Many simply never saw the invite email from github, and this error message is pretty unactionable.
It would also be a good idea to update the "About" description in https://github.com/orgs/NixOS/teams/nixpkgs-maintainers to indicate how to join.
(cherry picked from commit 470629541d)
By popular demand, this patch lets folks manually label PRs with the
label and make it stick, even if auto-labeler wouldn't label it itself
(presumably because the author didn't mark their commits according to
automation policy).
Assisted-by: Codex gpt-5.6-sol medium
(cherry picked from commit 9686621d1b)
This succeeded before the ESM conversion because we weren't in strict mode
(and therefore `line` was added to the global scope).
ES Modules run in strict mode by default, so this is a `ReferenceError` now.
TypeScript would have caught this! I will keep working on converting to it.
(cherry picked from commit 375b60d66b)
This commit hopefully improves readability: encapsulates some
intermediary decisions in variable, plus adopts early return decision
tree.
Assisted-by: Codex gpt-5.6-sol medium
(cherry picked from commit 403d5922cf)
Tests reflect status quo. They establish baseline for later policy
changes. Some test cases are obvious bugs (e.g. mass rebuild checks are
skipped on staging-nixos), others may also be questionable.
Assisted-by: Codex gpt-5.6-sol medium
(cherry picked from commit e1aa8c4d16)
This is in preparation to test the extracted pure function in the next
commit.
Assisted-by: Codex gpt-5.6-sol medium
(cherry picked from commit 3d17eabf1a)
Fixes a bug that was originally found by Claude and reported to the NixOS
security team by Anthropic as a security issue.
Previously, the file list was never output for merge commits.
This could have allowed someone who buried an edit to a file that shouldn't be
edited manually in a merge commit to not trigger the check.
It isn't a security issue, though, because the manual-file-edits check is not
a security boundary (just a friendly reminder to committers).
Anthropic report ID: ANT-2026-223Q3FSE
(cherry picked from commit e7804286db)
Discussed in AGENTS.md debate PR
Assisted by https://regex101.com/, my brain, and love for humanity and free software
Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
(cherry picked from commit 7eb5f48146)
`bot.js` already pulls reviews via GraphQL for the approval-count
labels. Move that fetch above the `handleMerge` call, add `commit
{ oid }` to the query, and pass the result through. `handleMerge` no
longer issues its own `listReviews` REST call.
While here, the `approvals` set is now derived from the same reviews
data. Two upsides:
- A reviewer who approved and was later dismissed no longer counts
towards the approval check; their review now surfaces with state
DISMISSED instead of leaving a stale `reviewed` event behind.
- `events` is no longer needed by `runChecklist` (it was only feeding
the approvals filter); the parameter is dropped from both call
sites. `handleMerge` still uses `events` for tracking the latest
push and merge-command comments.
Also drop the redundant `user` truthy checks (and the stale "some
users have been deleted" comment) in `runChecklist`. The GraphQL
query uses `author { ... on User { login id } }` and bot.js then
filters via `r.user?.login`, so by the time reviews reach
`runChecklist` every entry already has a populated `user`. Verified
by querying real PRs: bots surface as `{__typename: "Bot"}` (no
`login`/`id`, filtered out by bot.js), and deleted accounts surface
as the "ghost" user (login `"ghost"`, id `10137`), which passes the
filter but matches no committer - harmless for both checks.
Assisted-by: claude-code with claude-opus-4-8[1m]-high
(cherry picked from commit 0c1c3d4813)
The previous tip ("Sometimes GitHub gets stuck after enabling Auto
Merge") didn't explain why nothing happens immediately after the bot's
"Enabled Auto Merge" reply, leaving maintainers unsure whether to wait
or intervene. Spell out that Auto Merge waits for required CI before
queueing, that a later CI failure leaves the PR un-queued until it is
fixed, and link to GitHub's documentation; keep the existing "leave
another approval" workaround for the rare cases where Auto Merge stalls
after CI completes.
Assisted-by: claude-code with claude-opus-4-8[1m]-high
(cherry picked from commit 6f9325fb5d)
A "changes requested" review from a committer blocks both the merge
queue and auto-merge, but unlike approvals it isn't auto-dismissed
when new commits are pushed. Surface it as a checklist item so the
bot's reply explains the block instead of silently enabling
auto-merge that will never trigger.
Implementation pulls every review for the PR via `listReviews` and,
for each committer, takes the latest review whose state is
`APPROVED`/`CHANGES_REQUESTED`. The check fails if any committer's
latest stance is `CHANGES_REQUESTED`. Other review states fall out
naturally:
- A dismissed review surfaces as `DISMISSED`, so a committer
dismissing their own changes-requested review unblocks the PR.
- A comment-only follow-up surfaces as `COMMENTED`, so it doesn't
override an earlier actionable review - the prior stance still
stands until the committer explicitly approves or requests changes
again.
Assisted-by: claude-code with claude-opus-4-8[1m]-high
(cherry picked from commit b94b44d3f9)
The merge bot falls back to GitHub Auto Merge whenever the merge queue
won't accept a PR yet. That is the right move while CI is still
running, but pointless once CI has already failed: Auto Merge can never
trigger, and fixing CI requires a new push, which invalidates the merge
command anyway (the bot only acts on comments after the latest push).
Fetch the `no PR failures` commit status and, when the merge-queue
enqueue fails, branch on it. If CI has already failed
(`error`/`failure`), skip Auto Merge and reply that a fresh
`@NixOS/nixpkgs-merge-bot merge` comment is needed once CI is green
again. Otherwise (pending or missing status) enable Auto Merge as
before.
`merge()` now returns `{ reaction, messages }` so the CI-failure path
can leave a thumbs-down reaction rather than the rocket used for an
actual merge.
Closes#512554.
Assisted-by: claude-code with claude-opus-4-8[1m]-high
(cherry picked from commit da97bf8423)
