Commit Graph

213 Commits

Author SHA1 Message Date
Michael Daniels
2496d47b76 ci/github-script/check-target-branch: convert to TypeScript
Only doing this one for now as a proof-of-concept.
2026-08-10 20:26:01 -04:00
Philip Taron
efa8264ee0 Revert ".github: Bump actions/checkout from 6.0.3 to 7.0.1" 2026-07-27 13:23:38 -07:00
dependabot[bot]
7079e863e7 .github: Bump actions/checkout from 6.0.3 to 7.0.1
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](df4cb1c069...3d3c42e5aa)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-24 11:22:46 +00:00
dependabot[bot]
942be243bd .github: Bump cachix/install-nix-action from 31.10.7 to 31.11.0
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.7 to 31.11.0.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](a49548c11d...630ae543ea)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-17 11:22:54 +00:00
dependabot[bot]
53c53d5d5b .github: Bump cachix/install-nix-action from 31.10.6 to 31.10.7
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.6 to 31.10.7.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](8aa03977d8...a49548c11d)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.10.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-10 11:22:46 +00:00
Aliaksandr
a100d091a0 ci/eval: name the base branch in the performance comparison summary
The performance comparison summary previously stated it compared against
"its pull request base branch (e.g., 'master')" regardless of the actual
base branch.

Plumb the base branch classification computed in prepare.js through the
eval workflow to the `compare` derivation so the summary names the real
base branch (e.g. "staging-25.11"). The local `eval.full` helper defaults
to "master", matching its touched-files convention.

Assisted-by: claude-code with claude-opus-4-8[1m]-high
2026-06-17 01:08:45 +03:00
dependabot[bot]
d90a8da39f .github: Bump actions/checkout from 6.0.2 to 6.0.3
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](de0fac2e45...df4cb1c069)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-06-05 11:22:54 +00:00
Michael Daniels
21211019cf .github: Bump cachix/cachix-action from 1eb2ef646ac0255473d23a5907ad7b04ce94065c to 5f2d7c5294214f71b873db4b969586b980625e71 (#520405) 2026-05-15 23:21:22 +00:00
dependabot[bot]
5d15d396db .github: Bump cachix/cachix-action
Bumps [cachix/cachix-action](https://github.com/cachix/cachix-action) from 1eb2ef646ac0255473d23a5907ad7b04ce94065c to 5f2d7c5294214f71b873db4b969586b980625e71.
- [Release notes](https://github.com/cachix/cachix-action/releases)
- [Changelog](https://github.com/cachix/cachix-action/blob/master/RELEASE.md)
- [Commits](1eb2ef646a...5f2d7c5294)

---
updated-dependencies:
- dependency-name: cachix/cachix-action
  dependency-version: 5f2d7c5294214f71b873db4b969586b980625e71
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-15 11:25:48 +00:00
dependabot[bot]
8a91364b57 .github: Bump actions/create-github-app-token from 3.1.1 to 3.2.0
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token) from 3.1.1 to 3.2.0.
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](1b10c78c78...bcd2ba4921)

---
updated-dependencies:
- dependency-name: actions/create-github-app-token
  dependency-version: 3.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-15 11:25:37 +00:00
dependabot[bot]
0b995b605e .github: Bump cachix/install-nix-action from 31.10.5 to 31.10.6
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.5 to 31.10.6.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](ab739621df...8aa03977d8)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.10.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-08 11:27:24 +00:00
Michael Daniels
1c3e149546 Reapply {ci,workflows}: allow multiple blocking reviews"
A couple of bugfixes, but the problem was that the apps weren't installed.
2026-05-03 18:17:03 -04:00
Michael Daniels
cd2e5a371b Revert "{ci,workflows}: allow multiple blocking reviews" 2026-05-03 13:21:39 -04:00
Michael Daniels
636fc13366 {ci,workflows}: allow multiple blocking reviews 2026-05-02 18:09:26 -04:00
dependabot[bot]
416db884b3 .github: Bump cachix/install-nix-action from 31.10.4 to 31.10.5
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.4 to 31.10.5.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](616559265b...ab739621df)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.10.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-24 11:23:13 +00:00
dependabot[bot]
a0eec11bf7 .github: Bump actions/upload-artifact from 7.0.0 to 7.0.1
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](bbbca2ddaa...043fb46d1a)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-17 11:23:14 +00:00
Kamil Monicz
8926c73f50 ci/eval/compare: Expose attrdiff by kernel and platform 2026-04-13 10:53:48 +00:00
Michael Daniels
e209b3a529 .github: Bump actions/github-script from 8.0.0 to 9.0.0 (#508580) 2026-04-10 14:48:07 +00:00
dependabot[bot]
2b2d5e95d4 .github: Bump cachix/install-nix-action from 31.10.3 to 31.10.4
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.3 to 31.10.4.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](96951a368b...616559265b)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.10.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-10 11:23:15 +00:00
dependabot[bot]
b7e66be21f .github: Bump actions/github-script from 8.0.0 to 9.0.0
Bumps [actions/github-script](https://github.com/actions/github-script) from 8.0.0 to 9.0.0.
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](ed597411d8...3a2844b7e9)

---
updated-dependencies:
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-04-10 11:23:10 +00:00
Michael Daniels
ff444b86a6 workflows/eval: increase timeout
lixPackageSets.lix_2_93.lix seems to need a bit longer on x86_64-linux.
2026-03-28 18:12:40 -04:00
dependabot[bot]
3a22ec7c2c .github: Bump cachix/install-nix-action from 31.10.1 to 31.10.3
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.1 to 31.10.3.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](1ca7d21a94...96951a368b)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-27 11:23:06 +00:00
dependabot[bot]
f4056f3bd1 .github: Bump cachix/cachix-action from 16 to 17
Bumps [cachix/cachix-action](https://github.com/cachix/cachix-action) from 16 to 17.
- [Release notes](https://github.com/cachix/cachix-action/releases)
- [Commits](3ba601ff5b...1eb2ef646a)

---
updated-dependencies:
- dependency-name: cachix/cachix-action
  dependency-version: '17'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-20 11:23:02 +00:00
Michael Daniels
be54fd321f workflows: bump cachix/install-nix-action from 31.9.1 to 31.10.1 (#500377) 2026-03-17 00:42:33 +00:00
dependabot[bot]
69a467d1fb workflows: bump cachix/install-nix-action from 31.9.1 to 31.10.1
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.9.1 to 31.10.1.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](2126ae7fc5...1ca7d21a94)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.10.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-16 18:13:46 -04:00
dependabot[bot]
6ef2f5da34 workflows/eval: bump actions/download-artifact from 8.0.0 to 8.0.1
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](70fc10c6e5...3e5f45b2cf)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-16 18:11:38 -04:00
Jamie Magee
55b21e9fd6 workflows: document write permissions 2026-03-04 14:46:50 -08:00
Michael Daniels
3f9b72a015 build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 (#495812) 2026-03-02 22:47:35 +00:00
dependabot[bot]
60662ebb5e build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](b7c566a772...bbbca2ddaa)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02 12:10:36 +00:00
dependabot[bot]
57233d3255 build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 7.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](37930b1c2a...70fc10c6e5)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02 12:10:28 +00:00
dependabot[bot]
671d98531f build(deps): bump cachix/install-nix-action from 31.9.0 to 31.9.1
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.9.0 to 31.9.1.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](4e002c8ec8...2126ae7fc5)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.9.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-02-16 12:27:26 +00:00
Philip Taron
c066ab53a5 workflows/eval: Un-parallelize misc, fixing check, and add modules meta check (#484265) 2026-01-27 15:51:41 +00:00
Samuel Dionne-Riel
f58b11edad workflows/eval: Ensure NixOS modules meta is valid
As observed in #484155, it was possible for broken meta information to
slip its way into the NixOS modules system. It looks like that data was
never checked. At this point I wonder if it ever was *used* in a
programmatic manner, given how long it took for it to get noticed.

This simple check causes the results to be evaluated in a format that
isn't "Nix-brained". Not using `--json` *could* allow `<LAMBDA>` to be
in the output, which is AFAICT undesirable.

```
 $ nix-instantiate --strict --eval --expr '{ x = a: a; }'
{ x = <LAMBDA>; }

 $ nix-instantiate --strict --eval --expr --json '{ x = a: a; }'
error:
       … while evaluating attribute 'x'
         at «string»:1:3:
            1| { x = a: a; }
             |   ^

       error: cannot convert a function to JSON
       at «string»:1:3:
            1| { x = a: a; }
             |   ^
```
2026-01-27 08:43:50 -05:00
Samuel Dionne-Riel
40d295d46d Revert "workflows/eval.misc: run tasks in parallel"
This reverts commit 3d9cb9f355.

In 3d9cb9f355 (#436171), the two check
commands were combined in the same step, and backgrounded, `wait`ing on
their completion.

`help wait` states the following:

> If ID is not given, waits for all currently active child processes,
> and the return status is zero.

The result was that this check's misc check results were accidentally
thrown away. Oops.
2026-01-27 08:43:50 -05:00
Philip Taron
b50c080ddb build(deps): bump cachix/cachix-action from 0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad to 3ba601ff5bbb07c7220846facfa2cd81eeee15a1 (#483979) 2026-01-26 12:44:25 +00:00
dependabot[bot]
cd561c72fe build(deps): bump cachix/cachix-action
Bumps [cachix/cachix-action](https://github.com/cachix/cachix-action) from 0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad to 3ba601ff5bbb07c7220846facfa2cd81eeee15a1.
- [Release notes](https://github.com/cachix/cachix-action/releases)
- [Commits](0fc020193b...3ba601ff5b)

---
updated-dependencies:
- dependency-name: cachix/cachix-action
  dependency-version: 3ba601ff5bbb07c7220846facfa2cd81eeee15a1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-26 12:25:15 +00:00
dependabot[bot]
0f2f886044 build(deps): bump actions/checkout from 6.0.1 to 6.0.2
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](8e8c483db8...de0fac2e45)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-26 12:24:55 +00:00
Dyego Aurélio
8c4f3d3aa4 workflows/eval: find and isolate ci/pinned.json bump commits
When testVersions is enabled, the version matrix check now identifies
the specific commit that modified ci/pinned.json, rather than evaluating
the full PR. This allows formatting changes and other modifications to
coexist in the same PR without affecting the hash consistency check.

The workflow now:
- Adds headSha input to compare PR commits against target
- Finds the single commit that touched ci/pinned.json
- Errors if multiple commits modify it (to ensure clear attribution)
- Passes the bump commit to the checkout action for isolated evaluation
- Reports which commit was evaluated in the summary

The actual cherry-pick and pinned checkout handling is delegated to
the checkout action via the new `untrusted-pin-bump` input.

Co-Authored-By: Matt Sturgeon <matt@sturgeon.me.uk>
2026-01-20 18:37:28 -03:00
Michael Daniels
a4d5f8a6b1 {workflows/eval,ci/github-script}: check for mass rebuilds targeting master/release-* branches 2026-01-19 13:02:09 -05:00
Philip Taron
1fb8c4a221 build(deps): bump cachix/install-nix-action from 31.8.4 to 31.9.0 (#470998) 2025-12-17 01:41:35 +00:00
Philip Taron
7dde039464 build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#470996) 2025-12-16 17:58:02 +00:00
dependabot[bot]
be73f48212 build(deps): bump cachix/install-nix-action from 31.8.4 to 31.9.0
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.8.4 to 31.9.0.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](0b0e072294...4e002c8ec8)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-12-15 11:03:40 +00:00
dependabot[bot]
1463c436d8 build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0
Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](018cc2cf5b...37930b1c2a)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-12-15 11:03:28 +00:00
dependabot[bot]
c789135d93 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](330a01c490...b7c566a772)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-12-15 11:03:24 +00:00
dependabot[bot]
25c33e559a build(deps): bump actions/checkout from 6.0.0 to 6.0.1
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.0 to 6.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](1af3b93b68...8e8c483db8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-12-08 11:03:57 +00:00
Wolfgang Walther
1289456d3b workflows: run smaller jobs on ubuntu-slim
This is in public preview now. These runners run in a docker container
with only a single vCPU instead of 4 like the other jobs. For most of
our jobs, this should be plenty, except for eval and linting.
2025-11-25 11:44:14 +01:00
Wolfgang Walther
8217a51233 build(deps): bump cachix/install-nix-action from 31.8.3 to 31.8.4 (#464563) 2025-11-24 13:04:20 +00:00
dependabot[bot]
4820fb4bf3 build(deps): bump cachix/install-nix-action from 31.8.3 to 31.8.4
Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.8.3 to 31.8.4.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](7ec16f2c06...0b0e072294)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.8.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-11-24 12:17:12 +00:00
dependabot[bot]
6029d82a8a build(deps): bump actions/checkout from 5.0.0 to 6.0.0
Bumps [actions/checkout](https://github.com/actions/checkout) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](08c6903cd8...1af3b93b68)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-11-24 12:17:05 +00:00
Wolfgang Walther
807d304380 workflows: make cachix optional
If cachix fails to install, we don't actually need to error out - we can
still continue at the cost of building stuff more than required. That's
better than erroring out, just because cachix has another hiccup,
especially for the Merge Queue.
2025-11-18 13:13:26 +01:00