Fixes a bug that was originally found by Claude and reported to the NixOS
security team by Anthropic as a security issue.
Previously, the file list was never output for merge commits.
This could have allowed someone who buried an edit to a file that shouldn't be
edited manually in a merge commit to not trigger the check.
It isn't a security issue, though, because the manual-file-edits check is not
a security boundary (just a friendly reminder to committers).
Anthropic report ID: ANT-2026-223Q3FSE
When instantiating a dev-shell for x86_64-darwin, we cannot use 26.11's
pinned revision. Instead, we must use a revision that still supports
x86_64-darwin.
Print a warning when we need to use that revision, because it is likely
there will be subtle formatting & linting differences vs CI.
Discussed in AGENTS.md debate PR
Assisted by https://regex101.com/, my brain, and love for humanity and free software
Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
Paths within a --expr expression are relative to the script file,
while relative paths in NIX_PATH are relative to the caller's CWD.
We want the Nixpkgs import to be relative to update-pinned.sh itself,
so that it does not matter where it's executed from.
See https://github.com/NixOS/nixpkgs/issues/425551
This adds the small cost of building 'nixos-render-docs', a small python package.
For the benefit of improved iteration speed during refinement of the docs rendering
See: https://github.com/NixOS/nixpkgs/pull/535662 for motivation
With a dependency chain like
a -> b -> c
it was not possible to e.g. add a `meta.problems.removal` to b, because that would cause b to be entirely unavailable as a dependency.
This PR slightly lifts that restriction by allowing both a and b to be marked with such a problem without causing a CI failure.
This is useful for:
- Having a problem on a package that needs to be removed but still has dependents (which then also need a problem)
- Having a problem on a package that is aliased under another attribute, which counts as a dependency
Upstream archived the repo mid-2024 and I killed my own instance because
it became unreliable. The NixOS test has also been failing for a while
now, so I conclude that nobody cares about this package any more.
