge-commit.yml @@ -1,6 +1,9 @@ name: Get merge commit on: + pull_request: + paths: + - .github/workflows/get-merge-commit.yml workflow_call: outputs: mergedSha: @@ -38,7 +41,7 @@ jobs: push) echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT" ;; - pull_request_target) + pull_request*) if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then echo -e "Checking the commits:\n$commits" echo "$commits" >> "$GITHUB_OUTPUT" diff --git a/.github/workflows/lib-tests.yml b/.github/workflows/lib-tests.yml index 0643f980381b..d55a109aa9f5 100644 --- a/.github/workflows/lib-tests.yml +++ b/.github/workflows/lib-tests.yml @@ -1,6 +1,9 @@ name: "Building Nixpkgs lib-tests" on: + pull_request: + paths: + - .github/workflows/lib-tests.yml pull_request_target: paths: - 'lib/**' diff --git a/.github/workflows/manual-nixos-v2.yml b/.github/workflows/manual-nixos-v2.yml index fd0f91e2e0c7..c86d3eccd82d 100644 --- a/.github/workflows/manual-nixos-v2.yml +++ b/.github/workflows/manual-nixos-v2.yml @@ -1,6 +1,9 @@ name: "Build NixOS manual v2" on: + pull_request: + paths: + - .github/workflows/manual-nixos-v2.yml pull_request_target: branches: - master diff --git a/.github/workflows/manual-nixpkgs-v2.yml b/.github/workflows/manual-nixpkgs-v2.yml index f899ad409d50..5fc64af306af 100644 --- a/.github/workflows/manual-nixpkgs-v2.yml +++ b/.github/workflows/manual-nixpkgs-v2.yml @@ -1,6 +1,9 @@ name: "Build Nixpkgs manual v2" on: + pull_request: + paths: + - .github/workflows/manual-nixpkgs-v2.yml pull_request_target: branches: - master diff --git a/.github/workflows/nix-parse-v2.yml b/.github/workflows/nix-parse-v2.yml index aec48b0ac768..4b670331308e 100644 --- a/.github/workflows/nix-parse-v2.yml +++ b/.github/workflows/nix-parse-v2.yml @@ -1,6 +1,9 @@ name: "Check whether nix files are parseable v2" on: + pull_request: + paths: + - .github/workflows/nix-parse-v2.yml pull_request_target: permissions: {} diff --git a/.github/workflows/nixpkgs-vet.yml b/.github/workflows/nixpkgs-vet.yml index 80d6ba0b9aba..b9f9fd2c56f6 100644 --- a/.github/workflows/nixpkgs-vet.yml +++ b/.github/workflows/nixpkgs-vet.yml @@ -6,6 +6,9 @@ name: Vet nixpkgs on: + pull_request: + paths: + - .github/workflows/nixpkgs-vet.yml pull_request_target: # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`. # Instead it causes an `edited` event, so we need to add it explicitly here. diff --git a/.github/workflows/no-channel.yml b/.github/workflows/no-channel.yml index c5eae3c94e7d..ee305a12d61b 100644 --- a/.github/workflows/no-channel.yml +++ b/.github/workflows/no-channel.yml @@ -1,6 +1,9 @@ name: "No channel PR" on: + pull_request: + paths: + - .github/workflows/no-channel.yml pull_request_target: # Re-run should be triggered when the base branch is updated, instead of silently failing types: [opened, synchronize, reopened, edited]