python3Packages.dict2css: enable tests

No support for typer >= 0.27
https://github.com/pyupio/safety/pull/865

.editorconfig

@@ -79,7 +79,7 @@ indent_size = unset
 trim_trailing_whitespace = true
 
 # binaries
-[*.{nib,torrent}]
+[*.nib]
 end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset

.gitattributes

@@ -62,6 +62,3 @@ ci/OWNERS linguist-language=CODEOWNERS
 # patching CRLF line endings from an upstream source package.
 *.diff !text !eol
 *.patch !text !eol
-
-# Torrent files are binary files and should not be re-encoded.
-*.torrent !text !eol

.github/actions/checkout/action.yml

@@ -13,13 +13,6 @@ inputs:
 runs:
   using: composite
   steps:
-    # We don't actually need anything in this directory, but we need a small
-    # sparse checkout, and this directory is small.
-    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      with:
-        persist-credentials: false
-        sparse-checkout: .github/actions
-
     - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
@@ -44,7 +37,7 @@ runs:
             })
           }
 
-          // These are set automatically by the sparse checkout for .github/actions.
+          // These are set automatically by the spare checkout for .github/actions.
           // Undo them, otherwise git fetch below will not do anything.
           await run('git', 'config', 'unset', 'remote.origin.promisor')
           await run('git', 'config', 'unset', 'remote.origin.partialclonefilter')

.github/workflows/backport.yml

@@ -51,7 +51,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@6b65649031ac6d18ffdfd0c0820e9436f3fde22b # v4.6.1
+        uses: korthout/backport-action@2e830a1d0b8269505846ddd407a70876913ad1f8 # v4.6.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           add_author_as_reviewer: true

.github/workflows/bot.yml

@@ -49,7 +49,7 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false --no-audit @actions/artifact bottleneck
+        run: npm ci --package-lock-only=false @actions/artifact bottleneck
         working-directory: ci/github-script
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
@@ -76,8 +76,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const { default: bot } = await import('${{ github.workspace }}/ci/github-script/bot.js')
-            await bot({
+            require('./ci/github-script/bot.js')({
               github,
               context,
               core,

.github/workflows/build.yml

@@ -49,13 +49,17 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 60
     steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
       - name: Checkout the merge commit
-        uses: $/.github/actions/checkout
+        uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -24,10 +24,6 @@ on:
       # not evaluate untrusted code.
       NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY:
         required: false
-      # Can be provided in pull requests because the job it is used in does
-      # not evaluate untrusted code.
-      NIXPKGS_CI_APP_PRIVATE_KEY:
-        required: false
       # Should only be provided in the merge queue, not in pull requests,
       # where we're evaluating untrusted code.
       CACHIX_AUTH_TOKEN_GHA:
@@ -55,7 +51,7 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false --no-audit bottleneck
+        run: npm ci --package-lock-only=false bottleneck
         working-directory: trusted/ci/github-script
 
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
@@ -80,8 +76,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
             const targetsStable = JSON.parse(process.env.TARGETS_STABLE)
-            const { default: commits } = await import('${{ github.workspace }}/trusted/ci/github-script/commits.ts')
-            await commits({
+            require('./trusted/ci/github-script/commits.js')({
               github,
               context,
               core,
@@ -126,8 +121,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            const { default: checkManualFileEdits } = await import('${{ github.workspace }}/trusted/ci/github-script/manual-file-edits.ts')
-            await checkManualFileEdits({
+            require('./trusted/ci/github-script/manual-file-edits.js')({
               github,
               context,
               core,
@@ -140,87 +134,21 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
         run: gh api /rate_limit | jq
 
-  reminders:
-    if: inputs.baseBranch && inputs.headBranch
-    permissions:
-      pull-requests: write
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 8
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          path: trusted
-          sparse-checkout: |
-            ci/github-script
-
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_CLIENT_ID
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Post reminders
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          script: |
-            const { default: postReminders } = await import('${{ github.workspace }}/trusted/ci/github-script/reminders.ts')
-            await postReminders({
-              github,
-              context,
-              core,
-              dry: context.eventName == 'pull_request',
-              repoPath: 'trusted',
-            })
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-  github-script:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      - name: Checkout merge and target commits
-        uses: $/.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
-
-      - name: Install dependencies to trusted/
-        run: |
-          npm ci --package-lock-only=false --no-audit
-          echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"
-        working-directory: nixpkgs/trusted/ci/github-script
-
-      - name: Link trusted/ dependencies to untrusted/
-        run: ln -s "$PWD/trusted/ci/github-script/node_modules" untrusted/ci/github-script/node_modules
-        working-directory: nixpkgs
-
-      - name: Check ci/github-script
-        run: npm test
-        working-directory: nixpkgs/untrusted/ci/github-script
-
   owners:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 5
     steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
       - name: Checkout merge and target commits
-        uses: $/.github/actions/checkout
+        uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

.github/workflows/comment.yml

@@ -43,7 +43,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const { handleMergeComment } = await import('${{ github.workspace }}/ci/github-script/merge.js')
+            const { handleMergeComment } = require('./ci/github-script/merge.js')
             const { body, node_id } = context.payload.comment
 
             await handleMergeComment({

.github/workflows/eval.yml

@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Load supported versions
         id: versions
@@ -174,8 +174,12 @@ jobs:
           sudo mkswap /swap
           sudo swapon /swap
 
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
       - name: Check out the PR at merged and target commits
-        uses: $/.github/actions/checkout
+        uses: ./.github/actions/checkout
         with:
           # For versioned evals, use the target as the untrusted base and apply the pin-bump commit
           merged-as-untrusted-at: ${{ matrix.version && inputs.targetSha || inputs.mergedSha }}
@@ -183,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -255,8 +259,12 @@ jobs:
       statuses: write # creating 'Eval Summary' commit statuses
     timeout-minutes: 5
     steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
       - name: Check out the PR at the target commit
-        uses: $/.github/actions/checkout
+        uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
@@ -269,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Combine all output paths and eval stats
         run: |
@@ -367,8 +375,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           script: |
-            const { checkTargetBranch } = await import('${{ github.workspace }}/nixpkgs/trusted/ci/github-script/check-target-branch.ts')
-            await checkTargetBranch({
+            require('./nixpkgs/trusted/ci/github-script/check-target-branch.ts')({
               github,
               context,
               core,
@@ -469,13 +476,17 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
       - name: Checkout the merge commit
-        uses: $/.github/actions/checkout
+        uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'

.github/workflows/lint.yml

@@ -26,12 +26,16 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
       - name: Checkout the merge commit
-        uses: $/.github/actions/checkout
+        uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -57,12 +61,16 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
       - name: Checkout the merge commit
-        uses: $/.github/actions/checkout
+        uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -82,13 +90,17 @@ jobs:
     runs-on: ubuntu-24.04-arm
     timeout-minutes: 10
     steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions
       - name: Checkout merge and target commits
-        uses: $/.github/actions/checkout
+        uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -130,9 +142,9 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { default: checkCommitMessages } = await import('${{ github.workspace }}/trusted/ci/github-script/lint-commits.ts')
+            const checkCommitMessages = require('./trusted/ci/github-script/lint-commits.js')
 
-            await checkCommitMessages({
+            checkCommitMessages({
               github,
               context,
               core,

.github/workflows/merge-group.yml

@@ -29,7 +29,7 @@ jobs:
         with:
           persist-credentials: false
           sparse-checkout: |
-            ci/github-script
+            ci/github-script/supportedSystems.js
 
       - id: prepare
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -38,8 +38,8 @@ jobs:
           TARGET_SHA: ${{ inputs.targetSha }}
         with:
           script: |
-            const { classify } = await import('${{ github.workspace }}/ci/github-script/supportedBranches.ts')
-            const { default: supportedSystems } = await import('${{ github.workspace }}/ci/github-script/supportedSystems.ts')
+            const { classify } = require('./ci/supportedBranches.js')
+            const supportedSystems = require('./ci/github-script/supportedSystems.js')
 
             const baseBranch = (
               context.payload.merge_group?.base_ref ??
@@ -63,7 +63,7 @@ jobs:
   check:
     name: Check
     needs: [prepare]
-    uses: $/.github/workflows/check.yml
+    uses: ./.github/workflows/check.yml
     permissions:
       pull-requests: write # cherry-picks: unused in merge queue but required for check workflow
     secrets:
@@ -75,7 +75,7 @@ jobs:
   lint:
     name: Lint
     needs: [prepare]
-    uses: $/.github/workflows/lint.yml
+    uses: ./.github/workflows/lint.yml
     secrets:
       CACHIX_AUTH_TOKEN_GHA: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
     with:
@@ -85,7 +85,7 @@ jobs:
   eval:
     name: Eval
     needs: [prepare]
-    uses: $/.github/workflows/eval.yml
+    uses: ./.github/workflows/eval.yml
     # The eval workflow requests these permissions so we must explicitly allow them,
     # even though they are unused when working with the merge queue.
     permissions:
@@ -103,7 +103,7 @@ jobs:
   build:
     name: Build
     needs: [prepare]
-    uses: $/.github/workflows/build.yml
+    uses: ./.github/workflows/build.yml
     secrets:
       CACHIX_AUTH_TOKEN_GHA: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
     with:

.github/workflows/periodic-merge-24h.yml

@@ -40,7 +40,7 @@ jobs:
           - name: merge-base(master,staging) → haskell-updates
             from: master staging
             into: haskell-updates
-    uses: $/.github/workflows/periodic-merge.yml
+    uses: ./.github/workflows/periodic-merge.yml
     with:
       from: ${{ matrix.pairs.from }}
       into: ${{ matrix.pairs.into }}

.github/workflows/periodic-merge-6h.yml

@@ -37,7 +37,7 @@ jobs:
             into: staging
           - from: master
             into: staging-nixos
-    uses: $/.github/workflows/periodic-merge.yml
+    uses: ./.github/workflows/periodic-merge.yml
     with:
       from: ${{ matrix.pairs.from }}
       into: ${{ matrix.pairs.into }}

.github/workflows/periodic-merge.yml

@@ -32,7 +32,7 @@ jobs:
           client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
           private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
           permission-contents: write
-          permission-issues: write
+          permission-pull-requests: write
 
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -66,4 +66,4 @@ jobs:
             Periodic merge from `${{ inputs.from }}` into [`${{ inputs.into }}`](https://github.com/NixOS/nixpkgs/tree/${{ inputs.into }}) has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          gh issue comment 562905 --body "$BODY_TEXT"
+          gh pr comment 105153 --body "$BODY_TEXT"

.github/workflows/pull-request-target.yml

@@ -64,8 +64,7 @@ jobs:
           #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
           retry-exempt-status-codes: 400,401,403,404
           script: |
-            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.js')
-            await prepare({
+            require('./ci/github-script/prepare.js')({
               github,
               context,
               core,
@@ -75,14 +74,13 @@ jobs:
   check:
     name: Check
     needs: [prepare]
-    uses: $/.github/workflows/check.yml
+    uses: ./.github/workflows/check.yml
     permissions:
       # cherry-picks
       pull-requests: write
     secrets:
       NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY }}
       NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY }}
-      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
     with:
       baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       headBranch: ${{ needs.prepare.outputs.headBranch }}
@@ -92,7 +90,7 @@ jobs:
   lint:
     name: Lint
     needs: [prepare]
-    uses: $/.github/workflows/lint.yml
+    uses: ./.github/workflows/lint.yml
     with:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
@@ -100,7 +98,7 @@ jobs:
   eval:
     name: Eval
     needs: [prepare]
-    uses: $/.github/workflows/eval.yml
+    uses: ./.github/workflows/eval.yml
     permissions:
       # compare
       pull-requests: write
@@ -119,7 +117,7 @@ jobs:
   bot:
     name: Bot
     needs: [prepare, eval]
-    uses: $/.github/workflows/bot.yml
+    uses: ./.github/workflows/bot.yml
     permissions:
       issues: write
       pull-requests: write
@@ -131,7 +129,7 @@ jobs:
   build:
     name: Build
     needs: [prepare]
-    uses: $/.github/workflows/build.yml
+    uses: ./.github/workflows/build.yml
     with:
       artifact-prefix: ${{ inputs.artifact-prefix }}
       baseBranch: ${{ needs.prepare.outputs.baseBranch }}

.github/workflows/review.yml

@@ -40,7 +40,7 @@ jobs:
           github-token: ${{ steps.app-token.outputs.token || github.token }}
           retries: 3
           script: |
-            const { handleMergeComment } = await import('${{ github.workspace }}/ci/github-script/merge.js')
+            const { handleMergeComment } = require('./ci/github-script/merge.js')
 
             // PRs from forks don't have any PRs associated by default.
             // Thus, we request the PR number with an API call *to* the fork's repo.

.github/workflows/teams.yml

@@ -38,7 +38,7 @@ jobs:
             maintainers/github-teams.json
 
       - name: Install dependencies
-        run: npm ci --package-lock-only=false --no-audit bottleneck
+        run: npm ci --package-lock-only=false bottleneck
         working-directory: ci/github-script
 
       - name: Synchronise teams
@@ -46,8 +46,7 @@ jobs:
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |
-            const { default: getTeams } = await import('${{ github.workspace }}/ci/github-script/get-teams.js')
-            await getTeams({
+            require('./ci/github-script/get-teams.js')({
               github,
               context,
               core,
@@ -79,3 +78,4 @@ jobs:
             This is an automated PR to sync the GitHub teams with access to this repository to the `lib.teams` list.
 
             This PR can be merged without taking any further action.
+

.github/workflows/test.yml

@@ -35,8 +35,7 @@ jobs:
           #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
           retry-exempt-status-codes: 400,401,403,404
           script: |
-            const { default: prepare } = await import('${{ github.workspace }}/ci/github-script/prepare.js')
-            await prepare({
+            require('./ci/github-script/prepare.js')({
               github,
               context,
               core,
@@ -62,11 +61,9 @@ jobs:
               '.github/workflows/lint.yml',
               '.github/workflows/merge-group.yml',
               '.github/workflows/test.yml',
-              'ci/github-script/package.json',
-              'ci/github-script/package-lock.json',
-              'ci/github-script/supportedBranches.ts',
-              'ci/github-script/supportedSystems.ts',
+              'ci/github-script/supportedSystems.js',
               'ci/pinned.json',
+              'ci/supportedBranches.js',
               'pkgs/top-level/release-supported-systems.json',
             ].includes(file))) core.setOutput('merge-group', true)
 
@@ -81,29 +78,25 @@ jobs:
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
               'ci/github-script/check-target-branch.ts',
-              'ci/github-script/commits.ts',
-              'ci/github-script/get-pr-commit-details.ts',
-              'ci/github-script/lint-commits.ts',
-              'ci/github-script/manual-file-edits.ts',
+              'ci/github-script/commits.js',
+              'ci/github-script/get-pr-commit-details.js',
+              'ci/github-script/lint-commits.js',
               'ci/github-script/merge.js',
-              'ci/github-script/package.json',
-              'ci/github-script/package-lock.json',
               'ci/github-script/prepare.js',
-              'ci/github-script/reminders.ts',
               'ci/github-script/reviewers.js',
-              'ci/github-script/reviews.ts',
-              'ci/github-script/supportedBranches.ts',
-              'ci/github-script/supportedSystems.ts',
+              'ci/github-script/reviews.js',
+              'ci/github-script/supportedSystems.js',
               'ci/github-script/withRateLimit.js',
               'ci/pinned.json',
+              'ci/supportedBranches.js',
               'pkgs/top-level/release-supported-systems.json',
-            ].includes(file) || file.startsWith('ci/github-script/reminders/'))) core.setOutput('pr', true)
+            ].includes(file))) core.setOutput('pr', true)
 
   merge-group:
     if: needs.prepare.outputs.merge-group
     name: Merge Group
     needs: [prepare]
-    uses: $/.github/workflows/merge-group.yml
+    uses: ./.github/workflows/merge-group.yml
     # Those are actually only used on the merge_group event, but will throw an error if not set.
     permissions:
       pull-requests: write # unused on pull_request, required by merge-group workflow
@@ -117,7 +110,7 @@ jobs:
     if: needs.prepare.outputs.pr
     name: PR
     needs: [prepare]
-    uses: $/.github/workflows/pull-request-target.yml
+    uses: ./.github/workflows/pull-request-target.yml
     # Those are actually only used on the pull_request_target event, but will throw an error if not set.
     permissions:
       issues: write # unused on pull_request, required by bot workflow

.mailmap

@@ -6,7 +6,6 @@ Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
 Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
 Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
-Ethan Carter Edwards <ethan@ethancedwards.com> <ethancedwards8@users.noreply.github.com>
 Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
 Fiona Behrens <me@kloenk.dev>
 Fiona Behrens <me@kloenk.dev> <me@kloenk.de>
@@ -21,8 +20,6 @@ Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
 Katalin Rebhan <me@dblsaiko.net>
 Lin Jian <me@linj.tech> <linj.dev@outlook.com>
 Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
-Marie Ramlow <marie@marie.cologne> <me@nycode.dev>
-Marie Ramlow <marie@marie.cologne> <tabmeier12@gmail.com>
 Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>
 Martin Häcker <spamfaenger@gmx.de> <spamfaenger@gmx.de>
 moni <lythe1107@gmail.com> <lythe1107@icloud.com>

CONTRIBUTING.md

@@ -587,9 +587,9 @@ CI [enforces](./.github/workflows/lint.yml) all Nix files to be formatted using
 
 You can ensure this locally using either of these commands:
 ```
-nix fmt
-nix develop --command treefmt
 nix-shell --run treefmt
+nix develop --command treefmt
+nix fmt
 ```
 
 If you're starting your editor in `nix-shell` or `nix develop`, you can also set it up to automatically run `treefmt` on save.
@@ -957,6 +957,7 @@ The following situations are fully or partially exempt:
 
 If you believe that someone is using automation without appropriate disclosure and review, you can politely ask them if that’s the case and point them to this policy as appropriate.
 Please assume good faith and remain civil; it’s not always possible to determine, and it is more likely that someone overlooked this policy than deliberately violated it.
+If you think someone is continuing to break the policy after this, please escalate to the [Nixpkgs core team](https://nixos.org/community/teams/nixpkgs-core/) rather than fighting over it.
 
 If a contribution is clearly in violation of the policy (e.g. the contributor admits it was not followed, or there are AI tool attributions that do not meet our required format), it can be closed or hidden, preferably after informing the contributor of the policy and giving them a chance to address the violations.
 Deliberate violations of this policy are considered to break the [Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) clause against “Wasting other people’s time with low quality contributions, including but not limited to LLM and bot spam”.

ci/OWNERS

@@ -32,8 +32,8 @@
 /lib/asserts.nix            @infinisil @hsjobeki @llakala
 /lib/path/*                 @infinisil @hsjobeki @llakala
 /lib/fileset                @infinisil @hsjobeki @llakala
-/maintainers/github-teams.json @infinisil @llakala @NixOS/nixpkgs-ci
-/maintainers/computed-team-list.nix @infinisil @llakala @NixOS/nixpkgs-ci
+/maintainers/github-teams.json @infinisil @llakala
+/maintainers/computed-team-list.nix @infinisil @llakala
 ## Standard environment–related libraries
 /lib/customisation.nix      @alyssais @NixOS/stdenv @llakala
 /lib/derivations.nix        @NixOS/stdenv @llakala
@@ -97,7 +97,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 # Contributor documentation
 /CONTRIBUTING.md
 /.github/PULL_REQUEST_TEMPLATE.md
-/doc/contributing.md @infinisil
+/doc/contributing/
+/doc/contributing/contributing-to-documentation.chapter.md @jtojnar
 /lib/README.md
 /doc/README.md
 /nixos/README.md
@@ -105,6 +106,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/by-name/README.md
 /maintainers/README.md
 
+# User-facing development documentation
+/doc/development.md @infinisil
+/doc/development @infinisil
+
 # NixOS Internals
 /nixos/default.nix                                    @infinisil
 /nixos/lib/from-env.nix                               @infinisil
@@ -194,7 +199,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @wolfgangwalther
 /maintainers/scripts/haskell                  @sternenseemann @maralorn @wolfgangwalther
 /pkgs/development/compilers/ghc               @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix  @sternenseemann @maralorn @wolfgangwalther @OPNA2608 @liberodark @NixOS/loongarch64
+/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix  @sternenseemann @maralorn @wolfgangwalther @OPNA2608
 /pkgs/development/haskell-modules             @sternenseemann @maralorn @wolfgangwalther
 /pkgs/test/haskell                            @sternenseemann @maralorn @wolfgangwalther
 /pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @wolfgangwalther
@@ -356,10 +361,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/kakoune     @philiptaron
 
 # LuaPackages
-/pkgs/development/interpreters/lua-5  @NixOS/lua
-/pkgs/development/interpreters/luajit @NixOS/lua
 /pkgs/development/lua-modules         @NixOS/lua
-/pkgs/top-level/lua-packages.nix      @NixOS/lua
 
 # Neovim
 /pkgs/applications/editors/neovim           @NixOS/neovim
@@ -388,9 +390,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /doc/build-helpers/images/dockertools.section.md @roberth @jhol
 
 # Go
-/doc/languages-frameworks/go.section.md @kalbasit @Mic92
-/pkgs/build-support/go @kalbasit @Mic92
-/pkgs/development/compilers/go @kalbasit @Mic92
+/doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92
+/pkgs/build-support/go @kalbasit @katexochen @Mic92
+/pkgs/development/compilers/go @kalbasit @katexochen @Mic92
 
 # GNOME
 /pkgs/desktops/gnome                              @NixOS/gnome
@@ -444,9 +446,9 @@ nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @
 /doc/hooks/zig.section.md       @RossComputerGuy
 
 # Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92
-nixos/tests/buildbot.nix                               @Mic92
-pkgs/development/tools/continuous-integration/buildbot @Mic92
+nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
+nixos/tests/buildbot.nix                               @Mic92 @zowoq
+pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
 
 # Pretix
 pkgs/by-name/pr/pretix/ @mweinelt
@@ -523,7 +525,3 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @4evy @johnrtitor
 /nixos/lib/testing                                          @NixOS/test-driver
 /nixos/tests/nixos-test-driver                              @NixOS/test-driver
 /nixos/modules/virtualisation/nspawn-container/run-nspawn   @NixOS/test-driver
-
-# Boot security
-/pkgs/by-name/au/autopen    @NixOS/boot-security
-/pkgs/misc/signed-packages  @NixOS/boot-security

ci/README.md

@@ -104,7 +104,7 @@ For the purposes of CI, branches in the NixOS/nixpkgs repository are classified
 
 Some branches also have a version component, which is either `unstable` or `YY.MM`.
 
-`ci/github-script/supportedBranches.ts` is a script imported by CI to classify the base and head branches of a Pull Request.
+`ci/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
 This classification will then be used to skip certain jobs.
 This script can also be run locally to print basic test cases.
 

ci/github-script/.gitignore

@@ -2,4 +2,3 @@ comparison
 comparison.zip
 node_modules
 step-summary.md
-*.tsbuildinfo

ci/github-script/README.md

@@ -15,9 +15,3 @@ Run `./run commits OWNER REPO PR`, where OWNER is your username or "NixOS", REPO
 ## Labeler
 
 Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".
-
-## Reminders
-
-Run `./run reminders OWNER REPO PR` to post the reminders that apply to the paths a pull request touches.
-
-To add a reminder, write the review body to `reminders/KEY.md` and list KEY with its path regexes in `reminders.js`.

ci/github-script/bot.js

@@ -1,13 +1,13 @@
 // @ts-nocheck
-import { readFile, writeFile } from 'node:fs/promises'
-import path from 'node:path'
-import { DefaultArtifactClient } from '@actions/artifact'
-import { handleMerge } from './merge.js'
-import { handleReviewers } from './reviewers.js'
-import { classify } from './supportedBranches.ts'
-import withRateLimit from './withRateLimit.js'
+module.exports = async ({ github, context, core, dry }) => {
+  const path = require('node:path')
+  const { DefaultArtifactClient } = await import('@actions/artifact')
+  const { readFile, writeFile } = require('node:fs/promises')
+  const withRateLimit = require('./withRateLimit.js')
+  const { classify } = require('../supportedBranches.js')
+  const { handleMerge } = require('./merge.js')
+  const { handleReviewers } = require('./reviewers.js')
 
-export default async ({ github, context, core, dry }) => {
   const artifactClient = new DefaultArtifactClient()
 
   // Detect if running in a fork (not NixOS/nixpkgs)
@@ -397,11 +397,11 @@ export default async ({ github, context, core, dry }) => {
         per_page: 100,
       })
 
-      // label llm-assisted PRs accordingly, retaining it if manually set
+      // label llm-assisted PRs accordingly
       const assistedByPattern = /Assisted-by: (?!nix-init)/i
-      if (prCommits.some((c) => assistedByPattern.test(c.commit.message))) {
-        evalLabels['llm-assisted'] = true
-      }
+      evalLabels['llm-assisted'] = prCommits.some((c) =>
+        assistedByPattern.test(c.commit.message),
+      )
 
       const commitSubjects = prCommits.map(
         (c) => c.commit.message.split('\n')[0],
@@ -465,10 +465,9 @@ export default async ({ github, context, core, dry }) => {
         let owners = []
         try {
           // TODO: Create owner map similar to maintainer map.
-          owners =
-            (await readFile(`${pull_number}/owners.txt`, 'utf-8')).match(
-              /[^\n]+/g,
-            ) || []
+          owners = (await readFile(`${pull_number}/owners.txt`, 'utf-8')).split(
+            '\n',
+          )
         } catch (e) {
           // Older artifacts don't have the owners.txt, yet.
           if (e.code !== 'ENOENT') throw e
@@ -484,18 +483,6 @@ export default async ({ github, context, core, dry }) => {
           if (e.code !== 'ENOENT') throw e
         }
 
-        // TODO: Use maintainer map instead of the artifact.
-        const user_maintainers = Object.keys(
-          JSON.parse(
-            await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
-          ),
-        ).map((id) => parseInt(id))
-
-        prLabels['7.no default reviewers'] =
-          user_maintainers.length === 0 &&
-          team_maintainers.length === 0 &&
-          owners.length === 0
-
         // We set this label earlier already, but the current PR state can be very different
         // after handleReviewers has requested reviews, so update it in this case to prevent
         // this label from flip-flopping.
@@ -507,7 +494,12 @@ export default async ({ github, context, core, dry }) => {
           dry,
           pull_request,
           reviews,
-          user_maintainers,
+          // TODO: Use maintainer map instead of the artifact.
+          user_maintainers: Object.keys(
+            JSON.parse(
+              await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
+            ),
+          ).map((id) => parseInt(id)),
           team_maintainers,
           owners,
           getUser,
@@ -697,21 +689,16 @@ export default async ({ github, context, core, dry }) => {
     if (context.payload.pull_request) {
       await handle({ item: context.payload.pull_request, stats })
     } else {
-      // We don't use filters here because that causes GitHub to use an often-outdated index,
-      // resulting in the cursor not being updated, and therefore causing the same PRs
-      // to use up our rate limit over and over again.
       const lastRun = (
         await github.rest.actions.listWorkflowRuns({
           ...context.repo,
           workflow_id: 'bot.yml',
+          event: 'schedule',
+          status: 'success',
+          exclude_pull_requests: true,
+          per_page: 1,
         })
-      ).data.workflow_runs.find(
-        (run) => run.event === 'schedule' && run.conclusion === 'success',
-      )
-
-      core.info(
-        `Last successful run created at: ${lastRun?.created_at ?? '<n/a>'}`,
-      )
+      ).data.workflow_runs[0]
 
       const cutoff = new Date(
         Math.max(
@@ -807,7 +794,6 @@ export default async ({ github, context, core, dry }) => {
         } else {
           // No stats.artifacts++, because this does not allow passing a custom token.
           // Thus, the upload will not happen with the app token, but the default github.token.
-          core.info(`pagination-cursor: ${cursor}`)
           await artifactClient.uploadArtifact(
             'pagination-cursor',
             [uploadPath],
@@ -817,8 +803,6 @@ export default async ({ github, context, core, dry }) => {
             },
           )
         }
-      } else {
-        core.info('pagination-cursor: <n/a>')
       }
 
       // Some items might be in both search results, so filtering out duplicates as well.

ci/github-script/check-target-branch-policy.test.ts

@@ -1,242 +0,0 @@
-import assert from 'node:assert/strict'
-import test from 'node:test'
-import { evaluateTargetBranchPolicy } from './check-target-branch-policy.ts'
-
-type DecisionFacts = {
-  base: string
-  head: string
-  maxRebuildCount: number
-  rebuildsAllTests: boolean
-  onlyChangedFile: string | null
-}
-
-type Decision =
-  | 'mass-rebuild'
-  | 'nixos-rebuild'
-  | 'possible-mass-rebuild'
-  | 'skip-development-merge'
-  | 'dismiss'
-
-const defaults: DecisionFacts = {
-  base: 'master',
-  head: 'topic-branch',
-  maxRebuildCount: 0,
-  rebuildsAllTests: false,
-  onlyChangedFile: null,
-}
-
-const cases: Array<{
-  name: string
-  facts: Partial<DecisionFacts>
-  expected: Decision
-}> = [
-  {
-    name: 'allows fewer than 500 rebuilds on master',
-    facts: { maxRebuildCount: 499 },
-    expected: 'dismiss',
-  },
-  {
-    name: 'flags 500 rebuilds on master as a possible mass rebuild',
-    facts: { maxRebuildCount: 500 },
-    expected: 'possible-mass-rebuild',
-  },
-  {
-    name: 'flags 999 rebuilds on master as a possible mass rebuild',
-    facts: { maxRebuildCount: 999 },
-    expected: 'possible-mass-rebuild',
-  },
-  {
-    name: 'flags 1000 rebuilds on master as a mass rebuild',
-    facts: { maxRebuildCount: 1000 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'flags a mass rebuild on staging-nixos',
-    facts: { base: 'staging-nixos', maxRebuildCount: 24_000 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'flags a mass rebuild on a release staging-nixos branch',
-    facts: { base: 'staging-nixos-26.05', maxRebuildCount: 1000 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'allows mass rebuilds on staging',
-    facts: { base: 'staging', maxRebuildCount: 1000 },
-    expected: 'dismiss',
-  },
-  {
-    name: 'flags a mass rebuild on a release branch',
-    facts: { base: 'release-26.05', maxRebuildCount: 1000 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'flags NixOS test rebuilds on master',
-    facts: { rebuildsAllTests: true },
-    expected: 'nixos-rebuild',
-  },
-  {
-    name: 'flags NixOS test rebuilds on a release branch',
-    facts: { base: 'release-26.05', rebuildsAllTests: true },
-    expected: 'nixos-rebuild',
-  },
-  {
-    name: 'allows NixOS test rebuilds on staging-nixos',
-    facts: { base: 'staging-nixos', rebuildsAllTests: true },
-    expected: 'dismiss',
-  },
-  {
-    name: 'does not flag a possible mass rebuild when staging-nixos rebuilds all NixOS tests',
-    facts: {
-      base: 'staging-nixos',
-      maxRebuildCount: 500,
-      rebuildsAllTests: true,
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'flags other possible mass rebuilds on staging-nixos',
-    facts: { base: 'staging-nixos', maxRebuildCount: 500 },
-    expected: 'possible-mass-rebuild',
-  },
-  {
-    name: 'skips staging into master',
-    facts: {
-      head: 'staging',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'skips staging-nixos into master',
-    facts: {
-      head: 'staging-nixos',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'skips master into staging-nixos',
-    facts: {
-      base: 'staging-nixos',
-      head: 'master',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'checks staging into staging-nixos',
-    facts: {
-      base: 'staging-nixos',
-      head: 'staging',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'skips release staging-nixos into its release branch',
-    facts: {
-      base: 'release-26.05',
-      head: 'staging-nixos-26.05',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'skips a release branch into its staging-nixos branch',
-    facts: {
-      base: 'staging-nixos-26.05',
-      head: 'release-26.05',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'skip-development-merge',
-  },
-  {
-    name: 'checks release staging into its staging-nixos branch',
-    facts: {
-      base: 'staging-nixos-26.05',
-      head: 'staging-26.05',
-      maxRebuildCount: 24_000,
-    },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'kernels-org exemption suppresses a possible mass rebuild',
-    facts: {
-      maxRebuildCount: 999,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'kernels-org exemption suppresses a definite mass rebuild',
-    facts: {
-      maxRebuildCount: 1000,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'kernels-org exemption suppresses a NixOS test rebuild',
-    facts: {
-      rebuildsAllTests: true,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/kernels-org.json',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'xanmod kernel exemption suppresses a possible mass rebuild',
-    facts: {
-      maxRebuildCount: 999,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'xanmod kernel exemption suppresses a definite mass rebuild',
-    facts: {
-      maxRebuildCount: 1000,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'xanmod kernel exemption suppresses a NixOS test rebuild',
-    facts: {
-      rebuildsAllTests: true,
-      onlyChangedFile: 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix',
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'Home Assistant exemption suppresses a mass rebuild',
-    facts: {
-      head: 'wip-home-assistant',
-      maxRebuildCount: 1500,
-    },
-    expected: 'dismiss',
-  },
-  {
-    name: 'does not exempt a Home Assistant update above 1500 rebuilds',
-    facts: { head: 'wip-home-assistant', maxRebuildCount: 1501 },
-    expected: 'mass-rebuild',
-  },
-  {
-    name: 'Home Assistant exemption does not suppress a NixOS test rebuild',
-    facts: {
-      head: 'wip-home-assistant',
-      maxRebuildCount: 1500,
-      rebuildsAllTests: true,
-    },
-    expected: 'nixos-rebuild',
-  },
-]
-
-for (const { name, facts, expected } of cases) {
-  test(name, () => {
-    assert.equal(
-      evaluateTargetBranchPolicy({ ...defaults, ...facts }).decision,
-      expected,
-    )
-  })
-}

ci/github-script/check-target-branch-policy.ts

@@ -1,116 +0,0 @@
-import { classify, split } from './supportedBranches.ts'
-
-type TargetBranchPolicyFacts = {
-  base: string
-  head: string
-  maxRebuildCount: number
-  rebuildsAllTests: boolean
-  onlyChangedFile: string | null
-}
-
-type TargetBranchReviewDecision =
-  | 'mass-rebuild'
-  | 'nixos-rebuild'
-  | 'possible-mass-rebuild'
-  | 'skip-development-merge'
-  | 'dismiss'
-
-type TargetBranchPolicyResult = {
-  decision: TargetBranchReviewDecision
-  details: {
-    isExemptKernelUpdate: boolean
-    isExemptHomeAssistantUpdate: boolean
-  }
-}
-
-export function getTargetBranchPolicy({
-  base,
-  head,
-}: {
-  base: string
-  head: string
-}) {
-  const baseClassification = classify(base)
-  const headClassification = classify(head)
-  const isPrimaryBase = baseClassification.type.includes('primary')
-  const isPrimaryHead = headClassification.type.includes('primary')
-  const isStagingNixosBase = split(base).prefix === 'staging-nixos'
-  const isDevelopmentHead = headClassification.type.includes('development')
-  const shouldSkipDevelopmentMerge =
-    isDevelopmentHead && (!isStagingNixosBase || isPrimaryHead)
-
-  return {
-    isStagingNixosBase,
-    shouldSkipDevelopmentMerge,
-    shouldCheckMassRebuild:
-      !shouldSkipDevelopmentMerge && (isPrimaryBase || isStagingNixosBase),
-    shouldCheckNixosRebuild: !shouldSkipDevelopmentMerge && isPrimaryBase,
-  }
-}
-
-export function evaluateTargetBranchPolicy({
-  base,
-  head,
-  maxRebuildCount,
-  rebuildsAllTests,
-  onlyChangedFile,
-}: TargetBranchPolicyFacts): TargetBranchPolicyResult {
-  const {
-    isStagingNixosBase,
-    shouldSkipDevelopmentMerge,
-    shouldCheckMassRebuild,
-    shouldCheckNixosRebuild,
-  } = getTargetBranchPolicy({ base, head })
-
-  // https://github.com/NixOS/nixpkgs/pull/553786#issuecomment-5510286851
-  // kernels-org should go to staging-nixos (or master) and staging-nixos-xx.xx (or release-xx.xx) when backported
-  // https://github.com/NixOS/nixpkgs/pull/521157
-  // xanmod should go to master and release-xx.xx when backported
-  const isExemptKernelUpdate =
-    onlyChangedFile === 'pkgs/os-specific/linux/kernel/kernels-org.json' ||
-    onlyChangedFile === 'pkgs/os-specific/linux/kernel/xanmod-kernels.nix'
-
-  // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
-  const isExemptHomeAssistantUpdate =
-    maxRebuildCount <= 1500 && head === 'wip-home-assistant'
-
-  const details = {
-    isExemptKernelUpdate,
-    isExemptHomeAssistantUpdate,
-  }
-
-  const result = (decision: TargetBranchReviewDecision) => ({
-    decision,
-    details,
-  })
-
-  const isMassRebuild =
-    maxRebuildCount >= 1000 &&
-    !isExemptKernelUpdate &&
-    !isExemptHomeAssistantUpdate
-
-  if (shouldCheckMassRebuild && isMassRebuild) {
-    return result('mass-rebuild')
-  }
-
-  if (shouldCheckNixosRebuild && rebuildsAllTests && !isExemptKernelUpdate) {
-    return result('nixos-rebuild')
-  }
-
-  const isPossibleMassRebuild =
-    maxRebuildCount >= 500 &&
-    !isMassRebuild &&
-    !isExemptKernelUpdate &&
-    !isExemptHomeAssistantUpdate
-  if (
-    shouldCheckMassRebuild &&
-    isPossibleMassRebuild &&
-    !(rebuildsAllTests && isStagingNixosBase)
-  ) {
-    return result('possible-mass-rebuild')
-  }
-
-  return result(
-    shouldSkipDevelopmentMerge ? 'skip-development-merge' : 'dismiss',
-  )
-}

ci/github-script/check-target-branch.ts

@@ -1,18 +1,15 @@
-import { readFile } from 'node:fs/promises'
 import type * as actionsCore from '@actions/core'
 import type { context as actionsContext } from '@actions/github'
 import type { GitHub } from '@actions/github/lib/utils'
-import {
-  evaluateTargetBranchPolicy,
-  getTargetBranchPolicy,
-} from './check-target-branch-policy.ts'
-import { dismissReviews, postReview } from './reviews.ts'
-import { split } from './supportedBranches.ts'
 
 // TODO: should this be combined with the branch checks in prepare.js?
 // They do seem quite similar, but this needs to run after eval,
 // and prepare.js obviously doesn't.
 
+const { classify, split } = require('../supportedBranches.js')
+const { readFile } = require('node:fs/promises')
+const { postReview, dismissReviews } = require('./reviews.js')
+
 const reviewKey = 'check-target-branch'
 
 type ChangedPaths = {
@@ -43,93 +40,7 @@ type ChangedPaths = {
   rebuildsByPlatform: Record<string, string[]>
 }
 
-type TargetBranchReviewFacts = {
-  github: InstanceType<typeof GitHub>
-  context: typeof actionsContext
-  core: typeof actionsCore
-  dry: boolean
-  base: string
-  maxRebuildCount: number
-}
-
-function getStagingBranch(base: string) {
-  const version = split(base).version
-  return version ? `staging-${version}` : 'staging'
-}
-
-async function postMassRebuildReview(facts: TargetBranchReviewFacts) {
-  const { github, context, core, dry, base, maxRebuildCount } = facts
-  const desiredBranch = getStagingBranch(base)
-  const body = [
-    `The PR's base branch is set to \`${base}\`, but this PR causes ${maxRebuildCount} rebuilds.`,
-    'It is therefore considered a mass rebuild.',
-    `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${desiredBranch}\`).`,
-  ].join('\n')
-
-  await postReview({
-    github,
-    context,
-    core,
-    dry,
-    body,
-    event: 'REQUEST_CHANGES',
-    reviewKey,
-  })
-}
-
-async function postNixosRebuildReview(facts: TargetBranchReviewFacts) {
-  const { github, context, core, dry, base, maxRebuildCount } = facts
-  let branchText: string
-  if (base === 'master' && maxRebuildCount >= 500) {
-    branchText = '(probably either `staging-nixos` or `staging`)'
-  } else if (base === 'master') {
-    branchText = '(probably `staging-nixos`)'
-  } else if (maxRebuildCount >= 500) {
-    branchText = `(probably either \`staging-nixos-${split(base).version}\` or \`staging-${split(base).version}\`)`
-  } else {
-    branchText = `(probably \`staging-nixos-${split(base).version}\`)`
-  }
-  const body = [
-    `The PR's base branch is set to \`${base}\`, but this PR rebuilds all NixOS tests.`,
-    base === 'master' && maxRebuildCount >= 500
-      ? `Since this PR also causes ${maxRebuildCount} rebuilds, it may also be considered a mass rebuild.`
-      : '',
-    `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) ${branchText}.`,
-  ].join('\n')
-
-  await postReview({
-    github,
-    context,
-    core,
-    dry,
-    body,
-    event: 'REQUEST_CHANGES',
-    reviewKey,
-  })
-}
-
-async function postPossibleMassRebuildReview(facts: TargetBranchReviewFacts) {
-  const { github, context, core, dry, base, maxRebuildCount } = facts
-  const stagingBranch = getStagingBranch(base)
-  const body = [
-    `The PR's base branch is set to \`${base}\`, and this PR causes ${maxRebuildCount} rebuilds.`,
-    `Please consider whether this PR causes a mass rebuild according to [our conventions](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions).`,
-    `If it does cause a mass rebuild, please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${stagingBranch}\`).`,
-    `If it does not cause a mass rebuild, this message can be ignored.`,
-  ].join('\n')
-
-  await postReview({
-    github,
-    context,
-    core,
-    dry,
-    body,
-    event: 'REQUEST_CHANGES',
-    reviewKey,
-  })
-}
-
-export async function checkTargetBranch({
+async function checkTargetBranch({
   github,
   context,
   core,
@@ -158,7 +69,41 @@ export async function checkTargetBranch({
   ).data
   const base = prInfo.base.ref
   const head = prInfo.head.ref
-  const { shouldCheckMassRebuild } = getTargetBranchPolicy({ base, head })
+  const baseClassification = classify(base)
+  const headClassification = classify(head)
+
+  // Don't run on, e.g., staging-nixos to master merges.
+  if (headClassification.type.includes('development')) {
+    core.info(
+      `Skipping checkTargetBranch: PR is from a development branch (${head})`,
+    )
+
+    await dismissReviews({
+      github,
+      context,
+      core,
+      dry,
+      reviewKey,
+    })
+
+    return
+  }
+  // Don't run on PRs against staging branches, wip branches, haskell-updates, etc.
+  if (!baseClassification.type.includes('primary')) {
+    core.info(
+      `Skipping checkTargetBranch: PR is against a non-primary base branch (${base})`,
+    )
+
+    await dismissReviews({
+      github,
+      context,
+      core,
+      dry,
+      reviewKey,
+    })
+
+    return
+  }
 
   const maxRebuildCount = Math.max(
     ...Object.values(changed.rebuildCountByKernel),
@@ -167,28 +112,25 @@ export async function checkTargetBranch({
     changed.attrdiff.changed.includes('nixosTests.simple-container') ||
     changed.attrdiff.changed.includes('nixosTests.simple-vm')
 
-  let onlyChangedFile: string | null = null
-  if (shouldCheckMassRebuild && prInfo.changed_files === 1) {
+  // https://github.com/NixOS/nixpkgs/pull/521157
+  // These should go to master and release-xx.xx when backported
+  let isExemptKernelUpdate = false
+  if (prInfo.changed_files === 1) {
     const changedFiles = (
       await github.rest.pulls.listFiles({
         ...context.repo,
         pull_number,
       })
     ).data
-    onlyChangedFile =
-      changedFiles.length === 1 ? changedFiles[0].filename : null
+    isExemptKernelUpdate =
+      changedFiles.length === 1 &&
+      changedFiles[0].filename ===
+        'pkgs/os-specific/linux/kernel/xanmod-kernels.nix'
   }
 
-  const {
-    decision,
-    details: { isExemptKernelUpdate, isExemptHomeAssistantUpdate },
-  } = evaluateTargetBranchPolicy({
-    base,
-    head,
-    maxRebuildCount,
-    rebuildsAllTests,
-    onlyChangedFile,
-  })
+  // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
+  const isExemptHomeAssistantUpdate =
+    maxRebuildCount <= 1500 && head === 'wip-home-assistant'
 
   core.info(
     [
@@ -200,43 +142,90 @@ export async function checkTargetBranch({
     ].join('\n'),
   )
 
-  const reviewFacts: TargetBranchReviewFacts = {
-    github,
-    context,
-    core,
-    dry,
-    base,
-    maxRebuildCount,
-  }
+  if (
+    maxRebuildCount >= 1000 &&
+    !isExemptHomeAssistantUpdate &&
+    !isExemptKernelUpdate
+  ) {
+    const desiredBranch =
+      base === 'master' ? 'staging' : `staging-${split(base).version}`
+    const body = [
+      `The PR's base branch is set to \`${base}\`, but this PR causes ${maxRebuildCount} rebuilds.`,
+      'It is therefore considered a mass rebuild.',
+      `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${desiredBranch}\`).`,
+    ].join('\n')
 
-  if (decision === 'mass-rebuild') {
-    await postMassRebuildReview(reviewFacts)
-    return
-  }
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'REQUEST_CHANGES',
+      reviewKey,
+    })
+  } else if (rebuildsAllTests && !isExemptKernelUpdate) {
+    let branchText: string
+    if (base === 'master' && maxRebuildCount >= 500) {
+      branchText = '(probably either `staging-nixos` or `staging`)'
+    } else if (base === 'master') {
+      branchText = '(probably `staging-nixos`)'
+    } else if (maxRebuildCount >= 500) {
+      branchText = `(probably either \`staging-nixos-${split(base).version}\` or \`staging-${split(base).version}\`)`
+    } else {
+      branchText = `(probably \`staging-nixos-${split(base).version}\`)`
+    }
+    const body = [
+      `The PR's base branch is set to \`${base}\`, but this PR rebuilds all NixOS tests.`,
+      base === 'master' && maxRebuildCount >= 500
+        ? `Since this PR also causes ${maxRebuildCount} rebuilds, it may also be considered a mass rebuild.`
+        : '',
+      `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) ${branchText}.`,
+    ].join('\n')
 
-  if (decision === 'nixos-rebuild') {
-    await postNixosRebuildReview(reviewFacts)
-    return
-  }
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'REQUEST_CHANGES',
+      reviewKey,
+    })
+  } else if (
+    maxRebuildCount >= 500 &&
+    !isExemptKernelUpdate &&
+    !isExemptHomeAssistantUpdate
+  ) {
+    const stagingBranch =
+      base === 'master' ? 'staging' : `staging-${split(base).version}`
+    const body = [
+      `The PR's base branch is set to \`${base}\`, and this PR causes ${maxRebuildCount} rebuilds.`,
+      `Please consider whether this PR causes a mass rebuild according to [our conventions](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions).`,
+      `If it does cause a mass rebuild, please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${stagingBranch}\`).`,
+      `If it does not cause a mass rebuild, this message can be ignored.`,
+    ].join('\n')
 
-  if (decision === 'possible-mass-rebuild') {
-    await postPossibleMassRebuildReview(reviewFacts)
-    return
-  }
-
-  if (decision === 'skip-development-merge') {
-    core.info(
-      `Skipping checkTargetBranch: PR merges the development branch ${head} into ${base}`,
-    )
+    await postReview({
+      github,
+      context,
+      core,
+      dry,
+      body,
+      event: 'REQUEST_CHANGES',
+      reviewKey,
+    })
   } else {
     core.info('checkTargetBranch: this PR is against an appropriate branch.')
-  }
 
-  await dismissReviews({
-    github,
-    context,
-    core,
-    dry,
-    reviewKey,
-  })
+    await dismissReviews({
+      github,
+      context,
+      core,
+      dry,
+      reviewKey,
+    })
+  }
 }
+
+module.exports = checkTargetBranch

ci/github-script/commits.js

@@ -1,78 +1,15 @@
-import { execFileSync } from 'node:child_process'
-import type * as actionsCore from '@actions/core'
-import type { context as actionsContext } from '@actions/github'
-import type { GitHub } from '@actions/github/lib/utils'
-import { dismissReviews, postReview } from './reviews.ts'
-import { classify } from './supportedBranches.ts'
-import withRateLimit from './withRateLimit.js'
-
-const dirname = import.meta.dirname
-
-type PullRequestCommit = Awaited<
-  ReturnType<InstanceType<typeof GitHub>['rest']['pulls']['listCommits']>
->['data'][number]
-
-type CommitDetails = Pick<PullRequestCommit, 'sha' | 'commit'>
-
-type CherryPick = CommitDetails & {
-  original_sha: string
-  severity?: undefined
-}
-
-type CheckResult = CommitDetails & {
-  diff?: string[]
-  colored_diff?: string
-  severity: 'important' | 'warning' | 'error' | 'info'
-  message: string
-  type?: 'no-cherry-pick' | 'no-commit-hash' | 'diff'
-}
-
-type ExtractedCommit = CheckResult | CherryPick
-
-type CheckCommitsProps = {
-  github: InstanceType<typeof GitHub>
-  context: typeof actionsContext
-  core: typeof actionsCore
-  dry: boolean
-  cherryPicks: boolean
-}
-
-type CommitBranches = {
-  branches: {
-    branch: string
-  }[]
-}
-
-type RateLimitStats = {
-  prs: number
-}
-
-function isCherryPick(result: ExtractedCommit): result is CherryPick {
-  return !result.severity
-}
-
-function isIgnoredBranchError(error: unknown) {
-  return (
-    typeof error === 'object' &&
-    error !== null &&
-    'status' in error &&
-    (error.status === 404 || error.status === 500)
-  )
-}
-
-export default async ({
-  github,
-  context,
-  core,
-  dry,
-  cherryPicks,
-}: CheckCommitsProps) => {
+// @ts-nocheck
+module.exports = async ({ github, context, core, dry, cherryPicks }) => {
+  const { execFileSync } = require('node:child_process')
+  const { classify } = require('../supportedBranches.js')
+  const withRateLimit = require('./withRateLimit.js')
+  const { dismissReviews, postReview } = require('./reviews.js')
   const reviewKey = 'check-commits'
 
-  await withRateLimit({ github, core }, async (stats: RateLimitStats) => {
+  await withRateLimit({ github, core }, async (stats) => {
     stats.prs = 1
 
-    const pull_number = context.payload.pull_request!.number
+    const pull_number = context.payload.pull_request.number
 
     const job_url =
       context.runId &&
@@ -82,14 +19,11 @@ export default async ({
           run_id: context.runId,
           per_page: 100,
         })
-      ).find(({ name }) => name.endsWith('Check / commits'))!.html_url +
+      ).find(({ name }) => name.endsWith('Check / commits')).html_url +
         '?pr=' +
         pull_number
 
-    async function extract({
-      sha,
-      commit,
-    }: CommitDetails): Promise<ExtractedCommit> {
+    async function extract({ sha, commit }) {
       const noCherryPick = Array.from(
         commit.message.matchAll(/^Not-cherry-picked-because: (.*)$/gm),
       ).at(0)
@@ -120,10 +54,10 @@ export default async ({
 
       const original_sha = cherry[1]
 
-      let branches: string[] | undefined
+      let branches
       try {
         branches = (
-          await github.request<CommitBranches>({
+          await github.request({
             // This is an undocumented endpoint to fetch the branches a commit is part of.
             // There is no equivalent in neither the REST nor the GraphQL API.
             // The endpoint itself is unlikely to go away, because GitHub uses it to display
@@ -139,7 +73,7 @@ export default async ({
       } catch (e) {
         // For some unknown reason a 404 error comes back as 500 without any more details in a GitHub Actions runner.
         // Ignore these to return a regular error message below.
-        if (!isIgnoredBranchError(e)) throw e
+        if (![404, 500].includes(e.status)) throw e
       }
       if (!branches?.length)
         return {
@@ -156,10 +90,10 @@ export default async ({
       }
     }
 
-    function diff({ sha, commit, original_sha }: CherryPick): CheckResult {
+    function diff({ sha, commit, original_sha }) {
       const diff = execFileSync('git', [
         '-C',
-        dirname,
+        __dirname,
         'range-diff',
         '--no-color',
         '--ignore-all-space',
@@ -186,7 +120,7 @@ export default async ({
 
       const colored_diff = execFileSync('git', [
         '-C',
-        dirname,
+        __dirname,
         'range-diff',
         '--color',
         '--no-notes',
@@ -218,14 +152,14 @@ export default async ({
     const extracted = await Promise.all(commits.map(extract))
 
     const fetch = extracted
-      .filter(isCherryPick)
+      .filter(({ severity }) => !severity)
       .flatMap(({ sha, original_sha }) => [sha, original_sha])
 
     if (fetch.length > 0) {
       // Fetching all commits we need for diff at once is much faster than any other method.
       execFileSync('git', [
         '-C',
-        dirname,
+        __dirname,
         'fetch',
         '--depth=2',
         'origin',
@@ -240,8 +174,8 @@ export default async ({
     // Log all results without truncation, with better highlighting and all whitespace changes to the job log.
     results.forEach(({ sha, commit, severity, message, colored_diff }) => {
       core.startGroup(`Commit ${sha}`)
-      core.info(`Author: ${commit.author!.name} ${commit.author!.email}`)
-      core.info(`Date: ${new Date(commit.author!.date!)}`)
+      core.info(`Author: ${commit.author.name} ${commit.author.email}`)
+      core.info(`Date: ${new Date(commit.author.date)}`)
       switch (severity) {
         case 'error':
           core.error(message)
@@ -261,7 +195,7 @@ export default async ({
     // An empty results array will always trigger this condition, which is helpful
     // to clean up reviews created by the prepare step when on the wrong branch.
     if (results.every(({ severity }) => severity === 'info')) {
-      await dismissReviews({ github, context, core, dry, reviewKey })
+      await dismissReviews({ github, context, dry, reviewKey })
       return
     }
 
@@ -353,7 +287,7 @@ export default async ({
         // that's too long. We think this is unlikely to happen, and so don't deal with it explicitly.
         const truncated = []
         let total_length = 0
-        for (const line of diff) {
+        for (line of diff) {
           total_length += line.length
           if (total_length > 10000) {
             truncated.push('', '[...truncated...]')
@@ -384,14 +318,6 @@ export default async ({
     // Posting a review could fail for very long comments. This can only happen with
     // multiple commits all hitting the truncation limit for the diff. If you ever hit
     // this case, consider just splitting up those commits into multiple PRs.
-    await postReview({
-      github,
-      context,
-      core,
-      dry,
-      body,
-      event: 'REQUEST_CHANGES',
-      reviewKey,
-    })
+    await postReview({ github, context, core, dry, body, reviewKey })
   })
 }

ci/github-script/get-pr-commit-details.js

@@ -1,25 +1,27 @@
-import { execFile as nodeExecFile } from 'node:child_process'
-import { promisify } from 'node:util'
+// @ts-nocheck
+const { promisify } = require('node:util')
+const execFile = promisify(require('node:child_process').execFile)
 
-const execFile = promisify(nodeExecFile)
+/**
+ * @typedef {{
+ *  subject: string,
+ *  sha: string,
+ *  author: { name: string, email: string },
+ *  committer: { name: string, email: string}
+ *  changedPaths: string[],
+ *  changedPathSegments: Set<string>,
+ * }} Commit
+ */
 
-export type Commit = {
-  subject: string
-  sha: string
-  author: { name: string; email: string }
-  committer: { name: string; email: string }
-  changedPaths: string[]
-  changedPathSegments: Set<string>
-}
-
-interface RunGitProps {
-  args: string[]
-  core: typeof import('@actions/core')
-  quiet?: boolean
-  repoPath?: string
-}
-
-async function runGit({ args, repoPath, core, quiet }: RunGitProps) {
+/**
+ * @param {{
+ *  args: string[]
+ *  core: typeof import('@actions/core'),
+ *  quiet?: boolean,
+ *  repoPath?: string,
+ * }} RunGitProps
+ */
+async function runGit({ args, repoPath, core, quiet }) {
   if (repoPath) {
     args = ['-C', repoPath, ...args]
   }
@@ -31,29 +33,21 @@ async function runGit({ args, repoPath, core, quiet }: RunGitProps) {
   return await execFile('git', args)
 }
 
-interface GetCommitMessagesForPRProps {
-  core: typeof import('@actions/core')
-  pr: Awaited<
-    ReturnType<
-      InstanceType<
-        typeof import('@actions/github/lib/utils').GitHub
-      >['rest']['pulls']['get']
-    >
-  >['data']
-  repoPath?: string
-}
-
 /**
  * Gets the SHA, subject and changed files for each commit in the given PR.
  *
  * Don't use GitHub API at all: the "list commits on PR" endpoint has a limit
  * of 250 commits and doesn't return the changed files.
+ *
+ * @param {{
+ *  core: typeof import('@actions/core'),
+ *  pr: Awaited<ReturnType<InstanceType<import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
+ *  repoPath?: string,
+ * }} GetCommitMessagesForPRProps
+ *
+ * @returns {Promise<Commit[]>}
  */
-export async function getCommitDetailsForPR({
-  core,
-  pr,
-  repoPath,
-}: GetCommitMessagesForPRProps): Promise<Commit[]> {
+async function getCommitDetailsForPR({ core, pr, repoPath }) {
   await runGit({
     args: ['fetch', `--depth=1`, 'origin', pr.base.sha],
     repoPath,
@@ -119,3 +113,5 @@ export async function getCommitDetailsForPR({
     }),
   )
 }
+
+module.exports = { getCommitDetailsForPR }

ci/github-script/get-teams.js

@@ -1,14 +1,14 @@
 // @ts-nocheck
-import { writeFileSync } from 'node:fs'
-import withRateLimit from './withRateLimit.js'
-
 const excludeTeams = [
   /^voters.*$/,
   /^nixpkgs-maintainers$/,
   /^nixpkgs-committers$/,
 ]
 
-export default async ({ github, context, core, outFile }) => {
+module.exports = async ({ github, context, core, outFile }) => {
+  const withRateLimit = require('./withRateLimit.js')
+  const { writeFileSync } = require('node:fs')
+
   const org = context.repo.owner
 
   const result = {}

ci/github-script/lint-commits.js

@@ -1,23 +1,17 @@
-import { type Commit, getCommitDetailsForPR } from './get-pr-commit-details.ts'
-import { classify } from './supportedBranches.ts'
+const { classify } = require('../supportedBranches.js')
+const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
-type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
-type Context = typeof import('@actions/github').context
-type Core = typeof import('@actions/core')
+/** @typedef {import('./get-pr-commit-details.js').Commit} Commit */
 
-interface LintCommitsProps {
-  github: GitHub
-  context: Context
-  core: Core
-  repoPath?: string
-}
-
-export default async function lintCommits({
-  github,
-  context,
-  core,
-  repoPath,
-}: LintCommitsProps) {
+/**
+ * @param {{
+ *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
+ *  context: typeof import('@actions/github').context,
+ *  core: typeof import('@actions/core'),
+ *  repoPath?: string,
+ * }} LintCommitsProps
+ */
+async function lintCommits({ github, context, core, repoPath }) {
   // This check should only be run when we have the pull_request context.
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
@@ -59,15 +53,13 @@ export default async function lintCommits({
   await checkCommitMetadata({ commits, core })
 }
 
-interface CheckCommitMessagesProps {
-  commits: Commit[]
-  core: Core
-}
-
-async function checkCommitMessages({
-  commits,
-  core,
-}: CheckCommitMessagesProps) {
+/**
+ * @param {{
+ *  commits: Commit[],
+ *  core: typeof import('@actions/core'),
+ * }} CheckCommitMessagesProps
+ */
+async function checkCommitMessages({ commits, core }) {
   const failures = new Set()
 
   const conventionalCommitTypes = [
@@ -88,13 +80,10 @@ async function checkCommitMessages({
   ]
 
   /**
-   * @param types e.g. ["fix", "feat"]
-   * @param sha commit hash
+   * @param {string[]} types e.g. ["fix", "feat"]
+   * @param {string?} sha commit hash
    */
-  function makeConventionalCommitRegex(
-    types: string[],
-    sha: string | null = null,
-  ) {
+  function makeConventionalCommitRegex(types, sha = null) {
     core.info(
       `${
         sha
@@ -177,15 +166,17 @@ async function checkCommitMessages({
   }
 }
 
-interface CheckGitFieldsProps {
-  commits: Commit[]
-  core: Core
-}
-
-async function checkCommitMetadata({ commits, core }: CheckGitFieldsProps) {
+/**
+ * @param {{
+ *  commits: Commit[],
+ *  core: typeof import('@actions/core'),
+ * }} CheckGitFieldsProps
+ */
+async function checkCommitMetadata({ commits, core }) {
   const failures = new Set()
 
-  const isEmail = (s: string) => /^.+@.*$/.test(s)
+  /** @type {(s: string) => boolean} */
+  const isEmail = (s) => /^.+@.*$/.test(s)
 
   for (const commit of commits) {
     if (!commit.author.name) {
@@ -229,3 +220,5 @@ async function checkCommitMetadata({ commits, core }: CheckGitFieldsProps) {
     core.setFailed('Committers: merging is discouraged.')
   }
 }
+
+module.exports = lintCommits

ci/github-script/manual-file-edits.js

@@ -1,20 +1,17 @@
-import { getCommitDetailsForPR } from './get-pr-commit-details.ts'
-import { dismissReviews, postReview } from './reviews.ts'
-import { classify } from './supportedBranches.ts'
+const { classify } = require('../supportedBranches.js')
+const { getCommitDetailsForPR } = require('./get-pr-commit-details')
 
-export default async function checkManualFileEdits({
-  github,
-  context,
-  core,
-  repoPath,
-  dry,
-}: {
-  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>
-  context: typeof import('@actions/github').context
-  core: typeof import('@actions/core')
-  repoPath?: string
-  dry: boolean
-}) {
+/**
+ * @param {{
+ *  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>,
+ *  context: typeof import('@actions/github').context,
+ *  core: typeof import('@actions/core'),
+ *  repoPath?: string,
+ *  dry: boolean,
+ * }} CheckManualFileEditsProps
+ */
+async function checkManualFileEdits({ github, context, core, repoPath, dry }) {
+  const { dismissReviews, postReview } = require('./reviews.js')
   const reviewKey = 'manual-file-edits'
 
   const pull_number = context.payload.pull_request?.number
@@ -93,3 +90,5 @@ export default async function checkManualFileEdits({
     })
   }
 }
+
+module.exports = checkManualFileEdits

ci/github-script/merge.js

@@ -1,5 +1,5 @@
 // @ts-nocheck
-import { classify } from './supportedBranches.ts'
+const { classify } = require('../supportedBranches.js')
 
 function runChecklist({
   committers,
@@ -123,7 +123,7 @@ function hasMergeCommand(body) {
     .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/im)
 }
 
-export async function handleMergeComment({ github, body, node_id, reaction }) {
+async function handleMergeComment({ github, body, node_id, reaction }) {
   if (!hasMergeCommand(body)) return
 
   await github.graphql(
@@ -138,7 +138,7 @@ export async function handleMergeComment({ github, body, node_id, reaction }) {
   )
 }
 
-export async function handleMerge({
+async function handleMerge({
   github,
   context,
   core,
@@ -409,3 +409,8 @@ export async function handleMerge({
   // This is used to set the respective label in bot.js.
   return result
 }
+
+module.exports = {
+  handleMerge,
+  handleMergeComment,
+}

ci/github-script/package-lock.json

@@ -12,6 +12,7 @@
         "commander": "14.0.3"
       },
       "devDependencies": {
+        "@tsconfig/node24": "24.0.4",
         "@types/node": "24.13.3",
         "typescript": "7.0.2"
       }
@@ -629,6 +630,13 @@
         "@protobuf-ts/runtime": "^2.11.1"
       }
     },
+    "node_modules/@tsconfig/node24": {
+      "version": "24.0.4",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node24/-/node24-24.0.4.tgz",
+      "integrity": "sha512-2A933l5P5oCbv6qSxHs7ckKwobs8BDAe9SJ/Xr2Hy+nDlwmLE1GhFh/g/vXGRZWgxBg9nX/5piDtHR9Dkw/XuA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/node": {
       "version": "24.13.3",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-24.13.3.tgz",

ci/github-script/package.json

@@ -1,11 +1,5 @@
 {
   "private": true,
-  "scripts": {
-    "typecheck": "tsc --build",
-    "testsuite": "node --test",
-    "test": "npm run typecheck && npm run testsuite"
-  },
-  "type": "module",
   "//": [
     "Keep `@actions/core` and `@actions/github` in sync with",
     "https://github.com/actions/github-script/blob/main/package.json."
@@ -18,6 +12,7 @@
     "commander": "14.0.3"
   },
   "devDependencies": {
+    "@tsconfig/node24": "24.0.4",
     "@types/node": "24.13.3",
     "typescript": "7.0.2"
   }

ci/github-script/prepare.js

@@ -1,11 +1,10 @@
 // @ts-nocheck
-import { dismissReviews, postReview } from './reviews.ts'
-import { classify } from './supportedBranches.ts'
-import supportedSystems from './supportedSystems.ts'
-
+const { classify } = require('../supportedBranches.js')
+const { postReview, dismissReviews } = require('./reviews.js')
 const reviewKey = 'prepare'
+const supportedSystems = require('./supportedSystems.js')
 
-export default async ({ github, context, core, dry }) => {
+module.exports = async ({ github, context, core, dry }) => {
   const pull_number = context.payload.pull_request.number
 
   for (const retryInterval of [5, 10, 20, 40, 80]) {
@@ -66,7 +65,7 @@ export default async ({ github, context, core, dry }) => {
       // commits between that base and head is the real base. We can query for this via GitHub's
       // REST API. There can be multiple candidates for the real base with the same number of
       // commits. In this case we pick the "best" candidate by a fixed ordering of branches,
-      // as defined in ci/github-script/supportedBranches.ts.
+      // as defined in ci/supportedBranches.js.
       //
       // These requests take a while, when comparing against the wrong release - they need
       // to look at way more than 10k commits in that case. Thus, we try to minimize the

ci/github-script/reminders.ts

@@ -1,111 +0,0 @@
-import fs from 'node:fs'
-import path from 'node:path'
-import type * as actionsCore from '@actions/core'
-import type { context as actionsContext } from '@actions/github'
-import type { GitHub } from '@actions/github/lib/utils'
-import { getCommitDetailsForPR } from './get-pr-commit-details.ts'
-import { dismissReviews, postReview } from './reviews.ts'
-import { classify } from './supportedBranches.ts'
-
-/**
- * Reminders to post as a non-blocking review when a pull request touches
- * certain matching paths.
- */
-export const reminders: { key: string; paths: RegExp[] }[] = [
-  {
-    key: 'docs-styleguide',
-    paths: [/^doc\//, /^nixos\/doc\//, /^nixos\/modules\/.*\.md$/],
-  },
-]
-
-export function matchesAny(changedPaths: string[], patterns: RegExp[]) {
-  return changedPaths.some((changedPath) =>
-    patterns.some((pattern) => pattern.test(changedPath)),
-  )
-}
-
-function reminderBody(key: string) {
-  return fs
-    .readFileSync(path.join(import.meta.dirname, 'reminders', `${key}.md`), {
-      encoding: 'utf8',
-    })
-    .trim()
-}
-
-export default async function postReminders({
-  github,
-  context,
-  core,
-  repoPath,
-  dry,
-}: {
-  github: InstanceType<typeof GitHub>
-  context: typeof actionsContext
-  core: typeof actionsCore
-  repoPath?: string
-  dry: boolean
-}) {
-  const pull_number = context.payload.pull_request?.number
-  if (!pull_number) {
-    core.info('This is not a pull request. Skipping reminders.')
-    return
-  }
-
-  const pr = (
-    await github.rest.pulls.get({
-      ...context.repo,
-      pull_number,
-    })
-  ).data
-
-  if (pr.user.login.endsWith('[bot]')) {
-    core.info('This is a bot, so reminders do not apply.')
-    return
-  }
-
-  const baseBranchType = classify(
-    pr.base.ref.replace(/^refs\/heads\//, ''),
-  ).type
-  const headBranchType = classify(
-    pr.head.ref.replace(/^refs\/heads\//, ''),
-  ).type
-
-  if (
-    baseBranchType.includes('development') &&
-    headBranchType.includes('development') &&
-    pr.base.repo.id === pr.head.repo?.id
-  ) {
-    // This matches, for example, PRs from NixOS:staging-next to NixOS:master, or vice versa.
-    // We ignore them, we should only care about PRs introducing new commits.
-    // We still want to run on PRs from, e.g., Someone:master to NixOS:master though.
-    core.info(
-      'This PR is from one development branch to another. Skipping reminders.',
-    )
-    return
-  }
-
-  const details = await getCommitDetailsForPR({ core, pr, repoPath })
-  const changedPaths = details.flatMap(({ changedPaths }) => changedPaths)
-
-  for (const { key, paths } of reminders) {
-    if (matchesAny(changedPaths, paths)) {
-      await postReview({
-        github,
-        context,
-        core,
-        dry,
-        event: 'COMMENT',
-        body: reminderBody(key),
-        reviewKey: key,
-      })
-    } else {
-      await dismissReviews({
-        github,
-        context,
-        core,
-        dry,
-        reviewKey: key,
-      })
-    }
-  }
-}

ci/github-script/reminders/docs-styleguide.md

@@ -1,12 +0,0 @@
-Thanks for contributing to the documentation
-
-Make sure you follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
-
-- Show, don't tell: lead with a minimal working example; explanation follows the code.
-- No meta-commentary: don't write "This section explains how to…", just do it.
-- Imperative mood and active voice: "Run the command", not "The user should run the following command".
-- Present tense: "This creates a folder", not "This will create a folder".
-- Be confident: no hedging with "should", "might", "typically", "usually".
-- Cut filler words: "simply", "just", "easily", "basically"; "to", not "in order to".
-
-For larger changes, like adding or removing whole sections, ask the NixOS documentation team for a review.

ci/github-script/reviewers.js

@@ -1,5 +1,5 @@
 // @ts-nocheck
-export async function handleReviewers({
+async function handleReviewers({
   github,
   context,
   core,
@@ -183,3 +183,7 @@ export async function handleReviewers({
     teams_reached.size === 0
   )
 }
+
+module.exports = {
+  handleReviewers,
+}

ci/github-script/reviews.js

@@ -13,28 +13,24 @@ const reviewUsers = [
   'manual-edit',
 ]
 
-type GitHub = InstanceType<typeof import('@actions/github/lib/utils').GitHub>
-type Context = typeof import('@actions/github').context
-type Review = Awaited<
-  ReturnType<GitHub['rest']['pulls']['listReviews']>
->['data'][number]
-type ReviewWithNonNullUser = Review & { user: NonNullable<Review['user']> }
+/**
+ * @typedef {InstanceType<typeof import('@actions/github/lib/utils').GitHub>} GitHub
+ * @typedef {typeof import('@actions/github').context} Context
+ *
+ * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
+ * @typedef {Review & { user: NonNullable<Review['user']> }} ReviewWithNonNullUser
+ */
 
-interface DismissReviewsProps {
-  github: GitHub
-  context: Context
-  core: typeof import('@actions/core')
-  dry: boolean
-  reviewKey?: string
-}
-
-export async function dismissReviews({
-  github,
-  context,
-  core,
-  dry,
-  reviewKey,
-}: DismissReviewsProps) {
+/**
+ * @param {{
+ *  github: GitHub,
+ *  context: Context,
+ *  core: typeof import('@actions/core'),
+ *  dry: boolean,
+ *  reviewKey?: string,
+ * }} DismissReviewsProps
+ */
+async function dismissReviews({ github, context, core, dry, reviewKey }) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('dismissReviews called outside of pull_request context')
@@ -45,29 +41,23 @@ export async function dismissReviews({
     return
   }
 
-  const allReviews: Review[] = await github.paginate(
-    github.rest.pulls.listReviews,
-    {
-      ...context.repo,
-      pull_number,
-    },
-  )
+  const allReviews = await github.paginate(github.rest.pulls.listReviews, {
+    ...context.repo,
+    pull_number,
+  })
 
-  const reviews = allReviews
-    .filter((review): review is ReviewWithNonNullUser => !!review.user)
-    .filter(
+  const reviews = /** @type {ReviewWithNonNullUser[]} */ (
+    allReviews.filter(
       (review) =>
+        review.user &&
         review.state !== 'DISMISSED' &&
         review.user.login.endsWith('[bot]') &&
         reviewUsers.some((substr) => review.user?.login.includes(substr)),
     )
+  )
 
   const reviewsByUser = reviews.reduce(
     (prev, curr) => {
-      if (!curr.user) {
-        return prev
-      }
-
       if (!(curr.user.login in prev)) {
         prev[curr.user.login] = []
       }
@@ -76,7 +66,7 @@ export async function dismissReviews({
 
       return prev
     },
-    {} as Record<string, ReviewWithNonNullUser[]>,
+    /** @type {Record<string, ReviewWithNonNullUser[]> } */ ({}),
   )
 
   const commentRegex = new RegExp(
@@ -90,8 +80,8 @@ export async function dismissReviews({
   )
 
   let reviewsToMinimize = reviews
-  const reviewsToDismiss: ReviewWithNonNullUser[] = []
-  const reviewsToResolve: ReviewWithNonNullUser[] = []
+  const /** @type {ReviewWithNonNullUser[]} */ reviewsToDismiss = []
+  const /** @type {ReviewWithNonNullUser[]} */ reviewsToResolve = []
 
   if (reviewKey && reviews.every((review) => commentRegex.test(review.body))) {
     reviewsToMinimize = reviews.filter((review) =>
@@ -108,7 +98,7 @@ export async function dismissReviews({
           commentResolvedRegex.test(review.body) ||
           (reviewKey && reviewKeyRegex.test(review.body)) ||
           // If we are called by check-commits and the review body is clearly
-          // from `commits.ts`, then we can safely dismiss the review.
+          // from `commits.js`, then we can safely dismiss the review.
           // This helps with pre-existing reviews (before the comments were added).
           (reviewKey &&
             reviewKey === 'check-commits' &&
@@ -169,17 +159,18 @@ export async function dismissReviews({
   ])
 }
 
-interface PostReviewProps {
-  github: GitHub
-  context: Context
-  core: typeof import('@actions/core')
-  dry: boolean
-  body: string
-  event: keyof typeof eventToState
-  reviewKey: string
-}
-
-export async function postReview({
+/**
+ * @param {{
+ *  github: GitHub,
+ *  context: Context,
+ *  core: typeof import('@actions/core'),
+ *  dry: boolean,
+ *  body: string,
+ *  event: keyof typeof eventToState,
+ *  reviewKey: string,
+ * }} PostReviewProps
+ */
+async function postReview({
   github,
   context,
   core,
@@ -187,7 +178,7 @@ export async function postReview({
   body,
   event = 'REQUEST_CHANGES',
   reviewKey,
-}: PostReviewProps) {
+}) {
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
     core.warning('postReview called outside of pull_request context')
@@ -213,7 +204,8 @@ export async function postReview({
       reviewUsers.some((substr) => review.user?.login.includes(substr)),
   )
 
-  let pendingReview: null | Review
+  /** @type {null | Review} */
+  let pendingReview
   const matchingReviews = reviews.filter((review) =>
     reviewKeyRegex.test(review.body),
   )
@@ -270,3 +262,8 @@ export async function postReview({
     }
   }
 }
+
+module.exports = {
+  dismissReviews,
+  postReview,
+}

ci/github-script/run

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env -S node --import ./run
 import { execSync } from 'node:child_process'
 import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
 import { tmpdir } from 'node:os'
@@ -60,7 +60,7 @@ program
   .argument('<pr>', 'Number of the Pull Request to check')
   .option('--no-cherry-picks', 'Do not expect cherry-picks.')
   .action(async (owner, repo, pr, options) => {
-    const commits = (await import('./commits.ts')).default
+    const commits = (await import('./commits.js')).default
     await run(commits, owner, repo, pr, options)
   })
 
@@ -101,7 +101,7 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkCommitMessages = (await import('./lint-commits.ts')).default
+    const checkCommitMessages = (await import('./lint-commits.js')).default
     await run(checkCommitMessages, owner, repo, pr, options)
   })
 
@@ -112,7 +112,7 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkTargetBranch = (await import('./check-target-branch.ts')).checkTargetBranch
+    const checkTargetBranch = (await import('./check-target-branch.ts')).default
     await run(checkTargetBranch, owner, repo, pr, options)
   })
 
@@ -123,19 +123,8 @@ program
   .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
   .argument('<pr>', 'Number of the Pull Request to run on')
   .action(async (owner, repo, pr, options) => {
-    const checkManualFileEdits = (await import('./manual-file-edits.ts')).default
+    const checkManualFileEdits = (await import('./manual-file-edits.js')).default
     await run(checkManualFileEdits, owner, repo, pr, options)
   })
 
-program
-  .command('reminders')
-  .description('Post reminders for the paths a PR touches')
-  .argument('<owner>', 'Owner of the GitHub repository to run on (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
-  .argument('<pr>', 'Number of the Pull Request to run on')
-  .action(async (owner, repo, pr, options) => {
-    const postReminders = (await import('./reminders.ts')).default
-    await run(postReminders, owner, repo, pr, options)
-  })
-
 await program.parse()

ci/github-script/supportedSystems.js

@@ -0,0 +1,11 @@
+// @ts-nocheck
+module.exports = async ({ github, context, targetSha }) => {
+  const { content, encoding } = (
+    await github.rest.repos.getContent({
+      ...context.repo,
+      path: 'pkgs/top-level/release-supported-systems.json',
+      ref: targetSha,
+    })
+  ).data
+  return JSON.parse(Buffer.from(content, encoding).toString())
+}

ci/github-script/supportedSystems.ts

@@ -1,30 +0,0 @@
-interface SupportedSystemsProps {
-  github: InstanceType<typeof import('@actions/github/lib/utils').GitHub>
-  context: typeof import('@actions/github').context
-  targetSha: string
-}
-
-export default async ({
-  github,
-  context,
-  targetSha,
-}: SupportedSystemsProps) => {
-  const contentObject = (
-    await github.rest.repos.getContent({
-      ...context.repo,
-      path: 'pkgs/top-level/release-supported-systems.json',
-      ref: targetSha,
-    })
-  ).data
-
-  if ('type' in contentObject && contentObject.type === 'file') {
-    const { content, encoding } = contentObject
-    return JSON.parse(
-      Buffer.from(content, encoding as BufferEncoding).toString(),
-    )
-  } else {
-    throw new Error(
-      'Fetched pkgs/top-level/release-supported-systems.json is not a file',
-    )
-  }
-}

ci/github-script/tsconfig.json

@@ -14,7 +14,7 @@
     "strict": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
-    "moduleResolution": "nodenext",
+    "moduleResolution": "node16",
 
     "allowImportingTsExtensions": true,
     "allowJs": true,

ci/github-script/withRateLimit.js

@@ -1,7 +1,7 @@
 // @ts-nocheck
-import Bottleneck from 'bottleneck'
+module.exports = async ({ github, core, maxConcurrent = 1 }, callback) => {
+  const Bottleneck = require('bottleneck')
 
-export default async ({ github, core, maxConcurrent = 1 }, callback) => {
   const stats = {
     issues: 0,
     prs: 0,

ci/nixpkgs-vet.nix

@@ -31,7 +31,6 @@ runCommand "nixpkgs-vet"
     env.NIXPKGS_VET_NIX_PACKAGE = nix;
   }
   ''
-    export NIX_STORE_DIR=$(mktemp -d)
     export NIX_STATE_DIR=$(mktemp -d)
     $NIXPKGS_VET_NIX_PACKAGE/bin/nix-store --init
 

ci/pinned.json

@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "7d5589bbf421c7b6f4185371abe3c465b1b557e9",
-      "url": "https://github.com/NixOS/nixpkgs/archive/7d5589bbf421c7b6f4185371abe3c465b1b557e9.tar.gz",
-      "hash": "sha256-8emM5Z42GzMSLLvjJt7UkX1j2k2TKXQIS7FnPTfeHno="
+      "revision": "7525d999cd850b9a488817abc89c75dc733acf17",
+      "url": "https://github.com/NixOS/nixpkgs/archive/7525d999cd850b9a488817abc89c75dc733acf17.tar.gz",
+      "hash": "sha256-4IHyyLgLBdKefkljdKod4IMn023pQiDXAWJA187cmdY="
     },
     "nixpkgs-26.05-darwin": {
       "type": "Git",
@@ -22,9 +22,9 @@
       },
       "branch": "nixpkgs-26.05-darwin",
       "submodules": false,
-      "revision": "7486293a941f7b0ec123f0c431517027f705f60f",
-      "url": "https://github.com/NixOS/nixpkgs/archive/7486293a941f7b0ec123f0c431517027f705f60f.tar.gz",
-      "hash": "sha256-WQhNWIW3PPijuZexyl5Zf0tJuQ7sKt5C9WPXVO4pMuM="
+      "revision": "51fe96f9107566e6b8eeb7fc4ba696c01e548b04",
+      "url": "https://github.com/NixOS/nixpkgs/archive/51fe96f9107566e6b8eeb7fc4ba696c01e548b04.tar.gz",
+      "hash": "sha256-yj0LPLnsmYoLmA3FGANjeTEwej0/DHjZBXWnDQDUuIs="
     }
   },
   "version": 8

ci/supportedBranches.js

@@ -2,12 +2,9 @@
 /*
 #!nix-shell -i node -p nodejs
 */
-import { resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
+// @ts-nocheck
 
-type BranchType = 'channel' | 'development' | 'primary' | 'secondary'
-
-const typeConfig: Record<string, BranchType[]> = {
+const typeConfig = {
   master: ['development', 'primary'],
   release: ['development', 'primary'],
   staging: ['development', 'secondary'],
@@ -20,7 +17,7 @@ const typeConfig: Record<string, BranchType[]> = {
 
 // "order" ranks the development branches by how likely they are the intended base branch
 // when they are an otherwise equally good fit according to ci/github-script/prepare.js.
-const orderConfig: Record<string, number> = {
+const orderConfig = {
   master: 0,
   release: 1,
   staging: 2,
@@ -29,30 +26,15 @@ const orderConfig: Record<string, number> = {
   'staging-next': 4,
 }
 
-type Digit = 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9
-type Version = `${Digit}${Digit}.${Digit}${Digit}` | 'unstable'
-interface SplitResult {
-  prefix: string
-  version: Version
-  suffix?: string
+function split(branch) {
+  return {
+    ...branch.match(
+      /(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/,
+    ).groups,
+  }
 }
 
-function split(branch: string) {
-  const groups = branch.match(
-    /(?<prefix>.+?)(-(?<version>\d{2}\.\d{2}|unstable)(?:-(?<suffix>.*))?)?$/,
-  )!.groups!
-  return groups as unknown as SplitResult
-}
-
-interface BranchClassification {
-  branch: string
-  order: number
-  stable: boolean
-  type: BranchType[]
-  version: Version
-}
-
-function classify(branch: string): BranchClassification {
+function classify(branch) {
   const { prefix, version } = split(branch)
   return {
     branch,
@@ -63,15 +45,12 @@ function classify(branch: string): BranchClassification {
   }
 }
 
-export { classify, split }
+module.exports = { classify, split }
 
 // If called directly via CLI, runs the following tests:
-if (
-  process.argv[1] &&
-  fileURLToPath(import.meta.url) === resolve(process.argv[1])
-) {
+if (!module.parent) {
   console.log('split(branch)')
-  function testSplit(branch: string) {
+  function testSplit(branch) {
     console.log(branch, split(branch))
   }
   testSplit('master')
@@ -88,7 +67,7 @@ if (
   console.log('')
 
   console.log('classify(branch)')
-  function testClassify(branch: string) {
+  function testClassify(branch) {
     console.log(branch, classify(branch))
   }
   testClassify('master')

ci/treefmt.nix

@@ -39,11 +39,6 @@
           ".github/workflows/*.yml"
           ".github/workflows/*.yaml"
         ];
-        options = [
-          # Support self-repository syntax
-          ''-ignore=reusable workflow call "\$/.+" at "uses" is not following the format''
-          ''-ignore=specifying action "\$/.+" in invalid format because ref is missing.''
-        ];
       };
 
       biome = {

doc/README.md

@@ -7,26 +7,19 @@ This directory houses the source files for the Nixpkgs manual.
 > We are actively restructuring our documentation to be more beginner friendly.
 >
 
-When writing new docs use **Progressive Disclosure:**
+When writing new docs use **Progressive Disclosure**
 
-- Start simple, pick up beginners.
-- Use **examples** first to show how to get something done.
-- Keep **explanation** lean.
+Start simple, pick up beginners.
+Use **examples** first to show how to get something done. Keep **Explanation** lean.
 
-Use our [style guide](./styleguide.md) for more in depth guidance on writing good documentation.
+Use our [styleguide](./styleguide.md) for more in depth guidance on writing good documentation.
 
-Documentation about Nixpkgs belongs here.
-This includes getting started guides and onboarding guides for *using* Nixpkgs and the language frameworks it ships.
+Documentation about Nixpkgs belongs here, this includes 'getting-started'-guides and 'onboarding-guides' for *using* Nixpkgs and the language frameworks it ships.
 
 Write **guides** task-first: lead with a working example, then explain in prose.
 Write **reference** as the specification of functions and attributes.
 
-We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with the `:doc` command in `nix repl`, e.g.:
-
-```
-nix-repl> :l <nixpkgs>
-nix-repl> :doc lib.mapAttrsToList
-```
+We are actively working to generate reference documentation from the [doc-comments](https://github.com/NixOS/rfcs/blob/master/rfcs/0145-doc-strings.md) present in code, which also lets you view it locally with `:doc` in `nix repl`.
 
 See [Document structure](#document-structure) for a structural template.
 
@@ -49,23 +42,23 @@ If the build succeeds, the manual will be in `./result/share/doc/nixpkgs/manual.
 
 ### Development environment
 
-To reduce repetition, consider using tools from the documentation development environment:
+To reduce repetition, consider using tools from the provided development environment:
+
+Load it from the Nixpkgs documentation directory with
 
 ```ShellSession
 $ cd /path/to/nixpkgs/doc
 $ nix-shell
 ```
 
-To load the documentation development environment automatically when entering that directory:
+To load the development utilities automatically when entering that directory, [set up `nix-direnv`](https://nix.dev/guides/recipes/direnv).
 
-1. Install [`nix-direnv`](https://search.nixos.org/packages?channel=unstable&query=nix-direnv#show=nix-direnv)
-1. Set up direnv in the documentation directory:
+Make sure that your local files aren't added to Git history by adding the following lines to `.git/info/exclude` at the root of the Nixpkgs repository:
 
-   ```ShellSession
-   $ cd doc
-   $ echo "use nix" > .envrc
-   $ direnv allow
-   ```
+```
+/**/.envrc
+/**/.direnv
+```
 
 #### Live preview
 
@@ -140,12 +133,14 @@ A few markups for other kinds of literals are also available:
 - `` {env}`XDG_DATA_DIRS` ``
 - `` {file}`/etc/passwd` ``
 - `` {option}`networking.useDHCP` ``
-- `` {var}`pkgs` ``
-
-The values will be formatted as inline `<code>` elements.
+- `` {var}`/etc/passwd` ``
 
 These literal kinds are used mostly in NixOS option documentation.
 
+This syntax is taken from [MyST](https://myst-parser.readthedocs.io/en/latest/syntax/syntax.html#roles-an-in-line-extension-point).
+Though, the feature originates from [reStructuredText](https://www.sphinx-doc.org/en/master/usage/restructuredtext/roles.html#role-manpage) with slightly different syntax.
+They are handled by `myst_role` defined per renderer. <!-- reverse references in code -->
+
 #### Admonitions
 
 Set off from the text to bring attention to something.
@@ -168,7 +163,7 @@ The following are supported:
 - `example`
 
 Example admonitions require a title to work.
-If you don't provide one, the manual won't build.
+If you don't provide one, the manual won't be built.
 
 ```markdown
 ::: {.example #ex-showing-an-example}
@@ -184,11 +179,11 @@ Text for the example.
 For defining a group of terms:
 
 ```markdown
-Pear
-:   Green or yellow bulbous fruit
+pear
+:   green or yellow bulbous fruit
 
-Watermelon
-:   Green fruit with red flesh
+watermelon
+:   green fruit with red flesh
 ```
 
 ## Commit conventions
@@ -220,7 +215,7 @@ When needed, each convention explains why it exists, so you can make a decision
 Note that these conventions are about the **structure** of the manual (and its source files), not about the content that goes in it.
 You, as the writer of documentation, are still in charge of its content.
 
-**For prose style, see the [documentation style guide](./styleguide.md).**
+**For prose style, see the [documentation styleguide](./styleguide.md).**
 
 ### Document structure
 
@@ -290,7 +285,7 @@ When changing existing content, update formatting if possible, but avoid excessi
 
 ### Examples first
 
-Put examples before detailed explanations (see the [style guide](./styleguide.md) for the rationale).
+Put examples before detailed explanations (see the [styleguide](./styleguide.md) for the rationale).
 
 Use this structure for each documented item:
 

doc/build-helpers.md

@@ -15,3 +15,15 @@ In addition, it offers various options to customize parts of the builds.
 There is no uniform interface for build helpers.
 [Trivial build helpers](#chap-trivial-builders) and [fetchers](#chap-pkgs-fetchers) have various input types for convenience.
 [Language- or framework-specific build helpers](#chap-language-support) usually follow the style of `stdenv.mkDerivation`, which accepts an attribute set or a fixed-point function taking an attribute set.
+
+```{=include=} chapters
+build-helpers/fixed-point-arguments.chapter.md
+build-helpers/fetchers.chapter.md
+build-helpers/trivial-build-helpers.chapter.md
+build-helpers/testers.chapter.md
+build-helpers/dev-shell-tools.chapter.md
+build-helpers/special.md
+build-helpers/images.md
+hooks/index.md
+packages/index.md
+```

doc/build-helpers/fetchers.chapter.md

@@ -988,20 +988,6 @@ fetchRadiclePatch {
 }
 ```
 
-## `fetchFromTangled` {#fetchfromtangled}
-
-This is to be used with tangled repositories. `fetchFromTangled` works with
-very similar arguments to `fetchFromGithub`. However, instead of a `owner` and
-`repo`, a `did` argument is expected.
-
-```nix
-fetchFromTangled {
-  did = "did:plc:jj6ajj6duxnlthwtnob4qyuv"; # tranquil.farm/tranquil-pds
-  tag = "v6.6.0";
-  hash = "sha256-cfTsjmK/IMqT5kMKOGpwwWbBlvtrCDOerUJJ8AVI3kY=";
-}
-```
-
 ## `requireFile` {#requirefile}
 
 `requireFile` allows requesting files that cannot be fetched automatically, but whose content is known.

doc/build-helpers/images.md

@@ -1,3 +1,12 @@
 # Images {#chap-images}
 
 This chapter describes tools for creating various types of images.
+
+```{=include=} sections
+images/appimagetools.section.md
+images/dockertools.section.md
+images/ocitools.section.md
+images/portableservice.section.md
+images/makediskimage.section.md
+images/binarycache.section.md
+```

doc/build-helpers/special.md

@@ -1,3 +1,13 @@
 # Special build helpers {#chap-special}
 
 This chapter describes several special build helpers.
+
+```{=include=} sections
+special/buildenv.section.md
+special/fakenss.section.md
+special/fhs-environments.section.md
+special/makesetuphook.section.md
+special/mkshell.section.md
+special/vm-tools.section.md
+special/checkpoint-build.section.md
+```

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -3,35 +3,6 @@
 Nixpkgs provides a variety of wrapper functions that help build commonly useful derivations.
 Like [`stdenv.mkDerivation`](#sec-using-stdenv), each of these build helpers creates a derivation, but the arguments passed are different (usually simpler) from those required by `stdenv.mkDerivation`.
 
-## Arguments with finalAttrs {#trivial-builder-finalAttrs}
-
-In parameters that reference this section, you may either pass the value itself,
-or a function that produces it.
-When it's a function the argument value is [`finalAttrs`] from [`mkDerivation`].
-
-Typically both the *attributes* and *script* arguments support this, simultaneously if needed.
-
-::: {.example #ex-trivial-builder-finalAttrs}
-# Using `finalAttrs` in a build helper
-
-```nix
-runCommand "hi" (finalAttrs: { passthru.exe = "${finalAttrs.finalPackage}/bin/hi"; }) ''
-  mkdir -p $out/bin
-  substitute ${./hi.foo} $out/bin/hi --replace-fail "@foo@" ${lib.getExe foo}
-''
-```
-
-This creates a package with an executable script that's in the standard `bin/` directory,
-but also convenient to interpolate without reliance on `$PATH`, e.g assuming the result of the above is in binding `hi`:
-```nix
-''
-  echo START_GREETING
-  ${hi.exe} --rude
-  echo END_GREETING
-''
-```
-
-:::
 
 ## `runCommandWith` {#trivial-builder-runCommandWith}
 
@@ -52,10 +23,8 @@ runCommandWith :: {
   name :: name;
   stdenv? :: Derivation;
   runLocal? :: Bool;
-  derivationArgs? :: { ... } | finalAttrs@{ finalPackage :: Derivation, ... } -> { ... };
-}
-  -> (String | finalAttrs@{ finalPackage :: Derivation, ... } -> String)
-  -> Derivation
+  derivationArgs? :: { ... };
+} -> String -> Derivation
 ```
 
 ### Inputs {#trivial-builder-runCommandWith-Inputs}
@@ -78,10 +47,10 @@ runCommandWith :: {
 `stdenv` (Derivation)
 :   The [standard environment](#chap-stdenv) to use, defaulting to `pkgs.stdenv`.
 
-`derivationArgs` (Attribute set *or* [function from `finalAttrs`](#trivial-builder-finalAttrs))
+`derivationArgs` (Attribute set)
 :   Additional arguments for [`mkDerivation`](#sec-using-stdenv).
 
-`buildCommand` (String *or* [function from `finalAttrs`](#trivial-builder-finalAttrs))
+`buildCommand` (String)
 :   Shell commands to run in the derivation builder.
 
     ::: {.note}
@@ -140,10 +109,10 @@ While the type signature(s) differ from [`runCommandWith`], individual arguments
 `name` (String)
 :   The derivation's name
 
-`derivationArgs` (Attribute set *or* [function from `finalAttrs`](#trivial-builder-finalAttrs))
+`derivationArgs` (Attribute set)
 :   Additional parameters passed to [`mkDerivation`]
 
-`buildCommand` (String *or* [function from `finalAttrs`](#trivial-builder-finalAttrs))
+`buildCommand` (String)
 :   The command(s) run to build the derivation.
 
 
@@ -933,6 +902,3 @@ produces an output path `/nix/store/<hash>-runtime-references` containing
 
 but none of `hello`'s dependencies because those are not referenced directly
 by `hi`'s output.
-
-[`finalAttrs`]: #mkderivation-recursive-attributes
-[`mkDerivation`]: #sec-using-stdenv

doc/contributing.md

@@ -1,84 +1,10 @@
-# Contributing {#part-contributing}
+# Contributing to Nixpkgs {#part-contributing}
 
-<!--
-    Legacy anchors. The sections behind these ids used to live in this manual and are
-    now maintained elsewhere. We keep these invisible anchor ids so external URIs would link to this page.
--->
-<!-- moved to CONTRIBUTING.md -->
-[]{#chap-conventions}
-[]{#sec-syntax}
-[]{#sec-organisation}
-[]{#chap-submitting-changes}
-[]{#submitting-changes-submitting-changes}
-[]{#submitting-changes-pull-request-template}
-[]{#submitting-changes-tested-with-sandbox}
-[]{#submitting-changes-platform-diversity}
-[]{#submitting-changes-nixos-tests}
-[]{#submitting-changes-tested-compilation}
-[]{#submitting-changes-tested-execution}
-[]{#submitting-changes-contribution-standards}
-[]{#submitting-changes-hotfixing-pull-requests}
-[]{#submitting-changes-commit-policy}
-[]{#submitting-changes-branches}
-[]{#submitting-changes-master-branch}
-[]{#submitting-changes-staging-branch}
-[]{#submitting-changes-staging-next-branch}
-[]{#submitting-changes-stable-release-branches}
-[]{#submitting-changes-stable-release-branches-automatic-backports}
-[]{#submitting-changes-stable-release-branches-manual-backports}
-[]{#acceptable-backport-criteria}
-[]{#chap-reviewing-contributions}
-[]{#reviewing-contributions-other-submissions}
-[]{#reviewing-contributions--merging-pull-requests}
-[]{#part-development}
-
-<!-- moved to pkgs/README.md -->
-[]{#chap-quick-start}
-[]{#sec-package-naming}
-[]{#sec-versioning}
-[]{#sec-sources}
-[]{#sec-source-hashes}
-[]{#sec-source-hashes-security}
-[]{#sec-patches}
-[]{#sec-package-tests}
-[]{#ssec-inline-package-tests-writing}
-[]{#ssec-package-tests-writing}
-[]{#ssec-package-tests-running}
-[]{#ssec-package-tests-examples}
-[]{#ssec-nixos-tests-linking}
-[]{#ssec-import-from-derivation}
-[]{#submitting-changes-submitting-security-fixes}
-[]{#submitting-changes-deprecating-packages}
-[]{#steps-to-remove-a-package-from-nixpkgs}
-[]{#chap-vulnerability-roundup}
-[]{#vulnerability-roundup-issues}
-[]{#vulnerability-roundup-triaging-and-fixing}
-[]{#reviewing-contributions-package-updates}
-[]{#reviewing-contributions-new-packages}
-
-<!-- moved to nixos/README.md -->
-[]{#reviewing-contributions-module-updates}
-[]{#reviewing-contributions-new-modules}
-
-<!-- moved to maintainers/README.md -->
-[]{#reviewing-contributions-individual-maintainer-list}
-[]{#reviewing-contributions-maintainer-teams}
-
-<!-- moved to doc/README.md -->
-[]{#chap-contributing}
-
-Contribution documentation lives along the repository scope it applies to:
-
-- [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): coding conventions, file organisation, submitting changes, commit policy, branches and backports, reviewing contributions.
-- [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md): adding and updating packages, package naming and versioning, source fetching and hashes, patches, package tests, deprecating packages, security fixes.
-- [nixos/README.md](https://github.com/NixOS/nixpkgs/blob/master/nixos/README.md): NixOS modules and reviewing module changes.
-- [maintainers/README.md](https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md): maintainer entries and maintainer teams.
-- [doc/README.md](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md): writing and building this manual.
-
-## Opening issues {#sec-opening-issues}
-
-- Make sure you have a [GitHub account](https://github.com/signup/free)
-- Make sure there is no open issue on the topic
-- [Submit a new issue](https://github.com/NixOS/nixpkgs/issues/new/choose) by choosing the kind of topic and filling out the template
-
-<!-- In the future this section could also include more detailed information on the issue templates -->
+```{=include=} chapters
+contributing/quick-start.chapter.md
+contributing/coding-conventions.chapter.md
+contributing/submitting-changes.chapter.md
+contributing/vulnerability-roundup.chapter.md
+contributing/reviewing-contributions.chapter.md
+contributing/contributing-to-documentation.chapter.md
+```

doc/contributing/coding-conventions.chapter.md

@@ -0,0 +1,63 @@
+# Coding conventions {#chap-conventions}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+## Syntax {#sec-syntax}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+## Package naming {#sec-package-naming}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## File naming and organisation {#sec-organisation}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+### Versioning {#sec-versioning}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Fetching Sources {#sec-sources}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Obtaining source hash {#sec-source-hashes}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+### Obtaining hashes securely {#sec-source-hashes-security}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Patches {#sec-patches}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Package tests {#sec-package-tests}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+### Writing inline package tests {#ssec-inline-package-tests-writing}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+### Writing larger package tests {#ssec-package-tests-writing}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+### Running package tests {#ssec-package-tests-running}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+### Examples of package tests {#ssec-package-tests-examples}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+### Linking NixOS module tests to a package {#ssec-nixos-tests-linking}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+### Import From Derivation {#ssec-import-from-derivation}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).

doc/contributing/contributing-to-documentation.chapter.md

@@ -0,0 +1,3 @@
+# Contributing to Nixpkgs documentation {#chap-contributing}
+
+This section has been moved to [doc/README.md](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md).

doc/contributing/quick-start.chapter.md

@@ -0,0 +1,3 @@
+# Quick Start to Adding a Package {#chap-quick-start}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).

doc/contributing/reviewing-contributions.chapter.md

@@ -0,0 +1,35 @@
+# Reviewing contributions {#chap-reviewing-contributions}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+## Package updates {#reviewing-contributions-package-updates}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## New packages {#reviewing-contributions-new-packages}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Module updates {#reviewing-contributions-module-updates}
+
+This section has been moved to [nixos/README.md](https://github.com/NixOS/nixpkgs/blob/master/nixos/README.md).
+
+## New modules {#reviewing-contributions-new-modules}
+
+This section has been moved to [nixos/README.md](https://github.com/NixOS/nixpkgs/blob/master/nixos/README.md#new-modules).
+
+## Individual maintainer list {#reviewing-contributions-individual-maintainer-list}
+
+This section has been moved to [maintainers/README.md](https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md).
+
+## Maintainer teams {#reviewing-contributions-maintainer-teams}
+
+This section has been moved to [maintainers/README.md](https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md).
+
+## Other submissions {#reviewing-contributions-other-submissions}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+## Merging pull requests {#reviewing-contributions--merging-pull-requests}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).

doc/contributing/submitting-changes.chapter.md

@@ -0,0 +1,88 @@
+# Submitting changes {#chap-submitting-changes}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+## Submitting changes {#submitting-changes-submitting-changes}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+## Submitting security fixes {#submitting-changes-submitting-security-fixes}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Deprecating/removing packages {#submitting-changes-deprecating-packages}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+### Steps to remove a package from Nixpkgs {#steps-to-remove-a-package-from-nixpkgs}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Pull Request Template {#submitting-changes-pull-request-template}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+### Tested using sandboxing {#submitting-changes-tested-with-sandbox}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+### Built on platform(s) {#submitting-changes-platform-diversity}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+### Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests) {#submitting-changes-nixos-tests}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+### Tested compilation of all pkgs that depend on this change using `nixpkgs-review` {#submitting-changes-tested-compilation}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+### Tested execution of all binary files (usually in `./result/bin/`) {#submitting-changes-tested-execution}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+### Meets Nixpkgs contribution standards {#submitting-changes-contribution-standards}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+## Hotfixing pull requests {#submitting-changes-hotfixing-pull-requests}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+## Commit policy {#submitting-changes-commit-policy}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+### Branches {#submitting-changes-branches}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+#### Master branch {#submitting-changes-master-branch}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+#### Staging branch {#submitting-changes-staging-branch}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+#### Staging-next branch {#submitting-changes-staging-next-branch}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+#### Stable release branches {#submitting-changes-stable-release-branches}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+#### Automatically backporting a Pull Request {#submitting-changes-stable-release-branches-automatic-backports}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+#### Manually backporting changes {#submitting-changes-stable-release-branches-manual-backports}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+#### Acceptable backport criteria {#acceptable-backport-criteria}
+
+This section has been moved to [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+

doc/contributing/vulnerability-roundup.chapter.md

@@ -0,0 +1,11 @@
+# Vulnerability Roundup {#chap-vulnerability-roundup}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Issues {#vulnerability-roundup-issues}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).
+
+## Triaging and Fixing {#vulnerability-roundup-triaging-and-fixing}
+
+This section has been moved to [pkgs/README.md](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md).

doc/development.md

@@ -0,0 +1,10 @@
+# Development of Nixpkgs {#part-development}
+
+This section shows you how Nixpkgs is developed and how you can interact with the contributors and the latest updates.
+If you are interested in contributing yourself, see [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md).
+
+<!-- In the future this section should also include: How to test pull requests, how to know if pull requests are available in channels, etc. -->
+
+```{=include=} chapters
+development/opening-issues.chapter.md
+```

doc/development/opening-issues.chapter.md

@@ -0,0 +1,7 @@
+# Opening issues {#sec-opening-issues}
+
+* Make sure you have a [GitHub account](https://github.com/signup/free)
+* Make sure there is no open issue on the topic
+* [Submit a new issue](https://github.com/NixOS/nixpkgs/issues/new/choose) by choosing the kind of topic and filling out the template
+
+<!-- In the future this section could also include more detailed information on the issue templates -->

doc/doc-support/include-to-nav.py

@@ -1,205 +0,0 @@
-import json
-import re
-import sys
-from pathlib import Path
-from typing import TypedDict
-
-# Coupled to where this file lives!
-# Needed to resolve the relative includes file paths
-REPO_ROOT = Path(__file__).resolve().parent.parent.parent
-
-ROOT_FILE = REPO_ROOT / "nixos/doc/manual/manual.md"
-DOC_ROOT = ROOT_FILE.parent
-
-INCLUDE_RE = re.compile(r"^```\{=include=\}(?P<rest>.*)$")
-FENCE_RE = re.compile(r"^(```|~~~)")
-HEADING_RE = re.compile(r"^(#{1,6})\s+(.*?)\s*(?:\{#([^}]+)\})?\s*$")
-
-
-class TokenIncludeBlock:
-    """Represents a complete include block like:
-
-    ```{=include=} sections
-    special/buildenv.section.md
-    ```
-
-    As
-
-    typ = "sections"
-    files = [ "special/buildenv.section.md" ]
-
-    """
-    kind = "include"
-
-    def __repr__(self):
-        # For debugging
-        return f"```{{=include=}} {self.typ}\n" "\n".join(self.files) + "\n```"
-
-    def __init__(self, typ, args, files, start, end):
-        self.typ: str = typ
-        self.args: list[str] = args
-        self.files: list[str] = files
-        self.start: int = start
-        self.end: int = end
-
-    def is_option_block(self) -> bool:
-        # option blocks have some special syntax which is part of another migration
-        # 8 coccurrences, seperate migration
-        return self.typ == "options"
-
-    def into_file(self) -> bool:
-        # into-file is trivial after the nav migration
-        # 2 coccurrences, can be migrated by hand
-        return any("html:into-file=" in arg for arg in self.args)
-
-    def keep(self) -> bool:
-        # Keep the include blocks that require seperate migration
-        return self.is_option_block() or self.into_file()
-
-class TokenHeading:
-    kind = "heading"
-
-    def __init__(self, level, title, anchor):
-        self.level: int = level
-        self.title: str = title
-        self.anchor: str = anchor
-
-
-def tokenize(src: str) -> list[TokenIncludeBlock|TokenHeading]:
-    """Finds all Includes and Headings"""
-    lines = src.splitlines()
-    items = []
-    fenced = False
-    i = 0
-    while i < len(lines):
-        line = lines[i]
-        m = INCLUDE_RE.match(line)
-        if m and not fenced:
-            typ, *args = m.group("rest").split()
-            end = i + 1
-            while end < len(lines) and not lines[end].startswith("```"):
-                end += 1
-            if end == len(lines):
-                sys.exit(f"unterminated include block at line {i + 1}")
-            files = [f.strip() for f in lines[i + 1 : end] if f.strip()]
-            items.append(TokenIncludeBlock(typ, args, files, i, end))
-            i = end + 1
-            continue
-        if FENCE_RE.match(line):
-            fenced = not fenced
-            i += 1
-            continue
-        if not fenced:
-            m = HEADING_RE.match(line)
-            if m:
-                items.append(TokenHeading(len(m.group(1)), m.group(2), m.group(3)))
-        i += 1
-    return items
-
-
-def read_source(source: Path) ->  None | tuple[str, Path]:
-    """Read a return [content,Path]
-
-    library.md is called .md.in; provided at build time via nixdoc
-
-    So the filename might differ
-    """
-    if source.exists():
-        return source.read_text(), source
-
-    in_file = Path(str(source) + ".in")
-    if in_file.exists():
-        return in_file.read_text(), in_file
-    return None
-
-# Make sure we process every file only once
-visited = set()
-
-# Map from filename -> line_nrs
-# These lines will be deleted from the file
-rewrites: dict[str, tuple[int,int]] = {}
-
-group_ids: set[str] = set()
-
-class Green(TypedDict):
-    label: str
-    id: str
-    children: list["Green"]
-    file: str | None
-
-def convert_md_in(md_in: Path) -> Green:
-    """Build up items for the nav.json as we recurse.
-    Collecting line-areas and group_ids
-    """
-    if md_in in visited:
-        sys.exit(f"{md_in}: reached twice")
-
-    visited.add(md_in)
-
-    res = read_source(md_in)
-
-    rel_file = md_in.relative_to(DOC_ROOT).as_posix()
-    if not res:
-        return {"file": rel_file}
-
-    text, actual = res
-    token: list[TokenHeading|TokenIncludeBlock] = tokenize(text)
-
-    # Collect a list of actual files to be processed
-    # Recurse for files
-    # Do not recurse for "options", "into-file"
-    all_file_includes: list[TokenIncludeBlock] = [it for it in token if it.kind == "include" and not (it.is_option_block() or it.into_file())]
-    children = [convert_md_in((md_in.parent / f).resolve()) for b in all_file_includes for f in b.files]
-
-    # Lines to rewrite
-    include_blocks_to_rewrite: list[TokenIncludeBlock] = [it for it in all_file_includes if not it.keep()]
-    rewrites[actual] = [(b.start, b.end) for b in include_blocks_to_rewrite]
-
-    if not children:
-        return {"file": rel_file}
-
-    title = next((it for it in token if it.kind == "heading" and it.level == 1), None)
-    if title is None:
-        sys.exit(f"{md_in}: no level-1 heading to label its group")
-    if not title.anchor:
-        sys.exit(f"{md_in}: level-1 heading has no id")
-    if title.anchor in group_ids:
-        sys.exit(f"{md_in}: duplicate group id {title.anchor}")
-    group_ids.add(title.anchor)
-
-    return Green({
-        "label": title.title.replace("`", ""),
-        "id": title.anchor,
-        "children": [{"file": rel_file}] + children,
-    })
-
-
-def remove_includes(path: Path, drop_lines: tuple[int,int]):
-    if not drop_lines:
-        return
-
-    lines = path.read_text().splitlines()
-    for start, end in sorted(drop_lines, reverse=True):
-        del lines[start : end + 1]
-        if 0 < start < len(lines) and not lines[start - 1].strip() and not lines[start].strip():
-            del lines[start]
-    while lines and not lines[-1].strip():
-        lines.pop()
-    path.write_text("\n".join(lines) + "\n")
-
-
-def main():
-    nav = DOC_ROOT / "nav.json"
-    if json.loads(nav.read_text())["items"]:
-        sys.exit("nav.json already has items; This tool can only run once")
-
-    root = convert_md_in(ROOT_FILE)
-    items = root["children"][1:]
-
-    nav.write_text(json.dumps({"open": [], "items": items}, indent=2) + "\n")
-    for path, lines in rewrites.items():
-        remove_includes(path, lines)
-
-
-if __name__ == "__main__":
-    main()

doc/doc-support/lib-function-docs.nix

@@ -1,27 +1,151 @@
 # Generates the documentation for library functions via nixdoc.
 # To build this derivation, run `nix-build -A nixpkgs-manual.lib-docs`
 {
+  lib,
   stdenvNoCC,
   nixdoc,
+  nix,
+  nixpkgs ? { },
+  libsets ? [
+    {
+      name = "asserts";
+      description = "assertion functions";
+    }
+    {
+      name = "attrsets";
+      description = "attribute set functions";
+    }
+    {
+      name = "strings";
+      description = "string manipulation functions";
+    }
+    {
+      name = "versions";
+      description = "version string functions";
+    }
+    {
+      name = "trivial";
+      description = "miscellaneous functions";
+    }
+    {
+      name = "fixedPoints";
+      baseName = "fixed-points";
+      description = "explicit recursion functions";
+    }
+    {
+      name = "lists";
+      description = "list manipulation functions";
+    }
+    {
+      name = "debug";
+      description = "debugging functions";
+    }
+    {
+      name = "options";
+      description = "NixOS / nixpkgs option handling";
+    }
+    {
+      name = "path";
+      description = "path functions";
+    }
+    {
+      name = "fetchers";
+      description = "functions which can be reused across fetchers";
+    }
+    {
+      name = "filesystem";
+      description = "filesystem functions";
+    }
+    {
+      name = "fileset";
+      description = "file set functions";
+    }
+    {
+      name = "sources";
+      description = "source filtering functions";
+    }
+    {
+      name = "cli";
+      description = "command-line serialization functions";
+    }
+    {
+      name = "generators";
+      description = "functions that create file formats from nix data structures";
+    }
+    {
+      name = "gvariant";
+      description = "GVariant formatted string serialization functions";
+    }
+    {
+      name = "customisation";
+      description = "Functions to customise (derivation-related) functions, derivations, or attribute sets";
+    }
+    {
+      name = "meta";
+      description = "functions for derivation metadata";
+    }
+    {
+      name = "derivations";
+      description = "miscellaneous derivation-specific functions";
+    }
+  ],
 }:
+
 stdenvNoCC.mkDerivation {
   name = "nixpkgs-lib-docs";
 
   src = ../../lib;
 
-  nativeBuildInputs = [ nixdoc ];
-
-  buildPhase = ''
-    mkdir -p src
-    cp -r ${../../lib} src/lib
-
-    mkdir -p $out
-    nixdoc --manifest ${../function-catalog.json} --root src --output $out/lib-functions.json
-  '';
+  nativeBuildInputs = [
+    nixdoc
+    nix
+  ];
 
   installPhase = ''
     runHook preInstall
 
+    cd ..
+
+    export NIX_STATE_DIR=$(mktemp -d)
+    nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
+      --arg nixpkgsPath "./." \
+      --argstr revision ${nixpkgs.rev or "master"} \
+      --argstr libsetsJSON ${lib.escapeShellArg (builtins.toJSON libsets)} \
+      --store $(mktemp -d) \
+      > locations.json
+
+    function docgen {
+      name=$1
+      baseName=$2
+      description=$3
+      # TODO: wrap lib.$name in <literal>, make nixdoc not escape it
+      if [[ -e "lib/$baseName.nix" ]]; then
+        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName.nix" > "$out/$name.md"
+      else
+        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName/default.nix" > "$out/$name.md"
+      fi
+      echo "$out/$name.md" >> "$out/index.md"
+    }
+
+    mkdir -p "$out"
+
+    cat > "$out/index.md" << 'EOF'
+    ```{=include=} sections auto-id-prefix=auto-generated
+    EOF
+
+    ${lib.concatMapStrings (
+      {
+        name,
+        baseName ? name,
+        description,
+      }:
+      ''
+        docgen ${name} ${baseName} ${lib.escapeShellArg description}
+      ''
+    ) libsets}
+
+    echo '```' >> "$out/index.md"
+
     runHook postInstall
   '';
 }

doc/doc-support/lib-function-locations.nix

@@ -0,0 +1,82 @@
+{
+  nixpkgsPath,
+  revision,
+  libsetsJSON,
+}:
+let
+  lib = import (nixpkgsPath + "/lib");
+  libsets = builtins.fromJSON libsetsJSON;
+
+  libDefPos =
+    prefix: set:
+    builtins.concatMap (
+      name:
+      [
+        {
+          name = builtins.concatStringsSep "." (prefix ++ [ name ]);
+          location = builtins.unsafeGetAttrPos name set;
+        }
+      ]
+      ++ lib.optionals (builtins.length prefix == 0 && builtins.isAttrs set.${name}) (
+        libDefPos (prefix ++ [ name ]) set.${name}
+      )
+    ) (builtins.attrNames set);
+
+  libset =
+    toplib:
+    map (subsetname: {
+      subsetname = subsetname;
+      functions = libDefPos [ ] toplib.${subsetname};
+    }) (map (x: x.name) libsets);
+
+  flattenedLibSubset =
+    { subsetname, functions }:
+    map (fn: {
+      name = "lib.${subsetname}.${fn.name}";
+      value = fn.location;
+    }) functions;
+
+  locatedlibsets = libs: map flattenedLibSubset (libset libs);
+  removeFilenamePrefix =
+    prefix: filename:
+    let
+      prefixLen = (builtins.stringLength prefix) + 1; # +1 to remove the leading /
+      filenameLen = builtins.stringLength filename;
+      substr = builtins.substring prefixLen filenameLen filename;
+    in
+    substr;
+
+  removeNixpkgs = removeFilenamePrefix (toString nixpkgsPath);
+
+  liblocations = builtins.filter (elem: elem.value != null) (lib.lists.flatten (locatedlibsets lib));
+
+  fnLocationRelative =
+    { name, value }:
+    {
+      inherit name;
+      value = value // {
+        file = removeNixpkgs value.file;
+      };
+    };
+
+  relativeLocs = (map fnLocationRelative liblocations);
+  sanitizeId = builtins.replaceStrings [ "'" ] [ "-prime" ];
+
+  urlPrefix = "https://github.com/NixOS/nixpkgs/blob/${revision}";
+  jsonLocs = builtins.listToAttrs (
+    map (
+      { name, value }:
+      {
+        name = sanitizeId name;
+        value =
+          let
+            text = "${value.file}:${toString value.line}";
+            target = "${urlPrefix}/${value.file}#L${toString value.line}";
+          in
+          "[${text}](${target}) in `<nixpkgs>`";
+      }
+    ) relativeLocs
+  );
+
+in
+jsonLocs

doc/doc-support/package.nix

@@ -91,7 +91,7 @@ stdenvNoCC.mkDerivation (
       substituteInPlace ./languages-frameworks/python.section.md \
         --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
 
-      cp ${lib-docs}/lib-functions.json ./lib-functions.json
+      cat ./functions/library.md.in ${lib-docs}/index.md > ./functions/library.md
 
       substitute ./manual.md.in ./manual.md \
         --replace-fail '@MANUAL_VERSION@' '${lib.version}'
@@ -147,7 +147,7 @@ stdenvNoCC.mkDerivation (
     '';
 
     passthru = {
-      lib-docs = callPackage ./lib-function-docs.nix { };
+      lib-docs = callPackage ./lib-function-docs.nix { inherit nixpkgs; };
 
       epub = callPackage ./epub.nix { };
 
@@ -176,7 +176,5 @@ stdenvNoCC.mkDerivation (
         manpage-urls = callPackage ../tests/manpage-urls.nix { };
       };
     };
-
-    meta.license = lib.licenses.mit;
   }
 )

doc/function-catalog.json

@@ -1,124 +0,0 @@
-{
-  "version": 1,
-  "groups": [
-    { "id": "asserts", "description": "assertion functions" },
-    { "id": "attrsets", "description": "attribute set functions" },
-    { "id": "strings", "description": "string manipulation functions" },
-    { "id": "versions", "description": "version string functions" },
-    { "id": "trivial", "description": "miscellaneous functions" },
-    { "id": "fixedPoints", "description": "explicit recursion functions" },
-    { "id": "lists", "description": "list manipulation functions" },
-    { "id": "debug", "description": "debugging functions" },
-    { "id": "options", "description": "NixOS / nixpkgs option handling" },
-    { "id": "path", "description": "path functions" },
-    {
-      "id": "fetchers",
-      "description": "functions which can be reused across fetchers"
-    },
-    { "id": "filesystem", "description": "filesystem functions" },
-    { "id": "fileset" },
-    { "id": "sources", "description": "source filtering functions" },
-    { "id": "cli", "description": "command-line serialization functions" },
-    {
-      "id": "generators",
-      "description": "functions that create file formats from nix data structures"
-    },
-    {
-      "id": "gvariant",
-      "description": "GVariant formatted string serialization functions"
-    },
-    {
-      "id": "customisation",
-      "description": "Functions to customise (derivation-related) functions, derivations, or attribute sets"
-    },
-    { "id": "meta", "description": "functions for derivation metadata" },
-    {
-      "id": "derivations",
-      "description": "miscellaneous derivation-specific functions"
-    }
-  ],
-  "sources": [
-    { "path": "lib.trivial", "file": "lib/trivial.nix", "groups": ["trivial"] },
-    {
-      "path": "lib.fixedPoints",
-      "file": "lib/fixed-points.nix",
-      "groups": ["fixedPoints"]
-    },
-    {
-      "path": "lib.attrsets",
-      "file": "lib/attrsets.nix",
-      "groups": ["attrsets"]
-    },
-    { "path": "lib.lists", "file": "lib/lists.nix", "groups": ["lists"] },
-    { "path": "lib.strings", "file": "lib/strings.nix", "groups": ["strings"] },
-    {
-      "path": "lib.customisation",
-      "file": "lib/customisation.nix",
-      "groups": ["customisation"]
-    },
-    {
-      "path": "lib.derivations",
-      "file": "lib/derivations.nix",
-      "groups": ["derivations"]
-    },
-    { "path": "lib.meta", "file": "lib/meta.nix", "groups": ["meta"] },
-    {
-      "path": "lib.versions",
-      "file": "lib/versions.nix",
-      "groups": ["versions"]
-    },
-    { "path": "lib.cli", "file": "lib/cli.nix", "groups": ["cli"] },
-    {
-      "path": "lib.gvariant",
-      "file": "lib/gvariant.nix",
-      "groups": ["gvariant"]
-    },
-    {
-      "path": "lib.generators",
-      "file": "lib/generators.nix",
-      "groups": ["generators"]
-    },
-    { "path": "lib.asserts", "file": "lib/asserts.nix", "groups": ["asserts"] },
-    { "path": "lib.debug", "file": "lib/debug.nix", "groups": ["debug"] },
-    {
-      "path": "lib.fetchers",
-      "file": "lib/fetchers.nix",
-      "groups": ["fetchers"]
-    },
-    { "path": "lib.path", "file": "lib/path/default.nix", "groups": ["path"] },
-    {
-      "path": "lib.filesystem",
-      "file": "lib/filesystem.nix",
-      "groups": ["filesystem"]
-    },
-    {
-      "path": "lib.fileset",
-      "file": "lib/fileset/default.nix",
-      "groups": ["fileset"]
-    },
-    {
-      "path": "lib.sources",
-      "file": "lib/sources.nix",
-      "groups": ["sources"],
-      "mode": "deep",
-      "include": [
-        "pathIsGitRepo",
-        "commitIdFromGitRepo",
-        "cleanSource",
-        "cleanSourceWith",
-        "cleanSourceFilter",
-        "pathHasContext",
-        "canCleanSource",
-        "urlToName",
-        "shortRev",
-        "revOrTag",
-        "repoRevToName",
-        "sourceByRegex",
-        "sourceFilesBySuffices",
-        "sourceByGlobs",
-        "trace"
-      ]
-    },
-    { "path": "lib.options", "file": "lib/options.nix", "groups": ["options"] }
-  ]
-}

doc/functions.md

@@ -1,3 +1,11 @@
 # Functions reference {#chap-functions}
 
 The Nixpkgs repository has several utility functions to manipulate Nix expressions.
+
+```{=include=} sections
+functions/library.md
+functions/generators.section.md
+functions/debug.section.md
+functions/prefer-remote-fetch.section.md
+functions/nix-gitignore.section.md
+```

doc/functions/library.md.in

@@ -1,3 +1,5 @@
 # Nixpkgs Library Functions {#sec-functions-library}
 
 Nixpkgs provides a standard library at `pkgs.lib`, or through `import <nixpkgs/lib>`.
+
+<!-- nixdoc-generated documentation must be appended here during build! -->

doc/getting-started/dev-environments.md

@@ -5,7 +5,7 @@ Create a `shell.nix` with the following:
 ```nix
 # shell.nix
 let
-  nixpkgs = fetchTarball "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
+  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
   pkgs = import nixpkgs { };
 in
 pkgs.mkShell {
@@ -25,7 +25,7 @@ nix-shell
 This activates your `shell.nix` and you should see:
 
 ```sh
-unpacking 'https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst' into the Git cache...
+unpacking 'https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz' into the Git cache...
 Welcome in your nix shell
 ```
 

doc/getting-started/first-package.chapter.md

@@ -53,7 +53,7 @@ Pin Nixpkgs and call the package from `default.nix`:
 ```nix
 # default.nix
 let
-  nixpkgs = fetchTarball "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
+  nixpkgs = fetchTarball "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
   pkgs = import nixpkgs { };
 in
 pkgs.callPackage ./package.nix { }

doc/getting-started/getting-started.part.md

@@ -1 +1,6 @@
 # Getting started {#getting-started}
+
+```{=include=} chapters
+first-package.chapter.md
+dev-environments.md
+```

doc/hooks/check-phase-thread-limit-hook.section.md

@@ -3,7 +3,7 @@
 This hook defaults a variety of environment variables known
 to control thread counts to 1. Many of these otherwise default
 to `$(nproc)`, which causes massive overloads on build machines
-if nix build jobs and build cores are already tuned to fully use
+if nix build jobs and build cores are already tuned to fully utilize
 compute capacity of a builder without additional parallelism.
 
 Currently sets the following environment variables:

doc/hooks/ghc.section.md

@@ -0,0 +1,3 @@
+# GHC {#ghc}
+
+Creates a temporary package database and registers every Haskell build input in it (TODO: how?).

doc/hooks/index.md

@@ -4,3 +4,54 @@ Nixpkgs has several hook packages that augment the stdenv phases.
 
 The stdenv built-in hooks are documented in [](#ssec-setup-hooks).
 
+```{=include=} sections
+autoconf.section.md
+automake.section.md
+autopatchcil.section.md
+autopatchelf.section.md
+aws-c-common.section.md
+bmake.section.md
+breakpoint.section.md
+cernlib.section.md
+check-phase-thread-limit-hook.section.md
+cmake.section.md
+desktop-file-utils.section.md
+gdk-pixbuf.section.md
+ghc.section.md
+gnome.section.md
+haredo.section.md
+installShellFiles.section.md
+installFonts.section.md
+julec.section.md
+just.section.md
+libglycin.section.md
+libiconv.section.md
+libxml2.section.md
+meson.section.md
+mpi-check-hook.section.md
+ninja.section.md
+nodejs-install-executables.section.md
+nodejs-install-manuals.section.md
+npm-build-hook.section.md
+npm-config-hook.section.md
+npm-install-hook.section.md
+patch-rc-path-hooks.section.md
+perl.section.md
+pkg-config.section.md
+pnpm.section.md
+postgresql-test-hook.section.md
+premake.section.md
+python.section.md
+scons.section.md
+tauri.section.md
+tetex-tex-live.section.md
+udevCheckHook.section.md
+unzip.section.md
+validatePkgConfig.section.md
+versionCheckHook.section.md
+waf.section.md
+writable-tmpdir-as-home-hook.section.md
+zig.section.md
+xcbuild.section.md
+xfce4-dev-tools.section.md
+```

doc/hooks/installAgentSkills.section.md

@@ -1,47 +0,0 @@
-# `installAgentSkills` {#installAgentSkills}
-
-This hook automatically installs LLM agent skills into the proper location in `$out/share/skills/($pname|$base)/$skill/`.
-
-Agents do not scan package outputs themselves. Expose skills via `environment.pathsToLink = [ "/share/skills" ];` and symlink the wanted `share/skills/<pname>/<skill>` directories into the agent's skill directory (e.g. `~/.claude/skills/`).
-
-The automatic behavior of the hook can be disabled by setting the `dontInstallAgentSkills` variable to true.
-
-Additionally, it exposes the `installSkill` function that can be used from `postInstall`
-
-## `installSkill` {#installAgentSkills-installSkill}
-
-The `installSkill` function takes one or two arguments: a directory to copy to the install location, and an optional base directory.
-
-NB: passing a SKILL.md file directly as the first argument will fail as skills often contain other examples and tooling within the same directory.
-
-### Example Usage {#installAgentSkills-installSkill-exampleusage}
-
-```nix
-{
-  nativeBuildInputs = [ installAgentSkills ];
-
-  postInstall = ''
-    installSkill skills/skill-xyz
-  '';
-  # installs to $out/share/skills/$pname/skill-xyz
-
-  # OR
-
-  postInstall = ''
-    installSkill skills/skill-xyz random-base
-  '';
-  # installs to $out/share/skills/random-base/skill-xyz
-}
-```
-
-Where `skills/skill-xyz` may look like:
-
-```
-skills/skill-xyz:
-  - SKILL.md
-  - scripts/
-  - references/
-  - assets/
-  - ...
-```
-

doc/hooks/juce.section.md

@@ -24,10 +24,10 @@ stdenv.mkDerivation {
 
 ## Variables controlling `juce.projucerHook` {#juce-projucer-hook-variables}
 
-### `dontUseProjucerConfigure` {#juce-dontuseprojucerconfigure}
+### `dontUseProjucerConfigure`
 
 Disables `projucerConfigurePhase`
 
-### `dontUseProjucerInstall` {#juce-dontuseprojucerinstall}
+### `dontUseProjucerInstall`
 
 Disables `projucerInstallPhase`

doc/hooks/tauri.section.md

@@ -73,7 +73,7 @@ Controls the flags passed to `cargo tauri build`.
 
 #### `tauriBundleType` {#tauri-bundle-type}
 
-The [bundle type](https://tauri.app/reference/javascript/api/namespaceapp/#bundletype) to build.
+The [bundle type](https://tauri.app/v1/guides/building/) to build.
 
 #### `dontTauriBuild` {#dont-tauri-build}
 

doc/hooks/writable-tmpdir-as-home-hook.section.md

@@ -2,4 +2,4 @@
 
 This setup hook provides a writable home directory for packages that require it.
 
-To use, just add the hook to the `nativeBuildInputs` (or `nativeCheckInputs`, `nativeInstallCheckInputs`, etc.) of the package.
+To use, just add the hook to the `nativeBuildInputs` of the package.

doc/interoperability.md

@@ -1 +1,5 @@
 # Interoperability Standards {#part-interoperability}
+
+```{=include=} chapters
+interoperability/cyclonedx.md
+```

doc/interoperability/cyclonedx.md

@@ -39,7 +39,7 @@ The `nix:narinfo` properties should be accompanied by a `nix:store_path` propert
 | `nix:narinfo:system`      | The hardware and software platform on which this component is produced. |
 | `nix:narinfo:sig`         | Signatures claiming that this component is what it claims to be. |
 | `nix:narinfo:ca`          | Content address of this store object's file system object, used to compute its store path. |
-| `nix:narinfo:references`  | A whitespace-separated array of store paths that this component references. |
+| `nix:narinfo:references`  | A whitespace separated array of store paths that this component references. |
 
 ### `nix:fod` {#sec-interop.cylonedx-fod}
 

doc/languages-frameworks/beam.section.md

@@ -34,21 +34,17 @@ Inside each package set are:
 - builders: mixRelease, buildRebar3, etc
 - hooks: for composing builders and packages
 
-The package set is the only place Erlang and Elixir versions are chosen. Builders such as `mixRelease`, `fetchMixDeps` and `buildMix` take them from the set they are called from, and do not accept `erlang`, `elixir` or `hex` arguments.
-
-To use a non-default Elixir, derive a new set with `overrideScope`. This keeps the rest of the set consistent, so every builder picks up the overridden Elixir:
+To use a non-default Elixir it's important to keep the rest of the package set consistent, so it's recommended to use `.extend`. This ensures that builders like `mixRelease`, `fetchMixDeps`, and `buildMix` all pick up the overridden Elixir:
 
 ```nix
 let
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 in
 beamPackages.mixRelease {
   # ...
 }
 ```
 
-`erlang` can be replaced the same way, which is useful for a patched OTP. Every member of the set is built from the set's own `erlang`, so overriding it rebuilds Elixir, Rebar3 and the rest against it.
-
 ## Build Tools {#beam-build-tools}
 
 ### Rebar3 {#beam-build-tools-rebar3}
@@ -336,8 +332,8 @@ Usually, we need to create a `shell.nix` file and do our development inside the
 
 with pkgs;
 let
-  # pin OTP via beam27Packages/beam28Packages/... and Elixir via overrideScope
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  # pin OTP via beam27Packages/beam28Packages/... and Elixir via .extend
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 in
 mkShell { buildInputs = [ beamPackages.elixir ]; }
 ```
@@ -372,8 +368,8 @@ Here is an example `shell.nix`.
 with import <nixpkgs> { };
 
 let
-  # pin OTP via beam27Packages/beam28Packages/... and Elixir via overrideScope
-  beamPackages = beam27Packages.overrideScope (final: prev: { elixir = final.elixir_1_18; });
+  # pin OTP via beam27Packages/beam28Packages/... and Elixir via .extend
+  beamPackages = beam27Packages.extend (self: super: { elixir = self.elixir_1_18; });
 
   # define packages to install
   basePackages = [

doc/languages-frameworks/chicken.section.md

@@ -1,32 +1,8 @@
 # CHICKEN {#sec-chicken}
 
-[CHICKEN](https://call-cc.org/) is a Scheme compiler. It includes an
-interactive mode and a custom package format, "eggs". CHICKEN 5 is
-[R⁵RS](https://schemers.org/Documents/Standards/R5RS/HTML/)-compliant, whereas
-CHICKEN 6 targets
-[R⁷RS](https://standards.scheme.org/official/r7rs.pdf).
-
-## Package Sets {#sec-chicken-package-sets}
-
-Each major release of CHICKEN has its own package set, because eggs are
-compiled against a specific binary version of the compiler and cannot be shared
-between releases:
-
-* `chickenPackages_5` — CHICKEN 5, and the set the unversioned attributes
-  (`chicken`, `chickenPackages`, `eggDerivation`, `fetchegg`) point at.
-* `chickenPackages_6` — CHICKEN 6.
-* `chickenPackages_4` — CHICKEN 4; kept for the few packages that still need
-  it and maintained on a best-effort basis.
-
-Each set provides `chicken`, `eggDerivation`, `fetchegg` and an `chickenEggs`
-attrset of eggs published for that release. Note that upstream has not ported
-every egg to CHICKEN 6 yet, so `chickenPackages_6.chickenEggs` is considerably
-smaller than its CHICKEN 5 counterpart.
-
-CHICKEN 5 and 6 are built from the same expressions, in
-`pkgs/development/compilers/chicken/common/`; the release directories next to
-it hold only what differs between releases, which is the compiler's version and
-its egg set. CHICKEN 4 predates that arrangement and stands on its own.
+[CHICKEN](https://call-cc.org/) is a
+[R⁵RS](https://schemers.org/Documents/Standards/R5RS/HTML/)-compliant Scheme
+compiler. It includes an interactive mode and a custom package format, "eggs".
 
 ## Using Eggs {#sec-chicken-using}
 
@@ -50,43 +26,29 @@ variables `CHICKEN_INCLUDE_PATH` and `CHICKEN_REPOSITORY_PATH`.
 
 ## Updating Eggs {#sec-chicken-updating-eggs}
 
-For CHICKEN 5 and 6, the egg set is generated from upstream's list of latest
-egg releases, so there is no list of eggs to curate in Nixpkgs: every egg
-published for that release is included. The generated metadata lives in the
-release directory's `deps.toml`, and is regenerated by running the shared
-`update.sh` script with the release to update:
+Nixpkgs only knows about a subset of all published eggs. It uses
+[egg2nix](https://github.com/the-kenny/egg2nix) to generate a
+package set from a list of eggs to include.
+
+The package set is regenerated by running the following shell commands:
 
 ```
-$ cd pkgs/development/compilers/chicken/common/
-$ ./update.sh 6
-```
-
-This clones upstream's `eggs-<major>-latest` repository, prefetches each egg
-tarball and converts the egg metadata into `deps.toml`. Do not edit
-`deps.toml` by hand.
-
-Eggs that need extra native dependencies or other fixups are patched up in
-`overrides.nix` in the release directory; the entries there are keyed by egg
-name and applied automatically by `eggDerivation`.
-
-## Adding Eggs {#sec-chicken-adding-eggs}
-
-CHICKEN 4 predates the workflow above: its much smaller set is generated with
-[egg2nix](https://github.com/the-kenny/egg2nix) from a hand-written list of
-eggs, so eggs have to be added explicitly. The list is
-`pkgs/development/compilers/chicken/4/eggs.scm`; the first section lists eggs
-which are required by `egg2nix` itself, all other eggs go into the second
-section. After editing, regenerate the set:
-
-```
-$ nix-shell -p chickenPackages_4.egg2nix
-$ cd pkgs/development/compilers/chicken/4/
+$ nix-shell -p chickenPackages.egg2nix
+$ cd pkgs/development/compilers/chicken/5/
 $ egg2nix eggs.scm > eggs.nix
 ```
 
-`egg2nix` resolves one collection of eggs with mutually-compatible versions, so
-adding an egg may update existing ones. To keep those changes separate,
-regenerate the set before adding more eggs.
+## Adding Eggs {#sec-chicken-adding-eggs}
+
+When we run `egg2nix`, we obtain one collection of eggs with
+mutually-compatible versions. This means that when we add new eggs, we may
+need to update existing eggs. To keep those separate, follow the procedure for
+updating eggs before including more eggs.
+
+To include more eggs, edit `pkgs/development/compilers/chicken/5/eggs.scm`.
+The first section of this file lists eggs which are required by `egg2nix`
+itself; all other eggs go into the second section. After editing, follow the
+procedure for updating eggs.
 
 ## Override Scope {#sec-chicken-override-scope}
 

doc/languages-frameworks/cosmic.section.md

@@ -5,7 +5,7 @@
 COSMIC (Computer Operating System Main Interface Components) is a desktop environment developed by
 System76, primarily for the Pop!_OS Linux distribution. Applications in the COSMIC ecosystem are
 written in Rust and use libcosmic, which builds on the Iced GUI framework. This section explains
-how to package and integrate COSMIC applications within Nix.
+how to properly package and integrate COSMIC applications within Nix.
 
 ### libcosmicAppHook {#ssec-cosmic-libcosmic-app-hook}
 
@@ -17,7 +17,7 @@ and wrapping applications based on libcosmic. It handles many common requirement
 - Managing Vergen environment variables for build-time information
 - Setting up Rust linker flags for specific libraries
 
-Add the hook to your package's `nativeBuildInputs`:
+To use the hook, simply add it to your package's `nativeBuildInputs`:
 
 ```nix
 {
@@ -61,9 +61,8 @@ rustPlatform.buildRustPackage {
 }
 ```
 
-> [!Note]
-> `cosmic-settings` is a separate application and not a part of the libcosmic settings
-> system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
+Note that `cosmic-settings` is a separate application and not a part of the libcosmic settings
+system itself. It's included by default in `libcosmicAppHook` only to provide these fallback theme
 settings.
 
 ### Icons {#ssec-cosmic-icons}

doc/languages-frameworks/index.md

@@ -53,3 +53,56 @@ Each supported language or software ecosystem has its own package set named `<la
   …
   ```
   :::
+
+```{=include=} sections
+agda.section.md
+android.section.md
+astal.section.md
+beam.section.md
+chicken.section.md
+cosmic.section.md
+crystal.section.md
+cuda.section.md
+cuelang.section.md
+dart.section.md
+dhall.section.md
+dlang.section.md
+dotnet.section.md
+emscripten.section.md
+factor.section.md
+gnome.section.md
+go.section.md
+gradle.section.md
+hare.section.md
+haskell.section.md
+hy.section.md
+idris.section.md
+idris2.section.md
+ios.section.md
+java.section.md
+javascript.section.md
+julia.section.md
+lean4.section.md
+lisp.section.md
+lua.section.md
+maven.section.md
+nim.section.md
+ocaml.section.md
+octave.section.md
+perl.section.md
+php.section.md
+pkg-config.section.md
+python.section.md
+qt.section.md
+r.section.md
+rocq.section.md
+ruby.section.md
+rust.section.md
+scheme.section.md
+swift.section.md
+tcl.section.md
+texlive.section.md
+typst.section.md
+vim.section.md
+neovim.section.md
+```

doc/languages-frameworks/javascript.section.md

@@ -1,30 +1,49 @@
-# JavaScript {#language-javascript}
+# Javascript {#language-javascript}
 
 ## Introduction {#javascript-introduction}
 
-Package JavaScript applications with the tools below.
+This contains instructions on how to package JavaScript applications.
+
+The various tools available will be listed in the [tools-overview](#javascript-tools-overview).
+Some general principles for packaging will follow.
+Finally, some tool-specific instructions will be given.
+
+## Getting unstuck / finding code examples {#javascript-finding-examples}
+
+If you find you are lacking inspiration for packaging JavaScript applications, the links below might prove useful.
+Searching online for prior art can be helpful if you are running into solved problems.
+
+### Github {#javascript-finding-examples-github}
+
+- Searching Nix files for `yarnConfigHook`: <https://github.com/search?q=yarnConfigHook+language%3ANix&type=code>
+- Searching just `flake.nix` files for `yarnConfigHook`: <https://github.com/search?q=yarnConfigHook+path%3A**%2Fflake.nix&type=code>
+
+### Gitlab {#javascript-finding-examples-gitlab}
+
+- Searching Nix files for `yarnConfigHook`: <https://gitlab.com/search?scope=blobs&search=yarnConfigHook+extension%3Anix>
+- Searching just `flake.nix` files for `yarnConfigHook`: <https://gitlab.com/search?scope=blobs&search=yarnConfigHook+filename%3Aflake.nix>
 
 ## Tools overview {#javascript-tools-overview}
 
 ## General principles {#javascript-general-principles}
 
-The principles below are ordered by importance.
+The following principles are given in order of importance with potential exceptions.
 
-### Use the project's Node.js version {#javascript-upstream-node-version}
+### Try to use the same node version used upstream {#javascript-upstream-node-version}
 
-It is often not documented which Node.js version the project uses, but if it is, use the same version when packaging.
+It is often not documented which node version is used upstream, but if it is, try to use the same version when packaging.
 
-This can be a problem if the project uses the latest and greatest and you are trying to use an earlier version of Node.js.
+This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node.
 Some cryptic errors regarding V8 may appear.
 
-### Use the project's package manager and lock file {#javascript-upstream-package-manager}
+### Try to respect the package manager originally used by upstream (and use the upstream lock file) {#javascript-upstream-package-manager}
 
 A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of `node_modules` for each tool.
 
-Package manager guidelines recommend committing those lock files to the repository.
-If a particular lock file is present, it is a strong indication of which package manager the project uses.
+Guidelines of package managers, recommend to commit those lock files to the repos.
+If a particular lock file is present, it is a strong indication of which package manager is used upstream.
 
-Use a Nix tool that understands the lock file.
+It's better to try to use a Nix tool that understands the lock file.
 Using a different tool might give you a hard-to-understand error because different packages have been installed.
 
 Using a different tool forces you to commit a lock file to the repository.
@@ -32,16 +51,16 @@ These files are fairly large, so when packaging for nixpkgs, this approach does
 
 Exceptions to this rule are:
 
-- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems are detailed. If a tool has a problem, try another. You may have to re-create a lock file and commit it to Nixpkgs.
-- Some lock files contain a particular version of a package that has been pulled off npm for some reason. In that case, you can recreate the lock file (by removing the original and running `npm install`, `yarn`, etc.) and commit this to Nixpkgs.
+- When you encounter one of the bugs from a Nix tool. In each of the tool-specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to re-create a lock file and commit it to Nixpkgs.
+- Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
 
-### Use the project's `package.json` {#javascript-upstream-package-json}
+### Try to use upstream package.json {#javascript-upstream-package-json}
 
 Exceptions to this rule are:
 
-- Sometimes the project assumes some dependencies are installed globally. Add them to the `package.json` manually (`yarn add xxx` or `npm install xxx`). Run locally installed CLI tools with `npx`, for example `npx postcss`. That is how you call them in the phases.
+- Sometimes the upstream repo assumes some dependencies should be installed globally. In that case, you can add them manually to the upstream `package.json` (`yarn add xxx` or `npm install xxx`, ...). Dependencies that are installed locally can be executed with `npx` for CLI tools (e.g. `npx postcss ...`, this is how you can call those dependencies in the phases).
 - Sometimes there is a version conflict between some dependency requirements. In that case you can fix a version by removing the `^`.
-- Sometimes a script in `package.json` does not work as is. It might call a CLI tool that is not available, or `cd` into a directory with a different `package.json`, which is common with workspaces. Read what the script does. Reproduce it in the build phases. For example, a `build` script may call `build:ui` and `build:server` in turn. If one fails, split them into separate steps.
+- Sometimes the script defined in the package.json does not work as is. Some scripts for example use CLI tools that might not be available, or cd in directory with a different package.json (for workspaces notably). In that case, it's perfectly fine to look at what the particular script is doing and break this down in the phases. In the build script you can see `build:*` calling in turns several other build scripts like `build:ui` or `build:server`. If one of those fails, you can try to separate those into,
 
   ```sh
   yarn build:ui
@@ -51,7 +70,7 @@ Exceptions to this rule are:
   npm run build:server
   ```
 
-  When you need to override `package.json`, it is best to use the one from the project and make explicit overrides. Here is an example:
+  when you need to override a package.json. It's nice to use the one from the upstream source and do some explicit override. Here is an example:
 
   ```nix
   {
@@ -63,22 +82,22 @@ Exceptions to this rule are:
   }
   ```
 
-  You still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
+  You will still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
 
-### Use `node_modules` directly {#javascript-using-node_modules}
+### Using node_modules directly {#javascript-using-node_modules}
 
-Each tool has an abstraction to build the node_modules (dependencies) directory.
+Each tool has an abstraction to just build the node_modules (dependencies) directory.
 You can always use the `stdenv.mkDerivation` with the node_modules to build the package (symlink the node_modules directory and then use the package build command).
-The `node_modules` abstraction can also be used to build some web framework frontends.
-For an example of this, see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
-Then, when building the frontend, you can symlink the `node_modules` directory.
+The node_modules abstraction can be also used to build some web framework frontends.
+For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/pl/plausible/package.nix) is built.
+Then when building the frontend you can just symlink the node_modules directory.
 
 ## Tool-specific instructions {#javascript-tool-specific}
 
 ### buildNpmPackage {#javascript-buildNpmPackage}
 
-`buildNpmPackage` packages npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
-It uses npm's cache. It builds a reproducible cache of the project's dependencies and points npm at it.
+`buildNpmPackage` allows you to package npm-based projects in Nixpkgs without the use of an auto-generated dependencies file.
+It works by utilizing npm's cache functionality -- creating a reproducible cache that contains the dependencies of a project, and pointing npm to it.
 
 Here's an example:
 
@@ -116,9 +135,9 @@ buildNpmPackage (finalAttrs: {
 })
 ```
 
-In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install. They go in `$out/lib/node_modules/$name/`, where `$name` is the `name` string in the package's `package.json`.
+In the default `installPhase` set by `buildNpmPackage`, it uses `npm pack --json --dry-run` to decide what files to install in `$out/lib/node_modules/$name/`, where `$name` is the `name` string defined in the package's `package.json`.
 Additionally, the `bin` and `man` keys in the source's `package.json` are used to decide what binaries and manpages are supposed to be installed.
-If these are not defined, `npm pack` may miss some files, and no binaries are produced.
+If these are not defined, `npm pack` may miss some files, and no binaries will be produced.
 
 #### Arguments {#javascript-buildNpmPackage-arguments}
 
@@ -153,8 +172,8 @@ sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
 
 `fetchNpmDeps` is a Nix function that requires the following mandatory arguments:
 
-- `src`: A directory or tarball with a `package-lock.json` file
-- `hash`: The output hash of the dependencies defined in `package-lock.json`.
+- `src`: A directory / tarball with `package-lock.json` file
+- `hash`: The output hash of the node dependencies defined in `package-lock.json`.
 
 It returns a derivation with all `package-lock.json` dependencies downloaded into `$out/`, usable as an npm cache.
 
@@ -168,7 +187,7 @@ There is no need to specify a `hash`, since it relies entirely on the integrity
 
 ##### Inputs {#javascript-buildNpmPackage-inputs}
 
-- `npmRoot`: Path to the package directory containing the source tree.
+- `npmRoot`: Path to package directory containing the source tree.
   If this is omitted, the `package` and `packageLock` arguments must be specified instead.
 - `package`: Parsed contents of `package.json`
 - `packageLock`: Parsed contents of `package-lock.json`
@@ -176,7 +195,7 @@ There is no need to specify a `hash`, since it relies entirely on the integrity
 - `version`: Package version
 - `fetcherOpts`: An attribute set of arguments forwarded to the underlying fetcher.
 
-It returns a derivation with a patched `package.json` and `package-lock.json` with all dependencies resolved to Nix store paths.
+It returns a derivation with a patched `package.json` & `package-lock.json` with all dependencies resolved to Nix store paths.
 
 :::{.note}
 `npmHooks.npmConfigHook` cannot be used with `importNpmLock`.
@@ -238,18 +257,18 @@ buildNpmPackage {
 
 `importNpmLock.buildNodeModules` returns a derivation with a pre-built `node_modules` directory, as imported by `importNpmLock`.
 
-This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to support `nix-shell`/`nix develop` development workflows.
+This is to be used together with `importNpmLock.hooks.linkNodeModulesHook` to facilitate `nix-shell`/`nix develop` based development workflows.
 
 It accepts an argument with the following attributes:
 
 `npmRoot` (Path; optional)
-: Path to the package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
+: Path to package directory containing the source tree. If not specified, the `package` and `packageLock` arguments must both be specified.
 
 `package` (Attrset; optional)
 : Parsed contents of `package.json`, as returned by `lib.importJSON ./my-package.json`. If not specified, the `package.json` in `npmRoot` is used.
 
 `packageLock` (Attrset; optional)
-: Parsed contents of `package-lock.json`, as returned by `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
+: Parsed contents of `package-lock.json`, as returned `lib.importJSON ./my-package-lock.json`. If not specified, the `package-lock.json` in `npmRoot` is used.
 
 `derivationArgs` (`mkDerivation` attrset; optional)
 : Arguments passed to `stdenv.mkDerivation`
@@ -269,26 +288,26 @@ pkgs.mkShell {
   };
 }
 ```
-creates a development shell where a `node_modules` directory is created and packages are symlinked to the Nix store when activated.
+will create a development shell where a `node_modules` directory is created & packages symlinked to the Nix store when activated.
 
 :::{.note}
-Commands like `npm install` and `npm add` that write packages and executables need to be used with `--package-lock-only`.
+Commands like `npm install` & `npm add` that write packages & executables need to be used with `--package-lock-only`.
 
-This means `npm` installs dependencies by writing into `package-lock.json` without modifying the `node_modules` folder. It installs by reloading the devShell.
-This gives the `nix shell` near-exclusive ownership over your `node_modules` folder.
+This means `npm` installs dependencies by writing into `package-lock.json` without modifying the `node_modules` folder. Installation happens through reloading the devShell.
+This might be best practice since it gives the `nix shell` virtually exclusive ownership over your `node_modules` folder.
 
-Set `package-lock-only = true` in your project-local [`.npmrc`](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc).
+It's recommended to set `package-lock-only = true` in your project-local [`.npmrc`](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc).
 :::
 
 ### corepack {#javascript-corepack}
 
-This package puts the corepack wrappers for pnpm and yarn in your PATH, and they honor the `packageManager` setting in the `package.json`.
+This package puts the corepack wrappers for pnpm and yarn in your PATH, and they will honor the `packageManager` setting in the `package.json`.
 
 ### pnpm {#javascript-pnpm}
 
 pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
-When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` prepares the build environment to install the pre-fetched dependencies store. The example below uses the fetcher and setup hook for a package that has `package.json` and `pnpm-lock.yaml`:
+When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
 There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
 
@@ -331,7 +350,7 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-Use a pinned version of pnpm (for example `pnpm_9` or `pnpm_10`) to increase reproducibility. An older version may be required if the package needs a certain lock file version. To do so, pass the `pnpm` argument to `fetchPnpmDeps`. Then override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
+It is highly recommended to use a pinned version of pnpm (i.e., `pnpm_9` or `pnpm_10`), to increase future reproducibility. It might also be required to use an older version if the package needs support for a certain lock file version. To do so, you can pass the `pnpm` argument to `fetchPnpmDeps` and override the `pnpm` arg in `pnpmConfigHook`. Here are the changes in the example above to use a pinned pnpm version:
 
 <!-- TODO: Does splicing still work when overriding in nativeBuildInputs here? -->
 
@@ -373,7 +392,7 @@ Use a pinned version of pnpm (for example `pnpm_9` or `pnpm_10`) to increase rep
  })
 ```
 
-In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`).
+In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `finalAttrs.patches` to the function as well (i.e., `inherit (finalAttrs) patches`.
 
 `pnpmConfigHook` supports adding additional `pnpm install` flags via `pnpmInstallFlags` which can be set to a Nix string array:
 
@@ -389,14 +408,14 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
-If needed, set `dontPnpmConfigure = true;` to fully disable `pnpmConfigHook` without removing it from inputs manually.
+If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
 
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
-If the pnpm project is in a subdirectory, you can define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
-If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
+If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
+If `sourceRoot` is different between the parent derivation and `fetchPnpmDeps`, you will have to set `pnpmRoot` to effectively be the same location as it is in `fetchPnpmDeps`.
 
-Assuming the directory structure below, you can define `sourceRoot` and `pnpmRoot`:
+Assuming the following directory structure, we can define `sourceRoot` and `pnpmRoot` as follows:
 
 ```
 .
@@ -420,9 +439,10 @@ Assuming the directory structure below, you can define `sourceRoot` and `pnpmRoo
 }
 ```
 
-#### pnpm workspaces {#javascript-pnpm-workspaces}
+#### PNPM Workspaces {#javascript-pnpm-workspaces}
 
-For a pnpm workspace, set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]` in your `fetchPnpmDeps` call. pnpm then installs only the dependencies for those workspace packages.
+If you need to use a PNPM workspace for your project, then set `pnpmWorkspaces = [ "<workspace project name 1>" "<workspace project name 2>" ]`, etc, in your `fetchPnpmDeps` call,
+which will make PNPM only install dependencies for those workspace packages.
 
 For example:
 
@@ -438,9 +458,9 @@ For example:
 ```
 
 The above would make `fetchPnpmDeps` call only install dependencies for the `@astrojs/language-server` workspace package.
-You do not need to set `sourceRoot` to make this work.
+Note that you do not need to set `sourceRoot` to make this work.
 
-For these projects, build with `pnpm --filter=<pnpm workspace name> build`, because `npmHooks.npmBuildHook` may not work. The example below fits most workspace projects:
+Usually, in such cases, you'd want to use `pnpm --filter=<pnpm workspace name> build` to build your project, as `npmHooks.npmBuildHook` probably won't work. A `buildPhase` based on the following example will probably fit most workspace projects:
 
 ```nix
 {
@@ -454,9 +474,9 @@ For these projects, build with `pnpm --filter=<pnpm workspace name> build`, beca
 }
 ```
 
-#### Additional pnpm commands and settings {#javascript-pnpm-extraCommands}
+#### Additional PNPM Commands and settings {#javascript-pnpm-extraCommands}
 
-If you require setting an additional pnpm configuration setting (such as `dedupe-peer-dependents` or similar),
+If you require setting an additional PNPM configuration setting (such as `dedupe-peer-dependents` or similar),
 set `prePnpmInstall` to the right commands to run. For example:
 
 ```nix
@@ -471,11 +491,11 @@ set `prePnpmInstall` to the right commands to run. For example:
 }
 ```
 
-In this example, `prePnpmInstall` runs in both `pnpmConfigHook` and the `fetchPnpmDeps` builder.
+In this example, `prePnpmInstall` will be run by both `pnpmConfigHook` and by the `fetchPnpmDeps` builder.
 
 #### pnpm `fetcherVersion` {#javascript-pnpm-fetcherVersion}
 
-This is the version of the output of `fetchPnpmDeps`. Use `4` for new packages:
+This is the version of the output of `fetchPnpmDeps`. New packages should use `4`:
 
 ```nix
 {
@@ -491,7 +511,7 @@ This is the version of the output of `fetchPnpmDeps`. Use `4` for new packages:
 When upgrading to a newer `fetcherVersion`, you need to regenerate the hash.
 
 This variable ensures that we can make changes to the output of `fetchPnpmDeps` without breaking existing hashes.
-Changes can include workarounds or bug fixes to existing pnpm issues.
+Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
@@ -504,9 +524,9 @@ Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 2
 
 ### Yarn {#javascript-yarn}
 
-Yarn-based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies.
+Yarn based projects use a `yarn.lock` file instead of a `package-lock.json` to pin dependencies.
 
-To package Yarn-based applications, you need to distinguish by the version pointers in the `yarn.lock` file. See the following sections.
+To package yarn-based applications, you need to distinguish by the version pointers in the `yarn.lock` file. See the following sections.
 
 #### Yarn v1 {#javascript-yarn-v1}
 
@@ -562,29 +582,6 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-##### `fetchYarnDeps` arguments {#javascript-fetchyarndeps}
-
-`fetchYarnDeps` accepts the following arguments:
-
-- `yarnLock`: Path to the `yarn.lock` file to fetch dependencies for.
-- `hash` (or `sha256`): The output hash of the offline cache.
-- `mirrorUrl`: Optional registry mirror URL used in place of the default yarn
-  registry (`https://registry.yarnpkg.com/`). When set, any resolved URL
-  pointing at the default registry is rewritten to use this mirror before
-  downloading. This is useful for pointing at a local or internal registry
-  mirror. Note that changing the mirror does not change the output hash, since
-  the downloaded contents are identical.
-
-```nix
-{
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock";
-    mirrorUrl = "https://registry.npmmirror.com/";
-    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-  };
-}
-```
-
 ##### `yarnConfigHook` arguments {#javascript-yarnconfighook}
 
 By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.
@@ -598,12 +595,12 @@ This script by default runs `yarn --offline build`, and it relies upon the proje
 
 ##### `yarnInstallHook` arguments {#javascript-yarninstallhook}
 
-To install the package, `yarnInstallHook` uses both `npm` and `yarn` to clean up project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
+To install the package `yarnInstallHook` uses both `npm` and `yarn` to cleanup project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
 
 - `yarnKeepDevDeps`: Disables the removal of devDependencies from `node_modules` before installation.
 
 #### Yarn Berry v3/v4 {#javascript-yarn-v3-v4}
-Yarn Berry (v3 / v4) versions have similar formats. They start with blocks like these:
+Yarn Berry (v3 / v4) have similar formats, they start with blocks like these:
 
 ```yaml
 __metadata:
@@ -623,7 +620,7 @@ For these packages, we have some helpers exposed under the respective `yarn-berr
 - `fetchYarnBerryDeps`
 - `yarnBerryConfigHook`
 
-Explicitly pin the major version. For example, capture the `yarn-berry_Xn` argument and re-define it as a `yarn-berry` `let` binding.
+It's recommended to ensure you're explicitly pinning the major version used, for example by capturing the `yarn-berry_Xn` argument and then re-defining it as a `yarn-berry` `let` binding.
 
 ```nix
 {
@@ -659,26 +656,26 @@ stdenv.mkDerivation (finalAttrs: {
 ##### `yarn-berry_X.fetchYarnBerryDeps` {#javascript-fetchYarnBerryDeps}
 `fetchYarnBerryDeps` runs `yarn-berry-fetcher fetch` in a fixed-output-derivation. It is a custom fetcher designed to reproducibly download all files in the `yarn.lock` file, validating their hashes in the process. For git dependencies, it creates a checkout at `${offlineCache}/checkouts/<40-character-commit-hash>` (relying on the git commit hash to describe the contents of the checkout).
 
-To produce the `hash` argument for the `fetchYarnBerryDeps` call, run `yarn-berry-fetcher prefetch`:
+To produce the `hash` argument for `fetchYarnBerryDeps` function call, the `yarn-berry-fetcher prefetch` command can be used:
 
 ```console
 $ yarn-berry-fetcher prefetch </path/to/yarn.lock> [/path/to/missing-hashes.json]
 ```
 
-This prints the hash to stdout. Use it in update scripts to recalculate the hash for a new `yarn.lock`.
+This prints the hash to stdout and can be used in update scripts to recalculate the hash for a new version of `yarn.lock`.
 
 ##### `yarn-berry_X.yarnBerryConfigHook` {#javascript-yarnBerryConfigHook}
 `yarnBerryConfigHook` uses the store path `offlineCache` points to, to run a `yarn install` during the build, producing a usable `node_modules` directory from the downloaded dependencies.
 
 Internally, this uses a patched version of Yarn to ensure git dependencies are re-packed and any attempted downloads fail immediately.
 
-##### Patching the project's `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
-In case patching the project's `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`).
+##### Patching upstream `package.json` or `yarn.lock` files {#javascript-yarnBerry-patching}
+In case patching the upstream `package.json` or `yarn.lock` is needed, it's important to pass `finalAttrs.patches` to `fetchYarnBerryDeps` as well, so the patched variants are picked up (i.e., `inherit (finalAttrs) patches`.
 
 ##### Missing hashes in the `yarn.lock` file {#javascript-yarnBerry-missing-hashes}
 Unfortunately, `yarn.lock` files do not include hashes for optional/platform-specific dependencies. This is [by design](https://github.com/yarnpkg/berry/issues/6759).
 
-To compensate for this, run the `yarn-berry-fetcher missing-hashes` subcommand to produce all missing hashes. These are stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
+To compensate for this, the `yarn-berry-fetcher missing-hashes` subcommand can be used to produce all missing hashes. These are usually stored in a `missing-hashes.json` file, which needs to be passed to both the build itself, as well as the `fetchYarnBerryDeps` helper:
 
 ```nix
 {
@@ -721,7 +718,7 @@ If you are packaging something outside Nixpkgs, consider the following:
 
 ### npmlock2nix {#javascript-npmlock2nix}
 
-[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet; the API may change.
+[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might be subject to change.
 
 #### Pitfalls {#javascript-npmlock2nix-pitfalls}
 
@@ -729,7 +726,7 @@ There are some [problems with npm v7](https://github.com/tweag/npmlock2nix/issue
 
 ### nix-npm-buildpackage {#javascript-nix-npm-buildpackage}
 
-[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet; the API may change. It supports both `package-lock.json` and yarn.lock.
+[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might change. It supports both `package-lock.json` and yarn.lock.
 
 #### Pitfalls {#javascript-nix-npm-buildpackage-pitfalls}
 

doc/languages-frameworks/neovim.section.md

@@ -63,7 +63,7 @@ For instance, `sqlite-lua` needs `g:sqlite_clib_path` to be set to work. Nixpkgs
 - `wrapperArgs`: Extra arguments forwarded to the `makeWrapper` call.
 - `wrapRc`: Nix, not being able to write in your `$HOME`, loads the
   generated Neovim configuration via the `$VIMINIT` environment variable, i.e. : `export VIMINIT='lua dofile("/nix/store/…-init.lua")'`. This has side effects like preventing Neovim from sourcing your `init.lua` in `$XDG_CONFIG_HOME/nvim` (see bullet 7 of [`:help startup`](https://neovim.io/doc/user/starting.html#startup) in Neovim). Disable it if you want to generate your own wrapper. You can still reuse the generated vimscript init code via `neovim.passthru.initRc`.
-- `plugins`: A list of plugins to add to the wrapper. If a plugin is not available in nixpkgs, you can [package it yourself](#what-if-your-favourite-vim-plugin-isnt-already-packaged).
+- `plugins`: A list of plugins to add to the wrapper.
 - `extraLuaPackages`: A function passed on to `lua.withPackages`.
 - `extraPython3Packages`: A function passed on to `python3.withPackages`.
 - `withPython3`, `withNodeJs`, `withRuby`, `withPerl` control when to enable neovim

doc/languages-frameworks/python.section.md

@@ -326,8 +326,8 @@ the packages with the version of the interpreter. Because this is irrelevant for
 applications, the prefix is omitted.
 
 When packaging a Python application with [`buildPythonApplication`](#buildpythonapplication-function), it should be
-called with `callPackage` and passed `python3` or `python3Packages` (or possibly
-specifying an interpreter version such as `python313Packages`), like this:
+called with `callPackage` and passed `python3` or `python3Packages` (possibly
+specifying an interpreter version), like this:
 
 ```nix
 {

doc/languages-frameworks/swift.section.md

@@ -11,86 +11,47 @@ nix-shell -p swift --run 'swiftc -' <<< 'print("Hello world!")'
 
 The `swift` package also provides the `swift` command, with some caveats:
 
-- Swift Package Manager (SwiftPM) is packaged separately as `swiftpm`.
-  If you need functionality like `swift build`, `swift run`, `swift test`, you must also add the `swiftpm` package to your closure.
-- On Darwin, the `swift repl` command requires an Xcode installation.
-  This is because it uses the system LLDB debugserver, which has special entitlements.
+- Swift Package Manager (SwiftPM) is packaged separately as `swiftpm`. If you
+  need functionality like `swift build`, `swift run`, `swift test`, you must
+  also add the `swiftpm` package to your closure.
+- On Darwin, the `swift repl` command requires an Xcode installation. This is
+  because it uses the system LLDB debugserver, which has special entitlements.
 
 ## Module search paths {#ssec-swift-module-search-paths}
 
-The Swift compiler executables are patched to find the C and C++ standard libraries associated with its target platform, but they are not wrapped.
-They will not find your application’s dependencies automatically in the Nix store.
-Your build system is expected to handle this for you.
+Like other toolchains in Nixpkgs, the Swift compiler executables are wrapped
+to help Swift find your application's dependencies in the Nix store. These
+wrappers scan the `buildInputs` of your package derivation for specific
+directories where Swift modules are placed by convention, and automatically
+add those directories to the Swift compiler search paths.
 
-SwiftPM provides a hook that scans the `buildInputs` of your package derivation for specific directories where the Swift modules are placed by convention.
-These directories are added automatically to `swiftpmFlags` when the hook runs.
-Swift in Nixpkgs follows a few conventions when installing dependencies:
+Swift follows different conventions depending on the platform. The wrappers
+look for the following directories:
 
-- Libraries (both shared and static) are installed to `lib`.
-  This differs from upstream packaging, but it matches how other langauges are packaged in Nixpkgs.
-  This allows Swift packages to take advantage of existing tooling that expects libraries to be installed in this standard location.
-- Modules are installed to `lib/swift/<platform>` where `<platform>` is the Swift platform for your host platform (e.g., `lib/swift/macosx` or `lib/swift/linux`).
-  Note that Linux modules may be installed in a directory specific to the target architecture(e.g., `lib/swift/linux/x86_64`), but this is uncommon.
-  Upstream Swift appears to be moving away from this convention.
+- On Darwin platforms: `lib/swift/macosx`
+  (If not targeting macOS, replace `macosx` with the Xcode platform name.)
+- On other platforms: `lib/swift/linux/x86_64`
+  (Where `linux` and `x86_64` are from lowercase `uname -sm`.)
+- For convenience, Nixpkgs also adds `lib/swift` to the search path.
+  This can save a bit of work packaging Swift modules, because many Nix builds
+  will produce output for just one target anyway.
 
 ## Core libraries {#ssec-swift-core-libraries}
 
-The `swift` package contains a complete toolchain with the Swift stdlib, Dispatch, Foundation, XCTest, and Swift Testing.
-These packages do not need to  be added to `buildInputs` when packaging applications.
-The Swift compiler will  find them automatically in the `swift` toolchain.
+In addition to the standard library, the Swift toolchain contains some
+additional 'core libraries' that, on Apple platforms, are normally distributed
+as part of the OS or Xcode. These are packaged separately in Nixpkgs and can
+be found (for use in `buildInputs`) as:
 
-If you do need to use these packages outside of the Swift toolchain, they are  available in the following packages:
-
-- `swiftPackages.stdlib` contains the Swift stdlib and backdeployment dylibs.
-- `swiftPackages.swift-corelibs-libdispatch` contains the Dispatch framework.
-- `swiftPackages.swift-corelibs-foundation` contains the Foundation framework.
-- `swiftPackages.swift-corelibs-xctest` and `swiftPackages.swift-testing` contain the XCTest and Swift Testing frameworks respectively.
-
-Note: On Darwin, the Swift stdlib has been removed from the SDK.
-The Swift toolchain contains the stubs and modules required to build Swift applications with the following exceptions:
-
-- Swift Differentiation is shipped as a dylib in Nixpkgs because it is no longer shipped with the OS (as of macOS 26.4).
-  This allows packages using Swift Differentiation to work regardless of OS version.
-- The Span back-deployment dylib is shipped with the stdlib.
-- This is expected because back-deployment dylibs are normally shipped with the toolchain.
-- FoundationMacros is built and shipped as a dylib in `swiftPackages.swift-foundation` and included in the toolchain.
-  Macros are actually compiler plugins executed at build time.
-  Without this, FoundationMacros would not work on Darwin.
+- `swiftPackages.Dispatch`
+- `swiftPackages.Foundation`
+- `swiftPackages.XCTest`
 
 ## Packaging with SwiftPM {#ssec-swift-packaging-with-swiftpm}
 
-Nixpkgs includes two ways to package dependencies for Swift applications: `fetchSwiftPMDeps` and `swiftpm2nix`.
-While `swiftpm2nix` is not deprecated, using `fetchSwiftPMDeps` is preferred because it is easier to use and does not (usually) require shipping extra files with your package.
-
-### Packaging with `fetchSwiftPMDeps` {#ssec-swift-packaging-with-fetch-swiftpm-deps}
-
-Swift provides a fetcher that will download all of your dependencies based on the `Package.resolved` shipped by your package.
-If your package does not ship one, you will have to generate it yourself and provide it with your package.
-Otherwise, set `swiftpmDeps` as follows:
-
-```nix
-{
-  swiftpmDeps = fetchSwiftPMDeps {
-    inherit src;
-    hash = "sha256-1KfyrQXE1HaO9WsuskzgiiEZxM/oelp40Jwzr8xJEL4=";
-  };
-}
-```
-
-The `src` attribute is required as is the `hash`.
-The first time you build your  package, you will need to set `hash` to an empty value by using `lib.fakeHash` to get the hash for your dependencies.
-The following optional attributes can also be used:
-
-- `name`: Sets the name of the vendored dependencies fixed-output derivation.
-  You can also use `pname` and `version` to set the `name`.
-  This is often easier because you can inherit them from `finalAttrs`.
-- `sourceRoot`: Sets the path where `Package.swift` and `Package.resolved` can be found if they are not in their default, top-level location.
-- `patches`: Can be used to apply patches to your project before the dependencies are vendored.
-  This is useful to update `Package.swift` or `Package.resolved`.
-- `postPatch`: Can be used to perform extra steps after patching.
-  You can copy a custom `Package.resolved` in `postPatch`.
-
-### Packaging with `swiftpm2nix` {#ssec-swift-packaging-with-swiftpm2nix}
+Nixpkgs includes a small helper `swiftpm2nix` that can fetch your SwiftPM
+dependencies for you, when you need to write a Nix expression to package your
+application.
 
 The first step is to run the generator:
 
@@ -104,8 +65,8 @@ swift package resolve
 swiftpm2nix
 ```
 
-This produces some files in a directory `nix`, which will be part of your Nix  expression.
-The next step is to write that expression:
+This produces some files in a directory `nix`, which will be part of your Nix
+expression. The next step is to write that expression:
 
 ```nix
 {
@@ -165,13 +126,45 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-#### Patching dependencies {#ssec-swiftpm-patching-dependencies}
+### Custom build flags {#ssec-swiftpm-custom-build-flags}
 
-In some cases, it may be necessary to patch a SwiftPM dependency.
-SwiftPM dependencies are located in `.build/checkouts`, but the `swiftpm2nix` helper provides these as symlinks to read-only `/nix/store` paths.
-To patch them, we need to make them writable.
+If you'd like to build a different configuration than `release`:
 
-A special function `swiftpmMakeMutable` is available to replace the symlink with a writable copy:
+```nix
+{ swiftpmBuildConfig = "debug"; }
+```
+
+It is also possible to provide additional flags to `swift build`:
+
+```nix
+{ swiftpmFlags = [ "--disable-dead-strip" ]; }
+```
+
+The default `buildPhase` already passes `-j` for parallel building.
+
+If these two customization options are insufficient, provide your own
+`buildPhase` that invokes `swift build`.
+
+### Running tests {#ssec-swiftpm-running-tests}
+
+Including `swiftpm` in your `nativeBuildInputs` also provides a default
+`checkPhase`, but it must be enabled with:
+
+```nix
+{ doCheck = true; }
+```
+
+This essentially runs: `swift test -c release`
+
+### Patching dependencies {#ssec-swiftpm-patching-dependencies}
+
+In some cases, it may be necessary to patch a SwiftPM dependency. SwiftPM
+dependencies are located in `.build/checkouts`, but the `swiftpm2nix` helper
+provides these as symlinks to read-only `/nix/store` paths. To patch
+them, we need to make them writable.
+
+A special function `swiftpmMakeMutable` is available to replace the symlink
+with a writable copy:
 
 ```nix
 {
@@ -190,76 +183,21 @@ A special function `swiftpmMakeMutable` is available to replace the symlink with
 }
 ```
 
-### Custom build flags {#ssec-swiftpm-custom-build-flags}
-
-If you'd like to build a different configuration than `release`:
-
-```nix
-{ swiftpmBuildConfig = "debug"; }
-```
-
-It is also possible to provide additional flags to `swift build`:
-
-```nix
-{ swiftpmFlags = [ "--disable-dead-strip" ]; }
-```
-
-The default `buildPhase` already passes `-j` for parallel building.
-
-If these two customization options are insufficient, provide your own `buildPhase` that invokes `swift build`.
-
-### Running tests {#ssec-swiftpm-running-tests}
-
-Including `swiftpm` in your `nativeBuildInputs` also provides a default `checkPhase`, but it must be enabled with:
-
-```nix
-{ doCheck = true; }
-```
-
-This essentially runs: `swift test -c release`
-
-### Installing packages {#ssec-swiftpm-install-phase}
-
-SwiftPM provides a default install phase that installs any products specified in your package’s `Package.swift`.
-If your package does not specify any products, which is not uncommon, you will have to manually install them to `out`.
-To disable the SwiftPM install phase, include the following in your derivation:
-
-```nix
-{ dontUseSwiftpmInstall = true; }
-```
-
-## Hooks {#ssec-swift-hooks}
-
-Swift provides the following hooks to automate builds and unpack dependencies:
-
-- `swiftpmHook`: Propagated by `swiftpm`.
-  Also propagates `swiftpmUnpackHook`.
-  Provides build, install, and check phases. It also adds any dependencies found in `buildInputs` to `swiftpmFlags`.
-- `swiftpmUnpackHook`: Sets up `workspace-state.json` and links vendored dependencies to the top-level `Packages` directory in the build environment.
-
-Swift also provides a hook with the toolchain to replace rpath references to  the toolchain with references to the stdlib package.
-This hook is used automatically by the `swift` package.
-This avoids pulling the entire toolchain into the closure of your package.
-
 ## Considerations for custom build tools {#ssec-swift-considerations-for-custom-build-tools}
 
 ### Linking the standard library {#ssec-swift-linking-the-standard-library}
 
-The Swift stdlib is packaged separately as `swiftPackages.stdlib`.
-The shared and static libraries are installed to `lib`.
-Most tooling in Nixpkgs should find them automatically when linking.
-The stdlib provides a hook to change any rpaths pointing to the toolchain to point to the stdlib instead.
+The `swift` package has a separate `lib` output containing just the Swift
+standard library, to prevent Swift applications needing a dependency on the
+full Swift compiler at runtime. Linking with the Nixpkgs Swift toolchain
+already ensures binaries correctly reference the `lib` output.
 
-The stdlib modules are installed to `lib/swift/<platform>` in the `dev` output of the stdlib package.
-These are symlinked together into the `swift` toolchain.
-If your build tools locate the modules relative to the `swift` compiler  executable, it should do the right thing automatically.
+Sometimes, Swift is used only to compile part of a mixed codebase, and the
+link step is manual. Custom build tools often locate the standard library
+relative to the `swift` compiler executable, and while the result will work,
+when this path ends up in the binary, it will have the Swift compiler as an
+unintended dependency.
 
-### Accessing properties of the Swift platform {#ssec-swift-platform-properties}
-
-The architecture, platform, and triple used by Swift is available as attributes on the build/host/targetPlatform for the `stdenv`.
-
-- `stdenv.<platform>.swift.platform`: The Swift platform (e.g., `macosx` for macOS, `linux` for Linux, etc).
-- `stdenv.<platform>.swift.arch`: The Swift architecture (e.g., `arm64` for Darwin or `aarch64` for Linux, `x86_64`, etc).
-- `stdenv.<platform>.swift.triple`: The triple used by Swift.
-  This is the same as `stdenv.<platform>.config` except on Darwin.
-  On Darwin, it uses the OS name instead of `darwin` and includes the deployment target (e.g., `arm64-apple-macosx14.0`).
+In this case, you should investigate how your build process discovers the
+standard library, and override the path. The correct path will be something
+like: `"${swift.swift.lib}/${swift.swiftModuleSubdir}"`

doc/lib.md

@@ -1 +1,6 @@
 # Nixpkgs `lib` {#id-1.4}
+
+```{=include=} chapters
+functions.md
+module-system/module-system.chapter.md
+```

doc/manual.md.in

@@ -1,6 +1,27 @@
 # Nixpkgs Manual {#nixpkgs-manual}
 ## Version @MANUAL_VERSION@
 
+```{=include=} chapters
+preface.chapter.md
+```
+
+```{=include=} parts
+getting-started/getting-started.part.md
+using-nixpkgs.md
+lib.md
+stdenv.md
+toolchains.md
+build-helpers.md
+modules/index.md
+development.md
+contributing.md
+interoperability.md
+```
+
+```{=include=} chapters
+languages-frameworks/index.md
+```
+
 ```{=include=} appendix html:into-file=//release-notes.html
 release-notes/release-notes.md
 ```

doc/modules/index.md

@@ -4,5 +4,9 @@ The Nixpkgs repository provides [Module System] modules for various purposes.
 
 The following sections are organized by [module class].
 
+```{=include=} chapters
+generic.chapter.md
+```
+
 [Module System]: https://nixos.org/manual/nixpkgs/unstable/#module-system
 [module class]: https://nixos.org/manual/nixpkgs/unstable/#module-system-lib-evalModules-param-class

doc/nav.json

@@ -1,670 +1,4 @@
 {
   "open": [],
-  "items": [
-    {
-      "file": "preface.chapter.md"
-    },
-    {
-      "label": "Getting started",
-      "id": "getting-started",
-      "children": [
-        {
-          "file": "getting-started/getting-started.part.md"
-        },
-        {
-          "file": "getting-started/first-package.chapter.md"
-        },
-        {
-          "file": "getting-started/dev-environments.md"
-        }
-      ]
-    },
-    {
-      "label": "Guides",
-      "id": "guides",
-      "children": [
-        {
-          "file": "using-nixpkgs.md"
-        },
-        {
-          "file": "channels.chapter.md"
-        },
-        {
-          "file": "using/platform-support.chapter.md"
-        },
-        {
-          "file": "using/configuration.chapter.md"
-        },
-        {
-          "file": "using/overlays.chapter.md"
-        },
-        {
-          "file": "using/overrides.chapter.md"
-        },
-        {
-          "label": "Standard environment",
-          "id": "part-stdenv",
-          "children": [
-            {
-              "file": "stdenv.md"
-            },
-            {
-              "file": "stdenv/stdenv.chapter.md"
-            },
-            {
-              "file": "stdenv/meta.chapter.md"
-            },
-            {
-              "file": "stdenv/passthru.chapter.md"
-            },
-            {
-              "file": "stdenv/multiple-output.chapter.md"
-            },
-            {
-              "file": "stdenv/cross-compilation.chapter.md"
-            },
-            {
-              "file": "stdenv/platform-notes.chapter.md"
-            }
-          ]
-        },
-        {
-          "label": "Languages and frameworks",
-          "id": "chap-language-support",
-          "children": [
-            {
-              "file": "languages-frameworks/index.md"
-            },
-            {
-              "file": "languages-frameworks/agda.section.md"
-            },
-            {
-              "file": "languages-frameworks/android.section.md"
-            },
-            {
-              "file": "languages-frameworks/astal.section.md"
-            },
-            {
-              "file": "languages-frameworks/beam.section.md"
-            },
-            {
-              "file": "languages-frameworks/chicken.section.md"
-            },
-            {
-              "file": "languages-frameworks/cosmic.section.md"
-            },
-            {
-              "file": "languages-frameworks/crystal.section.md"
-            },
-            {
-              "file": "languages-frameworks/cuda.section.md"
-            },
-            {
-              "file": "languages-frameworks/cuelang.section.md"
-            },
-            {
-              "file": "languages-frameworks/dart.section.md"
-            },
-            {
-              "file": "languages-frameworks/dhall.section.md"
-            },
-            {
-              "file": "languages-frameworks/dlang.section.md"
-            },
-            {
-              "file": "languages-frameworks/dotnet.section.md"
-            },
-            {
-              "file": "languages-frameworks/emscripten.section.md"
-            },
-            {
-              "file": "languages-frameworks/factor.section.md"
-            },
-            {
-              "file": "languages-frameworks/gnome.section.md"
-            },
-            {
-              "file": "languages-frameworks/go.section.md"
-            },
-            {
-              "file": "languages-frameworks/gradle.section.md"
-            },
-            {
-              "file": "languages-frameworks/hare.section.md"
-            },
-            {
-              "file": "languages-frameworks/haskell.section.md"
-            },
-            {
-              "file": "languages-frameworks/hy.section.md"
-            },
-            {
-              "file": "languages-frameworks/idris.section.md"
-            },
-            {
-              "file": "languages-frameworks/idris2.section.md"
-            },
-            {
-              "file": "languages-frameworks/ios.section.md"
-            },
-            {
-              "file": "languages-frameworks/java.section.md"
-            },
-            {
-              "file": "languages-frameworks/javascript.section.md"
-            },
-            {
-              "file": "languages-frameworks/julia.section.md"
-            },
-            {
-              "file": "languages-frameworks/lean4.section.md"
-            },
-            {
-              "file": "languages-frameworks/lisp.section.md"
-            },
-            {
-              "file": "languages-frameworks/lua.section.md"
-            },
-            {
-              "file": "languages-frameworks/maven.section.md"
-            },
-            {
-              "file": "languages-frameworks/nim.section.md"
-            },
-            {
-              "file": "languages-frameworks/ocaml.section.md"
-            },
-            {
-              "file": "languages-frameworks/octave.section.md"
-            },
-            {
-              "file": "languages-frameworks/perl.section.md"
-            },
-            {
-              "file": "languages-frameworks/php.section.md"
-            },
-            {
-              "file": "languages-frameworks/pkg-config.section.md"
-            },
-            {
-              "file": "languages-frameworks/python.section.md"
-            },
-            {
-              "file": "languages-frameworks/qt.section.md"
-            },
-            {
-              "file": "languages-frameworks/r.section.md"
-            },
-            {
-              "file": "languages-frameworks/rocq.section.md"
-            },
-            {
-              "file": "languages-frameworks/ruby.section.md"
-            },
-            {
-              "file": "languages-frameworks/rust.section.md"
-            },
-            {
-              "file": "languages-frameworks/scheme.section.md"
-            },
-            {
-              "file": "languages-frameworks/swift.section.md"
-            },
-            {
-              "file": "languages-frameworks/tcl.section.md"
-            },
-            {
-              "file": "languages-frameworks/texlive.section.md"
-            },
-            {
-              "file": "languages-frameworks/typst.section.md"
-            },
-            {
-              "file": "languages-frameworks/vim.section.md"
-            },
-            {
-              "file": "languages-frameworks/neovim.section.md"
-            }
-          ]
-        },
-        {
-          "label": "Toolchains",
-          "id": "part-toolchains",
-          "children": [
-            {
-              "file": "toolchains.md"
-            },
-            {
-              "file": "toolchains/llvm.chapter.md"
-            }
-          ]
-        },
-        {
-          "label": "Build helpers",
-          "id": "part-builders",
-          "children": [
-            {
-              "file": "build-helpers.md"
-            },
-            {
-              "file": "build-helpers/fixed-point-arguments.chapter.md"
-            },
-            {
-              "file": "build-helpers/fetchers.chapter.md"
-            },
-            {
-              "file": "build-helpers/trivial-build-helpers.chapter.md"
-            },
-            {
-              "file": "build-helpers/testers.chapter.md"
-            },
-            {
-              "file": "build-helpers/dev-shell-tools.chapter.md"
-            },
-            {
-              "label": "Special build helpers",
-              "id": "chap-special",
-              "children": [
-                {
-                  "file": "build-helpers/special.md"
-                },
-                {
-                  "file": "build-helpers/special/buildenv.section.md"
-                },
-                {
-                  "file": "build-helpers/special/fakenss.section.md"
-                },
-                {
-                  "file": "build-helpers/special/fhs-environments.section.md"
-                },
-                {
-                  "file": "build-helpers/special/makesetuphook.section.md"
-                },
-                {
-                  "file": "build-helpers/special/mkshell.section.md"
-                },
-                {
-                  "file": "build-helpers/special/vm-tools.section.md"
-                },
-                {
-                  "file": "build-helpers/special/checkpoint-build.section.md"
-                }
-              ]
-            },
-            {
-              "label": "Images",
-              "id": "chap-images",
-              "children": [
-                {
-                  "file": "build-helpers/images.md"
-                },
-                {
-                  "file": "build-helpers/images/appimagetools.section.md"
-                },
-                {
-                  "file": "build-helpers/images/dockertools.section.md"
-                },
-                {
-                  "file": "build-helpers/images/ocitools.section.md"
-                },
-                {
-                  "file": "build-helpers/images/portableservice.section.md"
-                },
-                {
-                  "file": "build-helpers/images/makediskimage.section.md"
-                },
-                {
-                  "file": "build-helpers/images/binarycache.section.md"
-                }
-              ]
-            },
-            {
-              "label": "Hooks reference",
-              "id": "chap-hooks",
-              "children": [
-                {
-                  "file": "hooks/index.md"
-                },
-                {
-                  "file": "hooks/autoconf.section.md"
-                },
-                {
-                  "file": "hooks/automake.section.md"
-                },
-                {
-                  "file": "hooks/autopatchcil.section.md"
-                },
-                {
-                  "file": "hooks/autopatchelf.section.md"
-                },
-                {
-                  "file": "hooks/aws-c-common.section.md"
-                },
-                {
-                  "file": "hooks/bmake.section.md"
-                },
-                {
-                  "file": "hooks/breakpoint.section.md"
-                },
-                {
-                  "file": "hooks/cernlib.section.md"
-                },
-                {
-                  "file": "hooks/check-phase-thread-limit-hook.section.md"
-                },
-                {
-                  "file": "hooks/cmake.section.md"
-                },
-                {
-                  "file": "hooks/desktop-file-utils.section.md"
-                },
-                {
-                  "file": "hooks/gdk-pixbuf.section.md"
-                },
-                {
-                  "file": "hooks/gnome.section.md"
-                },
-                {
-                  "file": "hooks/haredo.section.md"
-                },
-                {
-                  "file": "hooks/installAgentSkills.section.md"
-                },
-                {
-                  "file": "hooks/installShellFiles.section.md"
-                },
-                {
-                  "file": "hooks/installFonts.section.md"
-                },
-                {
-                  "file": "hooks/juce.section.md"
-                },
-                {
-                  "file": "hooks/julec.section.md"
-                },
-                {
-                  "file": "hooks/just.section.md"
-                },
-                {
-                  "file": "hooks/libglycin.section.md"
-                },
-                {
-                  "file": "hooks/libiconv.section.md"
-                },
-                {
-                  "file": "hooks/libxml2.section.md"
-                },
-                {
-                  "file": "hooks/memcached-test-hook.section.md"
-                },
-                {
-                  "file": "hooks/meson.section.md"
-                },
-                {
-                  "file": "hooks/mpi-check-hook.section.md"
-                },
-                {
-                  "file": "hooks/ninja.section.md"
-                },
-                {
-                  "file": "hooks/nodejs-install-executables.section.md"
-                },
-                {
-                  "file": "hooks/nodejs-install-manuals.section.md"
-                },
-                {
-                  "file": "hooks/npm-build-hook.section.md"
-                },
-                {
-                  "file": "hooks/npm-config-hook.section.md"
-                },
-                {
-                  "file": "hooks/npm-install-hook.section.md"
-                },
-                {
-                  "file": "hooks/patch-rc-path-hooks.section.md"
-                },
-                {
-                  "file": "hooks/perl.section.md"
-                },
-                {
-                  "file": "hooks/pkg-config.section.md"
-                },
-                {
-                  "file": "hooks/pnpm.section.md"
-                },
-                {
-                  "file": "hooks/postgresql-test-hook.section.md"
-                },
-                {
-                  "file": "hooks/premake.section.md"
-                },
-                {
-                  "file": "hooks/python.section.md"
-                },
-                {
-                  "file": "hooks/redis-test-hook.section.md"
-                },
-                {
-                  "file": "hooks/scons.section.md"
-                },
-                {
-                  "file": "hooks/tauri.section.md"
-                },
-                {
-                  "file": "hooks/tetex-tex-live.section.md"
-                },
-                {
-                  "file": "hooks/udevCheckHook.section.md"
-                },
-                {
-                  "file": "hooks/unzip.section.md"
-                },
-                {
-                  "file": "hooks/validatePkgConfig.section.md"
-                },
-                {
-                  "file": "hooks/versionCheckHook.section.md"
-                },
-                {
-                  "file": "hooks/waf.section.md"
-                },
-                {
-                  "file": "hooks/writable-tmpdir-as-home-hook.section.md"
-                },
-                {
-                  "file": "hooks/zig.section.md"
-                },
-                {
-                  "file": "hooks/xcbuild.section.md"
-                },
-                {
-                  "file": "hooks/xfce4-dev-tools.section.md"
-                }
-              ]
-            },
-            {
-              "label": "Packages",
-              "id": "chap-packages",
-              "children": [
-                {
-                  "file": "packages/index.md"
-                },
-                {
-                  "file": "packages/citrix.section.md"
-                },
-                {
-                  "file": "packages/darwin-builder.section.md"
-                },
-                {
-                  "file": "packages/dlib.section.md"
-                },
-                {
-                  "file": "packages/eclipse.section.md"
-                },
-                {
-                  "file": "packages/elm.section.md"
-                },
-                {
-                  "file": "packages/emacs.section.md"
-                },
-                {
-                  "file": "packages/firefox.section.md"
-                },
-                {
-                  "file": "packages/friction-graphics.section.md"
-                },
-                {
-                  "file": "packages/fish.section.md"
-                },
-                {
-                  "file": "packages/fuse.section.md"
-                },
-                {
-                  "file": "packages/geant4.section.md"
-                },
-                {
-                  "file": "packages/ibus.section.md"
-                },
-                {
-                  "file": "packages/inkscape.section.md"
-                },
-                {
-                  "file": "packages/kakoune.section.md"
-                },
-                {
-                  "file": "packages/krita.section.md"
-                },
-                {
-                  "file": "packages/linux.section.md"
-                },
-                {
-                  "file": "packages/lhapdf.section.md"
-                },
-                {
-                  "file": "packages/locales.section.md"
-                },
-                {
-                  "file": "packages/etc-files.section.md"
-                },
-                {
-                  "file": "packages/nginx.section.md"
-                },
-                {
-                  "file": "packages/nrfutil.section.md"
-                },
-                {
-                  "file": "packages/opengl.section.md"
-                },
-                {
-                  "file": "packages/packer.section.md"
-                },
-                {
-                  "file": "packages/shell-helpers.section.md"
-                },
-                {
-                  "file": "packages/python-tree-sitter.section.md"
-                },
-                {
-                  "label": "treefmt",
-                  "id": "treefmt",
-                  "children": [
-                    {
-                      "file": "packages/treefmt.section.md"
-                    },
-                    {
-                      "id-prefix": "auto-generated-treefmt-functions",
-                      "file": "packages/treefmt-functions.section.md"
-                    }
-                  ]
-                },
-                {
-                  "file": "packages/steam.section.md"
-                },
-                {
-                  "file": "packages/cataclysm-dda.section.md"
-                },
-                {
-                  "file": "packages/urxvt.section.md"
-                },
-                {
-                  "file": "packages/vcpkg.section.md"
-                },
-                {
-                  "file": "packages/weechat.section.md"
-                },
-                {
-                  "file": "packages/uv.section.md"
-                },
-                {
-                  "file": "packages/build-support.md"
-                }
-              ]
-            }
-          ]
-        },
-        {
-          "label": "Modules",
-          "id": "modules",
-          "children": [
-            {
-              "file": "modules/index.md"
-            },
-            {
-              "file": "modules/generic.chapter.md"
-            }
-          ]
-        }
-      ]
-    },
-    {
-      "label": "Reference",
-      "id": "reference",
-      "children": [
-        {
-          "file": "lib.md"
-        },
-        {
-          "file": "functions.md"
-        },
-        {
-          "file": "functions/library.md"
-        },
-        {
-          "collection": "lib-functions.json",
-          "type": "nixdoc"
-        },
-        {
-          "file": "functions/generators.section.md"
-        },
-        {
-          "file": "functions/debug.section.md"
-        },
-        {
-          "file": "functions/prefer-remote-fetch.section.md"
-        },
-        {
-          "file": "functions/nix-gitignore.section.md"
-        },
-        {
-          "file": "module-system/module-system.chapter.md"
-        },
-        {
-          "label": "Interoperability Standards",
-          "id": "part-interoperability",
-          "children": [
-            {
-              "file": "interoperability.md"
-            },
-            {
-              "file": "interoperability/cyclonedx.md"
-            }
-          ]
-        }
-      ]
-    },
-    {
-      "file": "contributing.md"
-    }
-  ]
+  "items": []
 }

doc/packages/citrix.section.md

@@ -6,26 +6,6 @@ The [Citrix Workspace App](https://www.citrix.com/products/workspace-app/) is a
 
 The tarball archive needs to be downloaded manually, as the license agreements of the vendor for [Citrix Workspace](https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html) needs to be accepted first. Then run `nix-prefetch-url file://$PWD/linuxx64-$version.tar.gz`. With the archive available in the store, the package can be built and installed with Nix.
 
-The package includes the `ctxcwalogd.service` user unit required by Citrix's logging tools.
-To enable it on NixOS:
-
-```nix
-{
-  systemd.packages = [ pkgs.citrix-workspace ];
-  systemd.user.services.ctxcwalogd.wantedBy = [ "default.target" ];
-}
-```
-
-For FUSE-based file transfer, enable the privileged helper on NixOS:
-
-```nix
-{
-  programs.fuse.enable = true;
-}
-```
-
-The package uses `/run/wrappers/bin/fusermount3` when it is available.
-
 ## Citrix Self-service {#sec-citrix-selfservice}
 
 The [self-service](https://support.citrix.com/article/CTX200337) is an application for managing Citrix desktops and applications. Please note that this feature only works with at least `citrix_workspace_20_06_0` and later versions.

doc/packages/darwin-builder.section.md

@@ -139,7 +139,7 @@ running NixOS integration tests on the builder (macOS 15+, M3 or newer).
 ```nix
 {
   inputs = {
-    nixpkgs.url = "https://channels.nixos.org/nixpkgs-26.05-darwin/nixexprs.tar.zst";
+    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-22.11-darwin";
     darwin.url = "github:nix-darwin/nix-darwin/master";
     darwin.inputs.nixpkgs.follows = "nixpkgs";
   };

doc/packages/index.md

@@ -1,3 +1,39 @@
 # Packages {#chap-packages}
 
 This chapter contains information about how to use and maintain the Nix expressions for a number of specific packages, such as the Linux kernel or X.org.
+
+```{=include=} sections
+citrix.section.md
+darwin-builder.section.md
+dlib.section.md
+eclipse.section.md
+elm.section.md
+emacs.section.md
+firefox.section.md
+friction-graphics.section.md
+fish.section.md
+fuse.section.md
+geant4.section.md
+ibus.section.md
+inkscape.section.md
+kakoune.section.md
+krita.section.md
+linux.section.md
+lhapdf.section.md
+locales.section.md
+etc-files.section.md
+nginx.section.md
+nrfutil.section.md
+opengl.section.md
+packer.section.md
+shell-helpers.section.md
+python-tree-sitter.section.md
+treefmt.section.md
+steam.section.md
+cataclysm-dda.section.md
+urxvt.section.md
+vcpkg.section.md
+weechat.section.md
+uv.section.md
+build-support.md
+```

doc/packages/treefmt.section.md

@@ -7,6 +7,10 @@ provides functions for configuring treefmt using the module system, which are [d
 
 Alternatively, treefmt can be configured using [treefmt-nix](https://github.com/numtide/treefmt-nix).
 
+```{=include=} sections auto-id-prefix=auto-generated-treefmt-functions
+treefmt-functions.section.md
+```
+
 ## Options Reference {#sec-treefmt-options-reference}
 
 The following attributes can be passed to [`withConfig`](#pkgs.treefmt.withConfig) or [`evalConfig`](#pkgs.treefmt.evalConfig):
@@ -16,3 +20,4 @@ id-prefix: opt-treefmt-
 list-id: configuration-variable-list
 source: ../treefmt-options.json
 ```
+