nixos/release-notes: move non-highlights to other mentions

(cherry picked from commit 9a3e869997)

.devcontainer/devcontainer.json

@@ -1,34 +0,0 @@
-{
-  "name": "nixpkgs",
-  "image": "mcr.microsoft.com/devcontainers/universal:5-linux",
-  "features": {
-    "ghcr.io/devcontainers/features/nix:1": {
-      // fails in the devcontainer sandbox, enable sandbox via config instead
-      "multiUser": false,
-      "packages": "nixpkgs.nixd,nixpkgs.nixfmt",
-      "useAttributePath": true,
-      "extraNixConfig": "experimental-features = nix-command flakes,sandbox = true"
-    }
-  },
-  // Fixup permissions inside container.
-  // https://github.com/NixOS/nix/issues/6680#issuecomment-1230902525
-  "postCreateCommand": "sudo apt-get install -y acl",
-  "postStartCommand": "sudo setfacl -k /tmp; if [ -e /dev/kvm ]; then sudo chgrp $(id -g) /dev/kvm; fi",
-  "customizations": {
-    "vscode": {
-      "extensions": [
-        "jnoortheen.nix-ide"
-      ],
-      "settings": {
-        "[nix]": {
-            "editor.formatOnSave": true
-        },
-        "nix.enableLanguageServer": true,
-        "nix.serverPath": "nixd"
-      }
-    }
-  },
-  "remoteEnv": {
-    "NIXPKGS": "/workspaces/nixpkgs"
-  }
-}

.editorconfig

@@ -17,13 +17,10 @@ end_of_line = unset
 insert_final_newline = unset
 trim_trailing_whitespace = unset
 
-# We want readFile .version to return the version without a newline.
-[.version]
-insert_final_newline = false
-
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
-[*.{bash,css,js,json,lock,md,nix,pl,pm,py,rb,sh,xml}]
+# Match json/lockfiles/markdown/nix/perl/python/ruby/shell/docbook files, set indent to spaces
+[*.{json,lock,md,nix,pl,pm,py,rb,sh,xml}]
 indent_style = space
 
 # Match docbook files, set indent width of one
@@ -31,15 +28,11 @@ indent_style = space
 indent_size = 1
 
 # Match json/lockfiles/markdown/nix/ruby files, set indent width of two
-[*.{js,json,lock,md,nix,rb}]
+[*.{json,lock,md,nix,rb}]
 indent_size = 2
 
-# Match all the Bash code in Nix files, set indent width of two
-[*.{bash,sh}]
-indent_size = 2
-
-# Match Perl and Python scripts, set indent width of four
-[*.{pl,pm,py}]
+# Match perl/python/shell scripts, set indent width of four
+[*.{pl,pm,py,sh}]
 indent_size = 4
 
 # Match gemfiles, set indent to spaces with width of two
@@ -47,11 +40,6 @@ indent_size = 4
 indent_size = 2
 indent_style = space
 
-# Match package.json and package-lock.json, which are generally pulled from upstream and accept them as they are
-[package{,-lock}.json]
-indent_style = unset
-insert_final_newline = unset
-
 # Disable file types or individual files
 # some of these files may be auto-generated and/or require significant changes
 
@@ -64,41 +52,45 @@ insert_final_newline = unset
 end_of_line = unset
 trim_trailing_whitespace = unset
 
-[*.json]
-insert_final_newline = unset
-
 [*.lock]
 indent_size = unset
 
-# Although Markdown/CommonMark allows using two trailing spaces to denote
-# a hard line break, we do not use that feature in nixpkgs since
-# it forces the surrounding paragraph to become a <literallayout> which
-# does not wrap reasonably.
-# Instead of a hard line break, start a new paragraph by inserting a blank line.
-[*.md]
-trim_trailing_whitespace = true
-
-# binaries
-[*.nib]
-end_of_line = unset
-insert_final_newline = unset
-trim_trailing_whitespace = unset
-charset = unset
-
 [eggs.nix]
 trim_trailing_whitespace = unset
 
-[registry.dat]
+[nixos/modules/services/networking/ircd-hybrid/*.{conf,in}]
+trim_trailing_whitespace = unset
+
+[nixos/tests/systemd-networkd-vrf.nix]
+trim_trailing_whitespace = unset
+
+[pkgs/build-support/dotnetenv/Wrapper/**]
+end_of_line = unset
+indent_style = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+
+[pkgs/build-support/upstream-updater/**]
+indent_style = unset
+trim_trailing_whitespace = unset
+
+[pkgs/development/compilers/elm/registry.dat]
 end_of_line = unset
 insert_final_newline = unset
 
-# see https://manual.jule.dev/project/code-style.html#indentions
-[*.jule]
-indent_style = tab
+[pkgs/development/haskell-modules/hackage-packages.nix]
+indent_style = unset
+trim_trailing_whitespace = unset
 
-[jule.mod]
+[pkgs/servers/dict/wordnet_structures.py]
+trim_trailing_whitespace = unset
+
+[pkgs/tools/misc/timidity/timidity.cfg]
+trim_trailing_whitespace = unset
+
+[pkgs/tools/security/enpass/data.json]
 insert_final_newline = unset
+trim_trailing_whitespace = unset
 
-# Keep this hint at the bottom:
-# Please don't add entries for subfolders here.
-# Create <subfolder>/.editorconfig instead.
+[pkgs/top-level/emscripten-packages.nix]
+trim_trailing_whitespace = unset

.git-blame-ignore-revs

@@ -1,315 +0,0 @@
-# This file contains a list of commits that are not likely what you
-# are looking for in a blame, such as mass reformatting or renaming.
-#
-# If a commit's line ends with `# !autorebase <command>`,
-# where <command> is an idempotent bash command that reapplies the changes from the commit,
-# the `maintainers/scripts/auto-rebase/run.sh` script can be used to rebase
-# across that commit while automatically resolving merge conflicts caused by the commit.
-#
-# You can set this file as a default ignore file for blame by running
-# the following command.
-#
-# $ git config blame.ignoreRevsFile .git-blame-ignore-revs
-#
-# To temporarily not use this file add
-# --ignore-revs-file=""
-# to your blame command.
-#
-# The ignoreRevsFile can't be set globally due to blame failing if the file isn't present.
-# To not have to set the option in every repository it is needed in,
-# save the following script in your path with the name "git-bblame"
-# now you can run
-# $ git bblame $FILE
-# to use the .git-blame-ignore-revs file if it is present.
-#
-# #!/usr/bin/env bash
-# repo_root=$(git rev-parse --show-toplevel)
-# if [[ -e $repo_root/.git-blame-ignore-revs ]]; then
-#     git blame --ignore-revs-file="$repo_root/.git-blame-ignore-revs" $@
-# else
-#     git blame $@
-# fi
-
-
-# nixos/modules/rename: Sort alphabetically
-1f71224fe86605ef4cd23ed327b3da7882dad382
-
-# manual: fix typos
-feddd5e7f8c6f8167b48a077fa2a5394dc008999
-
-# nixos: fix module paths in rename.nix
-d08ede042b74b8199dc748323768227b88efcf7c
-
-# fix indentation in mk-python-derivation.nix
-d1c1a0c656ccd8bd3b25d3c4287f2d075faf3cf3
-
-# fix indentation in meteor default.nix
-a37a6de881ec4c6708e6b88fd16256bbc7f26bbd
-
-# pkgs/stdenv/make-derivation: Reindent
-b4cc2a2479a7ab0f6440b2e1319221920ef72699
-
-# treewide: automatically md-convert option descriptions
-2e751c0772b9d48ff6923569adfa661b030ab6a2
-
-# nixos/*: automatically convert option docs
-087472b1e5230ffc8ba642b1e4f9218adf4634a2
-
-# nixos/*: automatically convert option descriptions
-ef176dcf7e76c3639571d7c6051246c8fbadf12a
-
-# nixos/*: automatically convert option docs to MD
-61e93df1891972bae3e0c97a477bd44e8a477aa0
-
-# nixos/*: convert options with admonitions to MD
-722b99bc0eb57711c0498a86a3f55e6c69cdb05f
-
-# nixos/*: automatically convert option docs
-6039648c50c7c0858b5e506c6298773a98e0f066
-
-# nixos/*: md-convert options with unordered lists
-c915b915b5e466a0b0b2af2906cd4d2380b8a1de
-
-# nixos/*: convert options with listings
-f2ea09ecbe1fa1da32eaa6e036d64ac324a2986f
-
-# nixos/*: convert straggler options to MD
-1d41cff3dc4c8f37bb5841f51fcbff705e169178
-
-# nixos/*: normalize manpage references to single-line form
-423545fe4865d126e86721ba30da116e29c65004
-
-# nixos/documentation: split options doc build
-fc614c37c653637e5475a0b0a987489b4d1f351d
-
-# nixos/*: convert options with admonitions to MD
-722b99bc0eb57711c0498a86a3f55e6c69cdb05f
-
-# nixos/*: convert internal option descriptions to MD
-9547123258f69efd92b54763051d6dc7f3bfcaca
-
-# nixos/*: replace </para><para> with double linebreaks
-694d5b19d30bf66687b42fb77f43ea7cd1002a62
-
-# treewide: add defaultText for options with simple interpolation defaults
-fb0e5be84331188a69b3edd31679ca6576edb75a
-
-# nixos/*: mark pre-existing markdown descriptions as mdDoc
-7e7d68a250f75678451cd44f8c3d585bf750461e
-
-# nixos/*: normalize link format
-3aebb4a2be8821a6d8a695f0908d8567dc00de31
-
-# nixos/*: replace <code> in option docs with <literal>
-16102dce2fbad670bd47dd75c860a8daa5fe47ad
-
-# nixos/*: add trivial defaultText for options with simple defaults
-25124556397ba17bfd70297000270de1e6523b0a
-
-# systemd: rewrite comments
-92dfeb7b3dab820ae307c56c216d175c69ee93cd
-
-# systemd: break too long lines of Nix code
-67643f8ec84bef1482204709073e417c9f07eb87
-
-# {pkgs/development/cuda-modules,pkgs/test/cuda,pkgs/top-level/cuda-packages.nix}: reformat all CUDA files with nixfmt-rfc-style 2023-03-01
-802a1b4d3338f24cbc4efd704616654456d75a94
-
-# postgresql: move packages.nix to ext/default.nix
-719034f6f6749d624faa28dff259309fc0e3e730
-
-# php ecosystem: reformat with nixfmt-rfc-style
-75ae7621330ff8db944ce4dff4374e182d5d151f
-c759efa5e7f825913f9a69ef20f025f50f56dc4d
-
-# pkgs/os-specific/bsd: Reformat with nixfmt-rfc-style 2024-03-01
-3fe3b055adfc020e6a923c466b6bcd978a13069a
-
-# k3s: format with nixfmt-rfc-style
-6cfcd3c75428ede517bc6b15a353d704837a2830
-
-# python3Packages: format with nixfmt
-59b1aef59071cae6e87859dc65de973d2cc595c0
-
-# treewide description changes (#317959)
-bf995e3641950f4183c1dd9010349263dfa0123b
-755b915a158c9d588f08e9b08da9f7f3422070cc
-f8c4a98e8e138e21353a2c33b90db3359f539b37
-
-# vscode-extensions.*: format with nixfmt (RFC 166)
-7bf9febfa6271012b1ef86647a3a06f06875fdcf
-
-# remove uses of mdDoc (#303841)
-1a24330f792c8625746d07d842290e6fd95ae6f9
-acd0e3898feb321cb9a71a0fd376f1157d0f4553
-1b28414d2886c57343864326dbb745a634d3e37d
-6afb255d976f85f3359e4929abd6f5149c323a02
-
-# azure-cli: move to by-name, nixfmt #325950
-96cd538b68bd1d0a0a37979356d669abbba32ebc
-
-# poptracker: format with nixfmt-rfc-style (#326697)
-ff5c8f6cc3d1f2e017e86d50965c14b71f00567b
-
-# mangal: format with nixfmt-rfc-style #328284
-3bb5e993cac3a6e1c3056d2bc9bf43eb2c7a5951
-
-# pico-sdk: switch to finalAttrs (#329438)
-8946018b0391ae594d167f1e58497b18de068968
-
-# ollama: format with nixfmt-rfc-style (#329353)
-bdfde18037f8d9f9b641a4016c8ada4dc4cbf856
-
-# nixos/ollama: format with nixfmt-rfc-style (#329561)
-246d1ee533810ac1946d863bbd9de9b525818d56
-
-# steam: cleanup (#216972)
-ad815aebfbfe1415ff6436521d545029c803c3fb
-
-# nixos/nvidia: apply nixfmt-rfc-style (#313440)
-fbdcdde04a7caa007e825a8b822c75fab9adb2d6
-
-# treewide: reformat files which need reformatting after (#341407)
-e0464e47880a69896f0fb1810f00e0de469f770a
-
-# step-cli: format package.nix with nixfmt (#331629)
-fc7a83f8b62e90de5679e993d4d49ca014ea013d
-
-# ndn-cxx: format with nixfmt-rfc-style
-160b2b769c3b8a6d1ae9947afa77520fa2887db7
-
-# ndn-tools: format with nixfmt-rfc-style
-4882ef721ce3d7bb3b5e48ff80125255db515013
-
-# nfd: format with nixfmt-rfc-style
-548c2377fa81e2abfc192fbf4f521e601251c468
-
-# darwin.stdenv: format with nixfmt-rfc-style (#333962)
-93c10ac9e561c6594d3baaeaff2341907390d9b8
-
-# nrr: format with nixfmt-rfc-style (#334578)
-cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
-
-# nixos/kanidm: inherit lib, nixfmt
-8f18393d380079904d072007fb19dc64baef0a3a
-
-# fetchgit, fetchurl, fetchzip:
-# format after refactoring with lib.extendMkDerivation (#455994)
-aeddd850c6d3485fc1af2edfb111e58141d18dc1
-
-# fetchhg: format after refactoring with lib.extendMkDerivation and make overridable (#423539)
-34a5b1eb23129f8fb62c677e3760903f6d43228f
-
-# fetchurl: nixfmt-rfc-style
-ce21e97a1f20dee15da85c084f9d1148d84f853b
-
-# percona: apply nixfmt
-8d14fa2886fec877690c6d28cfcdba4503dbbcea
-
-# nixos/virtualisation: format image-related files
-# Original formatting commit that was reverted
-04fadac429ca7d6b92025188652376c230205730
-# Revert commit
-4cec81a9959ce612b653860dcca53101a36f328a
-# Final commit that does the formatting
-88b285c01d84de82c0b2b052fd28eaf6709c2d26
-
-# sqlc: format with nixfmt
-2bdec131b2bb2c8563f4556d741d34ccb77409e2
-
-# ant: format with nixfmt-rfc-style
-2538d58436b8d0b56d29780aeebf4bf720ddb9ea
-
-# treewide: migrate packages to pkgs/by-name, take 1
-571c71e6f73af34a229414f51585738894211408
-
-# format files with nixfmt (#347275)
-adb9714bd909df283c66bbd641bd631ff50a4260
-
-# treewide: incus packages
-9ab59bb5fb943ad6740f64f5a79eae9642fb8211
-
-# treewide nixfmt reformat pass 1, master, staging and staging-next
-4f0dadbf38ee4cf4cc38cbc232b7708fddf965bc
-667d42c00d566e091e6b9a19b365099315d0e611
-84d4f874c2bac9f3118cb6907d7113b3318dcb5e
-
-# tmuxPlugins sha-to-sri.py script
-516b1e74c358a9c4b06e5591f8c1a2897aad0c33
-
-# treewide: migrate comments in lib to rfc145 style
-ef85e0daa092c9eae0d32c7ce16b889728a5fbc0
-d89ad6c70e0e89aaae75e9f886878ea4e103965a
-e0fe216f4912dd88a021d12a44155fd2cfeb31c8
-80d5b411f6397d5c3e755a0635d95742f76f3c75
-
-# nixos/movim: format with nixfmt-rfc-style
-43c1654cae47cbf987cb63758c06245fa95c1e3b
-
-# nixos/iso-image.nix: nixfmt
-da9a092c34cef6947d7aee2b134f61df45171631
-
-# python-packages: format with nixfmt-rfc-style
-5f6f5e13ae0b6960cbf1be8aeb3d0048285a08d1
-
-# python-packages: sort with keep-sorted
-fd14c067813572afc03ddbf7cdedc3eab5a59954
-783add849cbca228a36ffdf407e5d380dc2fe6c4
-
-# treewide format of all Nix files
-374e6bcc403e02a35e07b650463c01a52b13a7c8 # !autorebase nix-shell --run treefmt
-
-# nix: nixfmt-rfc-style
-a4f7e161b380b35b2f7bc432659a95fd71254ad8
-0812c9a321003c924868051d2b2e1934e8880f3f
-34f269c14ac18d89ddee9a8f54b1ca92a85bbcc6
-062c34cdace499aa44f0fa6ca6f2ca71769f6c43
-
-# haskellPackages.hercules-ci-agent (cabal2nix -> nixfmt-rfc-style)
-9314da7ee8d2aedfb15193b8c489da51efe52bb5
-
-# haskell-updates: nixfmt-rfc-style
-9e296dcf846294e0aa94af7d3235e82eee7fe055
-
-# nix-builder-vm: nixfmt-rfc-style
-a034fb50f79816c6738fb48b48503b09ea3b0132
-
-# treewide: switch instances of lib.teams.*.members to the new meta.teams attribute
-05580f4b4433fda48fff30f60dfd303d6ee05d21
-
-# nixos/redmine: Get rid of global lib expansions
-d7f1102f04c58b2edfc74c9a1d577e3aebfca775
-
-# **/README.md: one sentence per line
-3d505c03610b6102af6d870ae3506a151cef1f68
-60e35e4ded6e91524364a74b3b4ec233ed9321f2
-99f2e655d9db009ee0b4ede3edced5f6c882c7f4
-b4532efe93882ae2e3fc579929a42a5a56544146
-
-# emacs: keep elpa/nongnu/melpa package overrides sorted
-9f2faf683ed48704aa17f693208a13aa64e22181
-
-# nixfmt 1.0.0
-62fe01651911043bd3db0add920af3d2935d9869 # !autorebase nix-shell --run treefmt
-5a0711127cd8b916c3d3128f473388c8c79df0da # !autorebase nix-shell --run treefmt
-
-# systemd: nixfmt
-b1c5cd3e794cdf89daa5e4f0086274a416a1cded
-
-#nixos/nextcloud: remove with lib usage
-b6088b0d8e13e8d18464d78935f0130052784658
-f7611cad5154a9096faa26d156a4079577bfae17
-
-# nixf-diagnose
-90e7159c559021ac4f4cc1222000f08a91feff69 # !autorebase nix-shell --run treefmt
-c283f32d296564fd649ef3ed268c1f1f7b199c49 # !autorebase nix-shell --run treefmt
-91a8fee3aaf79348aa2dc1552a29fc1b786c5133 # !autorebase nix-shell --run treefmt
-
-# aliases: keep-sorted
-48ce0739044bd6eba83c3a43bd4ad1046399cdad # !autorebase nix-shell --run treefmt
-
-# treewide: clean up 'meta = with' pattern
-567e8dfd8eddc5468e6380fc563ab8a27422ab1d
-
-# nixfmt 1.2.0
-28096cc5e3d8334fbe1845925f000f8c8c5e0aac # !autorebase nix-shell --run treefmt

.gitattributes

@@ -1,26 +1,5 @@
-# node/js lock files
-**/package-lock.json linguist-generated
-**/yarn.nix linguist-generated
-**/yarn.lock linguist-generated
-
-# Rust lock files
-**/Cargo.lock linguist-generated
-pkgs/build-support/rust/**/Cargo.lock -linguist-generated
-
-# NuGet, Gradle and others
-**/deps.json linguist-generated
-
-# Ruby lock files
-**/gemset.nix linguist-generated
-**/Gemfile.lock linguist-generated
-
-# PHP lock files
-**/composer.lock linguist-generated
-
-# various package managers and tools
 **/deps.nix linguist-generated
-**/deps.toml linguist-generated
-
+**/node-packages.nix linguist-generated
 
 pkgs/applications/editors/emacs-modes/*-generated.nix linguist-generated
 pkgs/development/r-modules/*-packages.nix linguist-generated
@@ -35,30 +14,3 @@ nixos/doc/default.nix linguist-documentation=false
 
 nixos/modules/module-list.nix merge=union
 # pkgs/top-level/all-packages.nix merge=union
-
-ci/OWNERS linguist-language=CODEOWNERS
-
-# Avoid munging line endings when using Git for Windows, and instead keep files
-# using LF line endings.  This particularly affects scripts committed in the
-# nixpkgs repository.
-#
-# - `text` without `=auto` would mean "Git should always munge line endings on
-#   this file so there will never be a CRLF in the repository, and the line
-#   endings in the working directory should respect the local Git
-#   configuration."
-# - `text=auto` means "Git should try to work out if this file is a text file.
-#   If it is, it should do the line-ending munging as for `text`, and if it
-#   isn't, it should leave the file alone."
-# - `eol=lf` means "Ignore any local configuration about how line
-#   endings normally work on this platform. This file should always and only
-#   have LF line endings in the repo (so if there's a CR in the repo, it's
-#   meant to be there in addition to any end-of-line mark), and the selected
-#   attribute is how the file should appear in the working directory."
-#
-# See https://github.com/NixOS/nixpkgs/issues/423762 for historical context.
-* text=auto eol=lf
-
-# Don't force LF line endings for diff/patch files, as they might be correctly
-# patching CRLF line endings from an upstream source package.
-*.diff !text !eol
-*.patch !text !eol

.github/CODEOWNERS

@@ -0,0 +1,226 @@
+# CODEOWNERS file
+#
+# This file is used to describe who owns what in this repository. This file does not
+# replace `meta.maintainers` but is instead used for other things than derivations
+# and modules, like documentation, package sets, and other assets.
+#
+# For documentation on this file, see https://help.github.com/articles/about-codeowners/
+# Mentioned users will get code review requests.
+
+# This file
+/.github/CODEOWNERS @edolstra
+
+# GitHub actions
+/.github/workflows @NixOS/Security @Mic92 @zowoq
+/.github/workflows/merge-staging @FRidh
+
+# EditorConfig
+/.editorconfig @Mic92 @zowoq
+
+# Libraries
+/lib                        @edolstra @nbp @infinisil
+/lib/systems                @nbp @ericson2314 @matthewbauer
+/lib/generators.nix         @edolstra @nbp @Profpatsch
+/lib/cli.nix                @edolstra @nbp @Profpatsch
+/lib/debug.nix              @edolstra @nbp @Profpatsch
+/lib/asserts.nix            @edolstra @nbp @Profpatsch
+
+# Nixpkgs Internals
+/default.nix                                     @nbp
+/pkgs/top-level/default.nix                      @nbp @Ericson2314
+/pkgs/top-level/impure.nix                       @nbp @Ericson2314
+/pkgs/top-level/stage.nix                        @nbp @Ericson2314 @matthewbauer
+/pkgs/top-level/splice.nix                       @Ericson2314 @matthewbauer
+/pkgs/top-level/release-cross.nix                @Ericson2314 @matthewbauer
+/pkgs/stdenv/generic                             @Ericson2314 @matthewbauer
+/pkgs/stdenv/cross                               @Ericson2314 @matthewbauer
+/pkgs/build-support/cc-wrapper                   @Ericson2314 @orivej
+/pkgs/build-support/bintools-wrapper             @Ericson2314 @orivej
+/pkgs/build-support/setup-hooks                  @Ericson2314
+/pkgs/build-support/setup-hooks/auto-patchelf.sh @aszlig
+
+# Nixpkgs build-support
+/pkgs/build-support/writers @lassulus @Profpatsch
+
+# NixOS Internals
+/nixos/default.nix          @nbp @infinisil
+/nixos/lib/from-env.nix     @nbp @infinisil
+/nixos/lib/eval-config.nix  @nbp @infinisil
+/nixos/doc/manual/configuration/abstractions.xml      @nbp
+/nixos/doc/manual/configuration/config-file.xml       @nbp
+/nixos/doc/manual/configuration/config-syntax.xml     @nbp
+/nixos/doc/manual/configuration/modularity.xml        @nbp
+/nixos/doc/manual/development/assertions.xml          @nbp
+/nixos/doc/manual/development/meta-attributes.xml     @nbp
+/nixos/doc/manual/development/option-declarations.xml @nbp
+/nixos/doc/manual/development/option-def.xml          @nbp
+/nixos/doc/manual/development/option-types.xml        @nbp
+/nixos/doc/manual/development/replace-modules.xml     @nbp
+/nixos/doc/manual/development/writing-modules.xml     @nbp
+/nixos/doc/manual/man-nixos-option.xml                @nbp
+/nixos/modules/installer/tools/nixos-option.sh        @nbp
+
+# NixOS integration test driver
+/nixos/lib/test-driver  @tfc
+
+# Updaters
+## update.nix
+/maintainers/scripts/update.nix   @jtojnar
+/maintainers/scripts/update.py    @jtojnar
+## common-updater-scripts
+/pkgs/common-updater/scripts/update-source-version    @jtojnar
+
+# Python-related code and docs
+/maintainers/scripts/update-python-libraries	@FRidh
+/pkgs/top-level/python-packages.nix     @FRidh @jonringer
+/pkgs/development/interpreters/python   @FRidh
+/pkgs/development/python-modules        @FRidh @jonringer
+/doc/languages-frameworks/python.section.md     @FRidh
+/pkgs/development/tools/poetry2nix @adisbladis
+
+# Haskell
+/doc/languages-frameworks/haskell.section.md  @cdepillabout @sternenseemann @maralorn
+/maintainers/scripts/haskell                  @cdepillabout @sternenseemann @maralorn
+/pkgs/development/compilers/ghc               @cdepillabout @sternenseemann @maralorn
+/pkgs/development/haskell-modules             @cdepillabout @sternenseemann @maralorn
+/pkgs/test/haskell                            @cdepillabout @sternenseemann @maralorn
+/pkgs/top-level/release-haskell.nix           @cdepillabout @sternenseemann @maralorn
+/pkgs/top-level/haskell-packages.nix          @cdepillabout @sternenseemann @maralorn
+
+# Perl
+/pkgs/development/interpreters/perl @volth @stigtsp
+/pkgs/top-level/perl-packages.nix   @volth @stigtsp
+/pkgs/development/perl-modules      @volth @stigtsp
+
+# R
+/pkgs/applications/science/math/R   @peti
+/pkgs/development/r-modules         @peti
+
+# Ruby
+/pkgs/development/interpreters/ruby @marsam
+/pkgs/development/ruby-modules      @marsam
+
+# Rust
+/pkgs/development/compilers/rust @Mic92 @LnL7 @zowoq
+/pkgs/build-support/rust @andir @danieldk @zowoq
+
+# Darwin-related
+/pkgs/stdenv/darwin         @NixOS/darwin-maintainers
+/pkgs/os-specific/darwin    @NixOS/darwin-maintainers
+
+# C compilers
+/pkgs/development/compilers/gcc @matthewbauer
+/pkgs/development/compilers/llvm @matthewbauer
+
+# Compatibility stuff
+/pkgs/top-level/unix-tools.nix @matthewbauer
+/pkgs/development/tools/xcbuild @matthewbauer
+
+# Beam-related (Erlang, Elixir, LFE, etc)
+/pkgs/development/beam-modules                  @gleber
+/pkgs/development/interpreters/erlang           @gleber
+/pkgs/development/interpreters/lfe              @gleber
+/pkgs/development/interpreters/elixir           @gleber
+/pkgs/development/tools/build-managers/rebar    @gleber
+/pkgs/development/tools/build-managers/rebar3   @gleber
+/pkgs/development/tools/erlang                  @gleber
+
+# Jetbrains
+/pkgs/applications/editors/jetbrains @edwtjo
+
+# Licenses
+/lib/licenses.nix @alyssais
+
+# Qt / KDE
+/pkgs/applications/kde @ttuegel
+/pkgs/desktops/plasma-5 @ttuegel
+/pkgs/development/libraries/kde-frameworks @ttuegel
+/pkgs/development/libraries/qt-5 @ttuegel
+
+# PostgreSQL and related stuff
+/pkgs/servers/sql/postgresql @thoughtpolice @marsam
+/nixos/modules/services/databases/postgresql.xml @thoughtpolice
+/nixos/modules/services/databases/postgresql.nix @thoughtpolice
+/nixos/tests/postgresql.nix @thoughtpolice
+
+# Hardened profile & related modules
+/nixos/modules/profiles/hardened.nix @joachifm
+/nixos/modules/security/hidepid.nix @joachifm
+/nixos/modules/security/lock-kernel-modules.nix @joachifm
+/nixos/modules/security/misc.nix @joachifm
+/nixos/tests/hardened.nix @joachifm
+/pkgs/os-specific/linux/kernel/hardened-config.nix @joachifm
+
+# Network Time Daemons
+/pkgs/tools/networking/chrony @thoughtpolice
+/pkgs/tools/networking/ntp @thoughtpolice
+/pkgs/tools/networking/openntpd @thoughtpolice
+/nixos/modules/services/networking/ntp @thoughtpolice
+
+# Dhall
+/pkgs/development/dhall-modules      @Gabriel439 @Profpatsch @ehmry
+/pkgs/development/interpreters/dhall @Gabriel439 @Profpatsch @ehmry
+
+# Idris
+/pkgs/development/idris-modules @Infinisil
+
+# Bazel
+/pkgs/development/tools/build-managers/bazel @mboes @Profpatsch
+
+# NixOS modules for e-mail and dns services
+/nixos/modules/services/mail/mailman.nix    @peti
+/nixos/modules/services/mail/postfix.nix    @peti
+/nixos/modules/services/networking/bind.nix @peti
+/nixos/modules/services/mail/rspamd.nix     @peti
+
+# Emacs
+/pkgs/applications/editors/emacs-modes @adisbladis
+/pkgs/applications/editors/emacs       @adisbladis
+/pkgs/top-level/emacs-packages.nix     @adisbladis
+
+# Neovim
+/pkgs/applications/editors/neovim      @jonringer
+/pkgs/applications/editors/neovim      @teto
+
+# VimPlugins
+/pkgs/misc/vim-plugins         @jonringer @softinio
+
+# VsCode Extensions
+/pkgs/misc/vscode-extensions   @jonringer
+
+# Prometheus exporter modules and tests
+/nixos/modules/services/monitoring/prometheus/exporters.nix  @WilliButz
+/nixos/modules/services/monitoring/prometheus/exporters.xml  @WilliButz
+/nixos/tests/prometheus-exporters.nix                        @WilliButz
+
+# PHP interpreter, packages, extensions, tests and documentation
+/doc/languages-frameworks/php.section.md @NixOS/php
+/nixos/tests/php                         @NixOS/php
+/pkgs/build-support/build-pecl.nix       @NixOS/php
+/pkgs/development/interpreters/php       @NixOS/php
+/pkgs/development/php-packages           @NixOS/php
+/pkgs/top-level/php-packages.nix         @NixOS/php
+
+# Podman, CRI-O modules and related
+/nixos/modules/virtualisation/containers.nix @NixOS/podman @zowoq
+/nixos/modules/virtualisation/cri-o.nix      @NixOS/podman @zowoq
+/nixos/modules/virtualisation/podman.nix     @NixOS/podman @zowoq
+/nixos/tests/cri-o.nix                       @NixOS/podman @zowoq
+/nixos/tests/podman.nix                      @NixOS/podman @zowoq
+
+# Docker tools
+/pkgs/build-support/docker                   @roberth @utdemir
+/nixos/tests/docker-tools-overlay.nix        @roberth
+/nixos/tests/docker-tools.nix                @roberth
+/doc/builders/images/dockertools.xml         @roberth
+
+# Blockchains
+/pkgs/applications/blockchains  @mmahut @RaghavSood
+
+# Go
+/pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
+/pkgs/development/go-modules   @kalbasit @Mic92 @zowoq
+/pkgs/development/go-packages  @kalbasit @Mic92 @zowoq
+
+# Cinnamon
+/pkgs/desktops/cinnamon @mkg20001

.github/CONTRIBUTING.md

@@ -0,0 +1,64 @@
+# How to contribute
+
+Note: contributing implies licensing those contributions
+under the terms of [COPYING](../COPYING), which is an MIT-like license.
+
+## Opening issues
+
+* Make sure you have a [GitHub account](https://github.com/signup/free)
+* Make sure there is no open issue on the topic
+* [Submit a new issue](https://github.com/NixOS/nixpkgs/issues/new/choose) by choosing the kind of topic and fill out the template
+
+## Submitting changes
+
+* Format the commit messages in the following way:
+
+  ```
+  (pkg-name | nixos/<module>): (from -> to | init at version | refactor | etc)
+
+  (Motivation for change. Additional information.)
+  ```
+
+  For consistency, there should not be a period at the end of the commit message's summary line (the first line of the commit message).
+
+  Examples:
+
+  * nginx: init at 2.0.1
+  * firefox: 54.0.1 -> 55.0
+  * nixos/hydra: add bazBaz option
+
+    Dual baz behavior is needed to do foo.
+  * nixos/nginx: refactor config generation
+
+    The old config generation system used impure shell scripts and could break in specific circumstances (see #1234).
+
+* `meta.description` should:
+  * Be capitalized.
+  * Not start with the package name.
+  * Not have a period at the end.
+* `meta.license` must be set and fit the upstream license.
+  * If there is no upstream license, `meta.license` should default to `lib.licenses.unfree`.
+* `meta.maintainers` must be set.
+
+See the nixpkgs manual for more details on [standard meta-attributes](https://nixos.org/nixpkgs/manual/#sec-standard-meta-attributes) and on how to [submit changes to nixpkgs](https://nixos.org/nixpkgs/manual/#chap-submitting-changes).
+
+## Writing good commit messages
+
+In addition to writing properly formatted commit messages, it's important to include relevant information so other developers can later understand *why* a change was made. While this information usually can be found by digging code, mailing list/Discourse archives, pull request discussions or upstream changes, it may require a lot of work.
+
+For package version upgrades and such a one-line commit message is usually sufficient.
+
+## Backporting changes
+
+Follow these steps to backport a change into a release branch in compliance with the [commit policy](https://nixos.org/nixpkgs/manual/#submitting-changes-stable-release-branches).
+
+1. Take note of the commits in which the change was introduced into `master` branch.
+2. Check out the target _release branch_, e.g. `release-20.09`. Do not use a _channel branch_ like `nixos-20.09` or `nixpkgs-20.09`.
+3. Create a branch for your change, e.g. `git checkout -b backport`.
+4. When the reason to backport is not obvious from the original commit message, use `git cherry-pick -xe <original commit>` and add a reason. Otherwise use `git cherry-pick -x <original commit>`. That's fine for minor version updates that only include security and bug fixes, commits that fixes an otherwise broken package or similar. Please also ensure the commits exists on the master branch; in the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the master pull request.
+5. Push to GitHub and open a backport pull request. Make sure to select the release branch (e.g. `release-20.09`) as the target branch of the pull request, and link to the pull request in which the original change was comitted to `master`. The pull request title should be the commit title with the release version as prefix, e.g. `[20.09]`.
+6. When the backport pull request is merged and you have the necessary privileges you can also replace the label `9.needs: port to stable` with `8.has: port to stable` on the original pull request. This way maintainers can keep track of missing backports easier.
+
+## Reviewing contributions
+
+See the nixpkgs manual for more details on how to [Review contributions](https://nixos.org/nixpkgs/manual/#chap-reviewing-contributions).

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,11 @@
+## Issue description
+
+
+
+### Steps to reproduce
+
+
+
+## Technical details
+
+Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -1,145 +0,0 @@
-name: "Bug report (package)"
-description: "Create a generic bug report against a package."
-title: "PACKAGENAME: BUG TITLE"
-labels: ["0.kind: bug"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`PACKAGENAME: BUG TITLE`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it failing to launch on ARM Linux, your title would be as follows:
-        > ```
-        > hello: fails to launch on aarch64-linux
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%220.kind%3A+bug%22+-label%3A%226.topic%3A+darwin%22+-label%3A%226.topic%3A+nixos%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -1,159 +0,0 @@
-name: "Bug report (macOS)"
-description: "Create a bug report against a package where the issue only occurs on macOS."
-title: "PACKAGENAME: BUG TITLE"
-labels: ["0.kind: bug", "6.topic: darwin"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`PACKAGENAME: BUG TITLE`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it failing to launch on Apple Silicon, your title would be as follows:
-        > ```
-        > hello: fails to launch on aarch64-darwin
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "dropdown"
-    id: "nix-darwin"
-    attributes:
-      label: "Are you using nix-darwin?"
-      description: |
-        [`nix-darwin`](https://github.com/nix-darwin/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
-      options:
-        - "Yes, I am using nix-darwin."
-        - "No, I am not using nix-darwin."
-      default: 1
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-
-        If this issue is related to the Darwin packaging architecture as a whole, or is related to the core Darwin frameworks, consider mentioning the `@NixOS/darwin-core` team.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs/NixOS, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+darwin%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -1,149 +0,0 @@
-name: "Bug report (NixOS module)"
-description: "Create a bug report against a NixOS Module."
-title: "nixos/MODULENAME: BUG TITLE"
-labels: ["0.kind: bug", "6.topic: nixos"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`nixos/MODULENAME: BUG TITLE`** template above with the correct module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)) and a short title summarising what the bug entails.
-
-        > [!TIP]
-        > For instance, if you were filing a bug against the [`systemd-boot`](https://search.nixos.org/options?channel=unstable&show=boot.loader.systemd-boot.enable&from=0&size=1) module about it failing to install [`memtest86`](https://search.nixos.org/options?channel=unstable&show=boot.loader.systemd-boot.memtest86.enable&from=0&size=1), your title would be as follows:
-        > ```
-        > nixos/systemd-boot: fails to install memtest86
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
-      options:
-        - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the bug"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "expected-behaviour"
-    attributes:
-      label: "Expected behaviour"
-      description: "Please write a concise description of what was supposed to happen."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "screenshots"
-    attributes:
-      label: "Screenshots"
-      description: |
-        If applicable, add screenshots to help explain your problem.
-        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        If applicable, copy and paste any relevant log output.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the `meta.maintainers` list of the offending module. This is done by prefixing the person's username with an '@' character. You can quickly go to the source code of a module by searching for it on the [NixOS Option Search](https://search.nixos.org/options) and clicking the "Declared in..." button.
-
-        Please note that the maintainer attribute name does not always match the maintainer's GitHub username. If that occurs, try looking in [`maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix) for the maintainer attribute name, and checking if the maintainer has a listed GitHub username.
-
-        If in doubt, check the associated package's maintainers. Please add the mentions above the `---` characters.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+nixos%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -1,155 +0,0 @@
-name: "Build failure"
-description: "Report a package that is failing to build."
-title: "Build failure: PACKAGENAME"
-labels: ["0.kind: build failure"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Build failure: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
-
-        > [!TIP]
-        > For instance, if you were filing a build failure against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package, your title would be as follows:
-        > ```
-        > Build failure: hello
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        In what version of Nixpkgs did the build failure occur?
-
-        If you are using an older version, please update to the latest stable version and check if the build failure persists before continuing this report.
-
-        If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
-      options:
-        - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: "Please include a step-by-step guide for reproducing this build failure. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
-    validations:
-      required: true
-  - type: "dropdown"
-    id: "hydra"
-    attributes:
-      label: "Can Hydra reproduce this build failure?"
-      description: |
-        Can [Hydra](https://hydra.nixos.org), Nixpkgs' Continuous Integration system, reproduce this build failure?
-        Please use the search function in the header bar to locate the last build job for the package in question.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
-          You can still open a build failure report, but please say '**No, Hydra cannot reproduce this build failure.**' below.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
-        - If Hydra isn't supposed to build the package at all, say '**Hydra doesn’t try to build the package.**'
-      options:
-        - "Please select the Hydra Status."
-        - "Yes, Hydra can reproduce this build failure."
-        - "No, Hydra cannot reproduce this build failure."
-        - "Hydra is currently rebuilding this package."
-        - "The last build job was manually cancelled."
-        - "Hydra doesn’t try to build the package."
-      default: 0
-    validations:
-      required: true
-  - type: "input"
-    id: "hydra-logs"
-    attributes:
-      label: "Link to Hydra build job"
-      description: "If you answered 'yes' in the question above, please copy-and-paste the link to the failing Hydra job here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Relevant log output"
-      description: |
-        Please copy and paste the logs from the failed build.
-        This will be automatically formatted into code, so no need for backticks.
-      render: "console"
-    validations:
-      required: true
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "metadata"
-    attributes:
-      label: "System metadata"
-      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      description: |
-        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
-      options:
-        - label: "I assert that this is a bug and not a support request."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%220.kind%3A+build+failure%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -1,128 +0,0 @@
-name: "Request: package update"
-description: "Create an update request for an existing, but outdated package."
-title: "Update Request: PACKAGENAME OLDVERSION → NEWVERSION"
-labels: ["0.kind: enhancement", "9.needs: package (update)"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Update Request: PACKAGENAME OLDVERSION → NEWVERSION`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)), the current version of the package, and the latest version of the package.
-
-        > [!TIP]
-        > For instance, if you were filing a request against the out of date `hello` package, where the current version in Nixpkgs is 1.0.0, but the latest version upstream is 1.0.1, your title would be as follows:
-        > ```
-        > Update Request: hello 1.0.0 → 1.0.1
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older or stable version, please update to the latest **unstable** version and check if the package is still out of date.
-
-        If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
-      options:
-        - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "input"
-    id: "name"
-    attributes:
-      label: "Package name"
-      description: "Please indicate the name of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "upstream-version"
-    attributes:
-      label: "Upstream version"
-      description: "Please indicate the latest version of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "nixpkgs-version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        Please indicate the current version number in Nixpkgs' **unstable** channel. You can check this by setting the [NixOS Package Search](https://search.nixos.org/packages?channel=unstable) channel to 'unstable' and searching for the package.
-        If you meant to request an upgrade in the stable channel, please file the '**Request: backport to stable**' form instead.
-    validations:
-      required: true
-  - type: "input"
-    id: "changelog"
-    attributes:
-      label: "Changelog"
-      description: "If applicable, please link the upstream changelog for the latest version."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the update here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this package update does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+package+%28update%29%22) or in [Nixpkgs Unstable](https://search.nixos.org/packages?channel=unstable)."
-          required: true
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%229.needs%3A+package+%28update%29%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -1,103 +0,0 @@
-name: "Request: NixOS module"
-description: "Create a new NixOS Module request for an existing package."
-title: "Module Request: nixos/MODULENAME"
-labels: ["0.kind: enhancement", "6.topic: nixos", "9.needs: module (new)"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Module Request: nixos/MODULENAME`** template above with the correct module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)).
-
-        > [!TIP]
-        > For instance, if you were filing a request against the missing `hello` module, your title would be as follows:
-        > ```
-        > Module Request: nixos/hello
-        > ```
-
-        ---
-  - type: "dropdown"
-    id: "version"
-    attributes:
-      label: "Nixpkgs version"
-      description: |
-        What version of Nixpkgs are you using?
-
-        If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
-      options:
-        - "Please select a version."
-        - "- Unstable (26.11)"
-        - "- Stable (26.05)"
-      default: 0
-    validations:
-      required: true
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the proposed module"
-      description: "Please include a clear and concise description of what the module should accomplish."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the proposed module here."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this module does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+module+%28new%29%22) or in [NixOS Unstable](https://search.nixos.org/options?channel=unstable)."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%229.needs%3A+module+%28new%29%22). "
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve NixOS!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/07_backport_request.yml

@@ -1,109 +0,0 @@
-name: "Request: backport to stable"
-description: "Create a backport request for a package that is up-to-date in the unstable channel, but outdated in the stable channel."
-title: "Backport to Stable: PACKAGENAME OLDVERSION → NEWVERSION"
-labels: ["0.kind: enhancement", "9.needs: port to stable"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        > [!CAUTION]
-        > **Before you begin:** Be advised that backports are subject to the [release suitability guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).
-        >
-        > Stable releases of Nixpkgs do not receive breaking changes, which include major package updates that have incompatible API changes and break backwards compatibility. In the [Semantic Versioning standard](https://semver.org/), this is the first version number (1.X.X).
-        >
-        > Generally, only minor package updates, such as security patches, bug fixes and feature additions (but not removals!) will be considered for backporting. Please read the rules above carefully before filing this backport request.
-
-        Welcome to Nixpkgs. Please replace the **`Backport to Stable: PACKAGENAME OLDVERSION → NEWVERSION`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)), the current version of the package in Nixpkgs Stable and the current version of the package in Nixpkgs Unstable.
-
-        > [!TIP]
-        > For instance, if you were filing a request against the out of date `hello` package, where the current version in Nixpkgs Unstable is 1.0.1, but the current version in Nixpkgs Stable is 1.0.0, your title would be as follows:
-        > ```
-        > Backport to Stable: hello 1.0.0 → 1.0.1
-        > ```
-
-        ---
-  - type: "input"
-    id: "name"
-    attributes:
-      label: "Package name"
-      description: "Please indicate the name of the package."
-    validations:
-      required: true
-  - type: "input"
-    id: "unstable-version"
-    attributes:
-      label: "Version in unstable"
-      description: "Please indicate the current version of the package in the unstable channel."
-    validations:
-      required: true
-  - type: "input"
-    id: "stable-version"
-    attributes:
-      label: "Version in stable"
-      description: "Please indicate the current version of the package in the stable channel."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "reasoning"
-    attributes:
-      label: "Reasoning for backport"
-      description: "Please briefly explain why this backport fits the [release suitability guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases) and why you think this update should be backported."
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this backport does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+in%3Atitle+backport)."
-          required: true
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%229.needs%3A+port+to+stable%22+)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/08_documentation_request.yml

@@ -1,91 +0,0 @@
-name: "Request: documentation"
-description: "Report missing or incorrect documentation in the NixOS or Nixpkgs manuals."
-title: "Missing Documentation: PACKAGENAME"
-labels: ["0.kind: enhancement", "9.needs: documentation"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Missing Documentation: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) or module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)).
-
-        > [!TIP]
-        > For instance, if you were filing an issue against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it not having any NixOS-specific documentation, your title would be as follows:
-        > ```
-        > Missing Documentation: hello
-        > ```
-
-        ---
-  - type: "textarea"
-    id: "description"
-    attributes:
-      label: "Describe the problem"
-      description: "Please include a clear and concise description of what the issue is."
-    validations:
-      required: true
-  - type: "textarea"
-    id: "proposal"
-    attributes:
-      label: "Proposed solution"
-      description: |
-        If possible, please draft a tentative documentation chapter to resolve this issue.
-        Your proposal should be written in CommonMark Markdown, optionally enhanced with [Nix-specific extensions](https://github.com/NixOS/nixpkgs/tree/master/doc#syntax).
-      render: "markdown"
-    validations:
-      required: false
-  - type: "textarea"
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this request is not already implemented in the latest [NixOS](https://nixos.org/manual/nixos/unstable/) or [Nixpkgs](https://nixos.org/manual/nixpkgs/unstable/) manuals."
-          required: true
-        - label: "I assert that this is not a [duplicate of an existing documentation issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%229.needs%3A+documentation%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "priorisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/09_unreproducible_package.yml

@@ -1,161 +0,0 @@
-name: "Unreproducible Package"
-description: "Report a package that does not produce a bit-by-bit reproducible result each time it is built."
-title: "Unreproducible Package: PACKAGENAME"
-labels: ["0.kind: enhancement", "6.topic: reproducible builds"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Welcome to Nixpkgs. Please replace the **`Unreproducible Package: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
-
-        > [!NOTE]
-        > This form is for reporting unreproducible packages. For more information, see the [Reproducible Builds Status](https://reproducible.nixos.org/) page.
-        >
-        > To report a package that fails to build entirely, please use the "Build Failure" form instead.
-
-        ---
-  - type: "input"
-    id: "version"
-    attributes:
-      label: "Nixpkgs Revision"
-      description: "In which commit of Nixpkgs is this package displaying unreproducibility?"
-  - type: "textarea"
-    id: "introduction"
-    attributes:
-      label: "Introduction"
-      description: |
-        This is a generic introduction to build reproducibility.
-        Please replace **PACKAGENAME** below with the canonical package name of the package, as you have done for the title above.
-      value: |
-        Building **PACKAGENAME** multiple times does not yield bit-by-bit identical
-        results, complicating the detection of Continuous Integration (CI) breaches. For
-        more information on this issue, visit [reproducible-builds.org](https://reproducible-builds.org/).
-
-        Fixing bit-by-bit reproducibility also has additional advantages, such as
-        avoiding hard-to-reproduce bugs, making content-addressed storage more effective
-        and reducing rebuilds in such systems.
-    validations:
-      required: true
-  - type: "textarea"
-    id: "how-to-reproduce"
-    attributes:
-      label: "Steps to reproduce"
-      description: |
-        This is a step-by-step instruction set meant for maintainers to debug the package that is failing to reproduce. You should also follow it to gather the `diffoscope` logs that will be needed below.
-        Please replace **PACKAGENAME** below with the canonical package name of the package, as you have done for the introduction and the title above.
-      value: |
-        ### 1. Build the package
-
-        This step will build the package. Specific arguments are passed to the command
-        to keep the build artifacts so we can compare them in case of differences.
-
-        Execute the following command:
-
-        ```
-        nix-build '<nixpkgs>' -A PACKAGENAME && nix-build '<nixpkgs>' -A PACKAGENAME --check --keep-failed
-        ```
-
-        Or using the new command line style:
-
-        ```
-        nix build nixpkgs#PACKAGENAME && nix build nixpkgs#PACKAGENAME --rebuild --keep-failed
-        ```
-
-        ### 2. Compare the build artifacts
-
-        If the previous command completes successfully, no differences were found and
-        there's nothing to do, builds are reproducible.
-        If it terminates with the error message `error: derivation '<X>' may not be
-        deterministic: output '<Y>' differs from '<Z>'`, use `diffoscope` to investigate
-        the discrepancies between the two build outputs. You may need to add the
-        `--exclude-directory-metadata recursive` option to ignore files and directories
-        metadata (*e.g. timestamp*) differences.
-
-        ```
-        nix run nixpkgs#diffoscopeMinimal -- --exclude-directory-metadata recursive <Y> <Z>
-        ```
-
-        ### 3. Examine the build log
-
-        To examine the build log, use:
-
-        ```
-        nix-store --read-log $(nix-instantiate '<nixpkgs>' -A PACKAGENAME)
-        ```
-
-        Or with the new command line style:
-
-        ```
-        nix log $(nix path-info --derivation nixpkgs#PACKAGENAME)
-        ```
-    validations:
-      required: true
-  - type: "textarea"
-    id: "logs"
-    attributes:
-      label: "Diffoscope log"
-      description: |
-        Please copy and paste the relevant `diffoscope` log output, gathered from the steps above.
-        This will be automatically formatted into a monospaced text block, so no need for backticks.
-      render: "console"
-  - type: "textarea"
-    id: "additional-context"
-    attributes:
-      label: "Additional context"
-      description: "Add any other context about the problem here."
-    validations:
-      required: false
-    id: "maintainers"
-    attributes:
-      label: "Notify maintainers"
-      description: |
-        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |2
-
-
-        ---
-
-        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
-    validations:
-      required: false
-  - type: "checkboxes"
-    id: "sanity-check"
-    attributes:
-      label: "I assert that this issue is relevant for Nixpkgs"
-      options:
-        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+label%3A%226.topic%3A+reproducible+builds%22)."
-          required: true
-        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
-          required: true
-        - label: "I assert that I have read the [automation/AI policy](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy) and that this issue report complies with it."
-          required: true
-  - type: "markdown"
-    attributes:
-      value: |
-        # Thank you for helping improve Nixpkgs!
-
-        ---
-  - type: "textarea"
-    id: "prioritisation"
-    attributes:
-      label: "Is this issue important to you?"
-      description: |
-        **Please do not modify this text area!**
-
-        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
-        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
-      value: |
-        Add a :+1: [reaction] to [issues you find important].
-
-        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
-        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/10_package_request.yml

@@ -1,36 +0,0 @@
-name: "Request: Nix Package"
-description: "Package requests are no longer accepted. Please open a Pull Request with your desired package instead."
-title: "Package Request"
-labels: ["0.kind: packaging request", "4.workflow: auto-close"]
-body:
-  - type: "markdown"
-    attributes:
-      value: |
-        <p align="center">
-          <a href="https://nixos.org">
-            <picture>
-              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
-              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
-              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
-            </picture>
-          </a>
-        </p>
-
-        Thank you for your interest in packaging new software in Nixpkgs. Unfortunately, to mitigate the unsustainable growth of unmaintained packages, **Nixpkgs is no longer accepting package requests** via Issues.
-
-        As a [volunteer community][community], we are always open to new contributors. If you wish to see this package in Nixpkgs, **we encourage you to [contribute] it yourself**, via a Pull Request. Anyone can [become a package maintainer][maintainers]! You can find language-specific packaging information in the [Nixpkgs Manual][nixpkgs]. Should you need any help, please reach out to the community on [Matrix] or [Discourse].
-
-        [community]: https://nixos.org/community
-        [contribute]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#quick-start-to-adding-a-package
-        [maintainers]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
-        [nixpkgs]: https://nixos.org/manual/nixpkgs/unstable/
-        [Matrix]: https://matrix.to/#/#dev:nixos.org
-        [Discourse]: https://discourse.nixos.org/c/dev/14
-
-        ---
-  - type: "checkboxes"
-    id: "ignored"
-    attributes:
-      label: "Issues for new package requests are not accepted. Please open a Pull Request instead."
-      options:
-        - label: "I didn't read any of that."

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,43 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: '0.kind: bug'
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. ...
+2. ...
+3. ...
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Additional context**
+Add any other context about the problem here.
+
+**Notify maintainers**
+<!--
+Please @ people who are in the `meta.maintainers` list of the offending package or module.
+If in doubt, check `git blame` for whoever last touched something.
+-->
+
+**Metadata**
+Please run `nix-shell -p nix-info --run "nix-info -m"` and paste the result.
+
+Maintainer information:
+```yaml
+# a list of nixpkgs attributes affected by the problem
+attribute:
+# a list of nixos modules affected by the problem
+module:
+```

.github/ISSUE_TEMPLATE/out_of_date_package_report.md

@@ -0,0 +1,48 @@
+---
+name: Out-of-date package reports
+about: For packages that are out-of-date
+title: ''
+labels: '9.needs: package (update)'
+assignees: ''
+
+---
+
+
+###### Checklist
+
+<!-- Note that these are hard requirements -->
+
+<!--
+You can use the "Go to file" functionality on github to find the package
+Then you can go to the history for this package
+Find the latest "package_name: old_version -> new_version" commit
+The "new_version" is the the current version of the package
+-->
+- [ ] Checked the [nixpkgs master branch](https://github.com/NixOS/nixpkgs)
+<!--
+Type the name of your package and try to find an open pull request for the package
+If you find an open pull request, you can review it!
+There's a high chance that you'll have the new version right away while helping the community!
+-->
+- [ ] Checked the [nixpkgs pull requests](https://github.com/NixOS/nixpkgs/pulls)
+
+###### Project name
+`nix search` name:
+<!--
+The current version can be found easily with the same process than above for checking the master branch
+If an open PR is present for the package, take this version as the current one and link to the PR
+-->
+current version:
+desired version:
+
+###### Notify maintainers
+<!--
+Search your package here: https://search.nixos.org/packages?channel=unstable
+If no maintainer is listed for your package, tag the person that last updated the package
+-->
+
+maintainers:
+
+###### Note for maintainers
+
+Please tag this issue in your PR.

.github/ISSUE_TEMPLATE/packaging_request.md

@@ -0,0 +1,18 @@
+---
+name: Packaging requests
+about: For packages that are missing
+title: ''
+labels: '0.kind: packaging request'
+assignees: ''
+
+---
+
+**Project description**
+_describe the project a little_
+
+**Metadata**
+
+* homepage URL:
+* source URL:
+* license: mit, bsd, gpl2+ , ...
+* platforms: unix, linux, darwin, ...

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,42 +1,27 @@
-
 <!--
-^ Please summarise the changes you have done and explain why they are necessary here ^
-
-For package updates please link to a changelog or describe changes, this helps your fellow maintainers discover breaking updates.
-For new packages please briefly describe the package or provide a link to its homepage.
+To help with the large amounts of pull requests, we would appreciate your
+reviews of other pull requests, especially simple package updates. Just leave a
+comment describing what you have tested in the relevant package/service.
+Reviewing helps to reduce the average time-to-merge for everyone.
+Thanks a lot if you do!
+List of open PRs: https://github.com/NixOS/nixpkgs/pulls
+Reviewing guidelines: https://nixos.org/manual/nixpkgs/unstable/#chap-reviewing-contributions
 -->
 
-## Things done
+###### Motivation for this change
+
+
+###### Things done
 
 <!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->
 
-- Built on platform:
-  - [ ] x86_64-linux
-  - [ ] aarch64-linux
-  - [ ] x86_64-darwin
-  - [ ] aarch64-darwin
-- Tested, as applicable:
-  - [ ] [NixOS tests] in [nixos/tests].
-  - [ ] [Package tests] at `passthru.tests`.
-  - [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
-- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
-- [ ] Tested basic functionality of all binary files, usually in `./result/bin/`.
-- Nixpkgs Release Notes
-  - [ ] Package update: when the change is major or breaking.
-- NixOS Release Notes
-  - [ ] Module addition: when adding a new NixOS module.
-  - [ ] Module update: when the change is significant.
-- [ ] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
-- [ ] Follows the [automation/AI policy].
-
-[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
-[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
-[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
-
-[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
-[automation/AI policy]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#automationai-policy
-[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
-[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
-[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
-[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
-[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
+- [ ] Tested using sandboxing ([nix.useSandbox](https://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](https://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
+- Built on platform(s)
+   - [ ] NixOS
+   - [ ] macOS
+   - [ ] other Linux distributions
+- [ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
+- [ ] Tested compilation of all pkgs that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review wip"`
+- [ ] Tested execution of all binary files (usually in `./result/bin/`)
+- [ ] Added a release notes entry if the change is major or breaking
+- [ ] Fits [CONTRIBUTING.md](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).

.github/STALE-BOT.md

@@ -1,10 +1,9 @@
 # Stale bot information
 
 - Thanks for your contribution!
-- Our stale bot will never close an issue or PR.
 - To remove the stale label, just leave a new comment.
 - _How to find the right people to ping?_ → [`git blame`](https://git-scm.com/docs/git-blame) to the rescue! (or GitHub's history and blame buttons.)
-- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/), [our Matrix room](https://matrix.to/#/#nix:nixos.org), or on the [#nixos IRC channel](https://web.libera.chat/#nixos).
+- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/) or on the [#nixos IRC channel](https://webchat.freenode.net/#nixos).
 
 ## Suggestions for PRs
 

.github/actions/checkout/action.yml

@@ -1,136 +0,0 @@
-name: Checkout
-
-description: 'Checkout into trusted / untrusted / pinned folders consistently.'
-
-inputs:
-  merged-as-untrusted-at:
-    description: "Whether and which SHA to checkout for the merge commit in the ./nixpkgs/untrusted folder."
-  target-as-trusted-at:
-    description: "Whether and which SHA to checkout for the target commit in the ./nixpkgs/trusted folder."
-  untrusted-pin-bump:
-    description: "Commit that bumps ci/pinned.json; when set, ./nixpkgs/untrusted and ./nixpkgs/untrusted-pinned are derived from this commit."
-
-runs:
-  using: composite
-  steps:
-    - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-      env:
-        MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
-        TARGET_SHA: ${{ inputs.target-as-trusted-at }}
-        PIN_BUMP_SHA: ${{ inputs.untrusted-pin-bump }}
-      with:
-        script: |
-          const { rm, writeFile } = require('node:fs/promises')
-          const { spawn } = require('node:child_process')
-          const { join } = require('node:path')
-
-          async function run(cmd, ...args) {
-            return new Promise((resolve, reject) => {
-              const proc = spawn(cmd, args, {
-                stdio: 'inherit'
-              })
-              proc.on('close', (code) => {
-                if (code === 0) resolve()
-                else reject(code)
-              })
-            })
-          }
-
-          // These are set automatically by the spare checkout for .github/actions.
-          // Undo them, otherwise git fetch below will not do anything.
-          await run('git', 'config', 'unset', 'remote.origin.promisor')
-          await run('git', 'config', 'unset', 'remote.origin.partialclonefilter')
-
-          // Getting the pinned SHA via API allows us to do one single fetch call for all commits.
-          // Otherwise we would have to fetch merged/target first, read pinned, fetch again.
-          // A single fetch call comes with a lot less overhead. The fetch takes essentially the
-          // same time no matter whether its 1, 2 or 3 commits at once.
-          async function getPinnedSha(ref) {
-            if (!ref) return undefined
-            const { content, encoding } = (await github.rest.repos.getContent({
-              ...context.repo,
-              path: 'ci/pinned.json',
-              ref,
-            })).data
-            const pinned = JSON.parse(Buffer.from(content, encoding).toString())
-            return pinned.pins.nixpkgs.revision
-          }
-
-          // Getting the pin-bump diff via the API avoids issues with `git fetch`
-          // thin-packs not having enough base objects to be applied locally.
-          // Returns a unified diff suitable for `git apply`.
-          async function getPinBumpDiff(ref) {
-            const { data } = await github.rest.repos.getCommit({
-              mediaType: { format: 'diff' },
-              ...context.repo,
-              ref,
-            })
-            return data
-          }
-
-          const pin_bump_sha = process.env.PIN_BUMP_SHA
-
-          const commits = [
-            {
-              sha: process.env.MERGED_SHA,
-              path: 'untrusted',
-            },
-            {
-              sha: await getPinnedSha(pin_bump_sha || process.env.MERGED_SHA),
-              path: 'untrusted-pinned'
-            },
-            {
-              sha: process.env.TARGET_SHA,
-              path: 'trusted',
-            },
-            {
-              sha: await getPinnedSha(process.env.TARGET_SHA),
-              path: 'trusted-pinned'
-            }
-          ].filter(({ sha }) => Boolean(sha))
-
-          console.log('Checking out the following commits:', commits)
-
-          // Fetching all commits at once is much faster than doing multiple checkouts.
-          // This would fail without --refetch, because the we had a partial clone before, but changed it above.
-          await run('git', 'fetch', '--depth=1', '--refetch', 'origin', ...(commits.map(({ sha }) => sha)))
-
-          // On Linux, checking out onto tmpfs takes 1s and is faster by at least 10x.
-          // Currently, on Darwin we can only allocate 3.5GB, which isn't enough.
-          // See https://github.com/NixOS/nixpkgs/pull/506437
-          await run('mkdir', 'nixpkgs')
-          if (process.env.RUNNER_OS === 'Linux') {
-            await run('sudo', 'mount', '-t', 'tmpfs', 'tmpfs', 'nixpkgs')
-          }
-
-          // Git worktree setup can race when multiple worktrees are created and
-          // initialized at the same time against one repository. See #511286.
-          // Keep the setup sequential so shared repo config updates cannot contend.
-          for (const { sha, path } of commits) {
-            await run('git', 'worktree', 'add', join('nixpkgs', path), sha, '--no-checkout')
-            await run('git', '-C', join('nixpkgs', path), 'sparse-checkout', 'disable')
-            await run('git', '-C', join('nixpkgs', path), 'checkout', '--progress')
-          }
-
-          // Apply pin bump to untrusted worktree
-          if (pin_bump_sha) {
-            console.log('Fetching ci/pinned.json bump commit:', pin_bump_sha)
-            await writeFile('pin-bump.patch', await getPinBumpDiff(pin_bump_sha))
-
-            console.log('Applying untrusted ci/pinned.json bump to ./nixpkgs/untrusted')
-            try {
-              await run('git', '-C', join('nixpkgs', 'untrusted'), 'apply', '--3way', join('..', '..', 'pin-bump.patch'))
-            } catch {
-              core.setFailed([
-                `Failed to apply ci/pinned.json bump commit ${pin_bump_sha}.`,
-                `This commit does not apply cleanly onto the untrusted base ${process.env.MERGED_SHA}.`,
-                `Please rebase the PR or ensure the pin bump is standalone.`
-              ].join(' '))
-              return
-            } finally {
-              await rm('pin-bump.patch')
-            }
-          }
-
-          console.log('final disk usage:')
-          await run('df', '-h')

.github/dependabot.yml

@@ -1,9 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    labels: []
-    commit-message:
-      prefix: ".github"

.github/labeler-development-branches.yml

@@ -1,23 +0,0 @@
-# This file is used by .github/workflows/bot.yml
-# This version is only run for Pull Requests from development branches like staging-next, haskell-updates or python-updates.
-
-"4.workflow: package set update":
-  - any:
-      - head-branch:
-          - '-updates$'
-
-"4.workflow: staging":
-  - any:
-      - head-branch:
-          - '^staging-next$'
-          - '^staging-next-'
-
-"6.topic: haskell":
-  - any:
-      - head-branch:
-          - '^haskell-updates$'
-
-"6.topic: python":
-  - any:
-      - head-branch:
-          - '^python-updates$'

.github/labeler-no-sync.yml

@@ -1,47 +0,0 @@
-# This file is used by .github/workflows/bot.yml
-# This version uses `sync-labels: false`, meaning that a non-match will NOT remove the label
-
-# keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
-
-"6.topic: policy discussion":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/**/*
-              - CONTRIBUTING.md
-              - pkgs/README.md
-              - nixos/README.md
-              - maintainers/README.md
-              - lib/README.md
-              - doc/README.md
-
-"8.has: documentation":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/**/*
-              - nixos/doc/**/*
-
-"backport release-25.11":
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/actions/**/*
-              - .github/workflows/*
-              - .github/labeler*.yml
-              - ci/**/*.*
-              - maintainers/github-teams.json
-      - base-branch: ['master']
-
-"backport release-26.05":
-  - all:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/actions/**/*
-              - .github/workflows/*
-              - .github/labeler*.yml
-              - ci/**/*.*
-              - maintainers/github-teams.json
-      - base-branch: ['master']
-
-# keep-sorted end

.github/labeler.yml

@@ -1,641 +1,154 @@
-# This file is used by .github/workflows/bot.yml
-# This version uses `sync-labels: true`, meaning that a non-match will remove the label
-
-# keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
-
-"4.workflow: backport":
-  - any:
-      - base-branch:
-          - '^release-'
-          - '^staging-\d'
-          - '^staging-next-\d'
-          - '^staging-nixos-\d'
-
-# NOTE: bsd, darwin and cross-compilation labels are handled by ofborg
 "6.topic: agda":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/agda.section.md
-              - nixos/tests/agda.nix
-              - pkgs/build-support/agda/**/*
-              - pkgs/development/libraries/agda/**/*
-              - pkgs/top-level/agda-packages.nix
+  - doc/languages-frameworks/agda.section.md
+  - nixos/tests/agda.nix
+  - pkgs/build-support/agda/**/*
+  - pkgs/development/libraries/agda/**/*
+  - pkgs/top-level/agda-packages.nix
+
+"6.topic: bsd":
+  - pkgs/os-specific/bsd/**/*
+  - pkgs/stdenv/freebsd/**/*
 
 "6.topic: cinnamon":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/cinnamon.nix
-              - nixos/tests/cinnamon.nix
-              - nixos/tests/cinnamon-wayland.nix
-              - pkgs/by-name/ci/cinnamon/**/*
-              - pkgs/by-name/ci/cinnamon-*/**/*
-              - pkgs/by-name/cj/cjs/**/*
-              - pkgs/by-name/mu/muffin/**/*
-              - pkgs/by-name/ne/nemo/**/*
-              - pkgs/by-name/ne/nemo-*/**/*
-
-"6.topic: continuous integration":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - .github/**/*
-              - ci/**/*.*
-
-"6.topic: coq":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/science/logic/coq/**/*
-              - pkgs/development/coq-modules/**/*
-              - pkgs/top-level/coq-packages.nix
-
-"6.topic: COSMIC":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/desktop-managers/cosmic.nix
-              - nixos/modules/services/display-managers/cosmic-greeter.nix
-              - nixos/tests/cosmic.nix
-              - pkgs/by-name/co/cosmic-*/**/*
-              - pkgs/by-name/li/libcosmicAppHook/*
-              - pkgs/by-name/po/pop-launcher/*
-              - pkgs/by-name/xd/xdg-desktop-portal-cosmic/*
-
-"6.topic: crystal":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/compilers/crystal/**/*
-
-"6.topic: cuda":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/cuda-modules/**/*
-              - pkgs/top-level/cuda-packages.nix
-
-"6.topic: deepin":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/desktops/deepin/**/*
-              - pkgs/desktops/deepin/**/*
-
-"6.topic: docker tools":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/virtualization/docker/**/*
-
-"6.topic: dotnet":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/dotnet.section.md
-              - maintainers/scripts/update-dotnet-lockfiles.nix
-              - pkgs/build-support/dotnet/**/*
-              - pkgs/development/compilers/dotnet/**/*
-              - pkgs/test/dotnet/**/*
-              - pkgs/top-level/dotnet-packages.nix
+  - pkgs/desktops/cinnamon/**/*
 
 "6.topic: emacs":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/editors/emacs.nix
-              - nixos/modules/services/editors/emacs.xml
-              - nixos/tests/emacs-daemon.nix
-              - pkgs/applications/editors/emacs/build-support/**/*
-              - pkgs/applications/editors/emacs/elisp-packages/**/*
-              - pkgs/applications/editors/emacs/**/*
-              - pkgs/top-level/emacs-packages.nix
-
-"6.topic: Enlightenment DE":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/enlightenment.nix
-              - pkgs/desktops/enlightenment/**/*
-              - pkgs/development/python-modules/python-efl/*
+  - nixos/modules/services/editors/emacs.nix
+  - nixos/modules/services/editors/emacs.xml
+  - nixos/tests/emacs-daemon.nix
+  - pkgs/applications/editors/emacs-modes/**/*
+  - pkgs/applications/editors/emacs/**/*
+  - pkgs/build-support/emacs/**/*
+  - pkgs/top-level/emacs-packages.nix
 
 "6.topic: erlang":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/beam.section.md
-              - pkgs/development/beam-modules/**/*
-              - pkgs/development/interpreters/elixir/**/*
-              - pkgs/development/interpreters/erlang/**/*
-              - pkgs/development/tools/build-managers/rebar/**/*
-              - pkgs/development/tools/build-managers/rebar3/**/*
-              - pkgs/development/tools/erlang/**/*
-              - pkgs/top-level/beam-packages.nix
+  - doc/languages-frameworks/beam.section.md
+  - pkgs/development/beam-modules/**/*
+  - pkgs/development/interpreters/elixir/**/*
+  - pkgs/development/interpreters/erlang/**/*
+  - pkgs/development/tools/build-managers/rebar/**/*
+  - pkgs/development/tools/build-managers/rebar3/**/*
+  - pkgs/development/tools/erlang/**/*
+  - pkgs/top-level/beam-packages.nix
 
 "6.topic: fetch":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/build-support/fetch*/**/*
-
-"6.topic: flakes":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - '**/flake.nix'
-              - lib/systems/flake-systems.nix
-              - nixos/modules/config/nix-flakes.nix
-
-"6.topic: flutter":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/build-support/flutter/*.nix
-              - pkgs/development/compilers/flutter/**/*.nix
-
-"6.topic: games":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/games/**/*
+  - pkgs/build-support/fetch*/**/*
 
 "6.topic: GNOME":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/gnome.section.md
-              - nixos/modules/services/desktops/gnome/**/*
-              - nixos/modules/services/desktop-managers/gnome.nix
-              - nixos/tests/gnome-xorg.nix
-              - nixos/tests/gnome.nix
-              - pkgs/desktops/gnome/**/*
+  - doc/languages-frameworks/gnome.section.md
+  - nixos/modules/services/desktops/gnome/**/*
+  - nixos/modules/services/x11/desktop-managers/gnome.nix
+  - nixos/tests/gnome-xorg.nix
+  - nixos/tests/gnome.nix
+  - pkgs/desktops/gnome/**/*
 
 "6.topic: golang":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/go.section.md
-              - pkgs/build-support/go/**/*
-              - pkgs/development/compilers/go/**/*
-
-"6.topic: hardware":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/hardware/**/*
+  - doc/languages-frameworks/go.section.md
+  - pkgs/development/compilers/go/**/*
+  - pkgs/development/go-modules/**/*
+  - pkgs/development/go-packages/**/*
 
 "6.topic: haskell":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/haskell.section.md
-              - maintainers/scripts/haskell/**/*
-              - pkgs/development/compilers/ghc/**/*
-              - pkgs/development/haskell-modules/**/*
-              - pkgs/development/tools/haskell/**/*
-              - pkgs/test/haskell/**/*
-              - pkgs/top-level/haskell-packages.nix
-              - pkgs/top-level/release-haskell.nix
-
-"6.topic: java":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              # Distributions
-              - pkgs/development/compilers/adoptopenjdk-icedtea-web/**/*
-              - pkgs/development/compilers/corretto/**/*
-              - pkgs/development/compilers/graalvm/**/*
-              - pkgs/development/compilers/openjdk/**/*
-              - pkgs/by-name/op/openjfx/**/*
-              - pkgs/development/compilers/semeru-bin/**/*
-              - pkgs/development/compilers/temurin-bin/**/*
-              - pkgs/development/compilers/zulu/**/*
-              # Documentation
-              - doc/languages-frameworks/java.section.md
-              # Gradle
-              - doc/languages-frameworks/gradle.section.md
-              - pkgs/development/tools/build-managers/gradle/**/*
-              - pkgs/by-name/gr/gradle-completion/**/*
-              # Maven
-              - pkgs/by-name/ma/maven/**/*
-              - doc/languages-frameworks/maven.section.md
-              # Ant
-              - pkgs/by-name/an/ant/**/*
-              # javaPackages attrset
-              - pkgs/development/java-modules/**/*
-              - pkgs/top-level/java-packages.nix
-              # Maintainer tooling
-              - pkgs/by-name/ni/nixpkgs-openjdk-updater/**/*
-              # Misc
-              - nixos/modules/programs/java.nix
-
-"6.topic: jitsi":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/networking/jitsi-videobridge.nix
-              - nixos/modules/services/web-apps/jitsi-meet.nix
-              - pkgs/servers/web-apps/jitsi-meet/**/*
-              - pkgs/servers/jitsi-videobridge/**/*
-              - pkgs/applications/networking/instant-messengers/jitsi/**/*
-
-"6.topic: julia":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/julia.section.md
-              - pkgs/development/compilers/julia/**/*
-              - pkgs/development/julia-modules/**/*
-
-"6.topic: jupyter":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/python-modules/jupyter*/**/*
-              - pkgs/development/python-modules/mkdocs-jupyter/*
-              - nixos/modules/services/development/jupyter/**/*
-              - pkgs/applications/editors/jupyter-kernels/**/*
-              - pkgs/applications/editors/jupyter/**/*
-
-"6.topic: k3s":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/cluster/rancher/default.nix
-              - nixos/modules/services/cluster/rancher/k3s.nix
-              - nixos/tests/rancher/**/*
-              - pkgs/applications/networking/cluster/k3s/**/*
+  - doc/languages-frameworks/haskell.section.md
+  - maintainers/scripts/haskell/**/*
+  - pkgs/development/compilers/ghc/**/*
+  - pkgs/development/haskell-modules/**/*
+  - pkgs/development/tools/haskell/**/*
+  - pkgs/test/haskell/**/*
+  - pkgs/top-level/haskell-packages.nix
+  - pkgs/top-level/release-haskell.nix
 
 "6.topic: kernel":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/packages/linux.section.md
-              - lib/kernel.nix
-              - nixos/doc/manual/configuration/linux-kernel.chapter.md
-              - nixos/modules/system/boot/kernel.nix
-              - nixos/tests/kernel-generic/**/*
-              - pkgs/build-support/kernel/**/*
-              - pkgs/os-specific/linux/kernel/**/*
-              - pkgs/top-level/linux-kernels.nix
-
-"6.topic: lib":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - lib/**
-
-"6.topic: llvm/clang":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/compilers/llvm/**/*
+  - pkgs/build-support/kernel/**/*
+  - pkgs/os-specific/linux/kernel/**/*
 
 "6.topic: lua":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/tools/misc/luarocks/*
-              - pkgs/development/interpreters/lua-5/**/*
-              - pkgs/development/interpreters/luajit/**/*
-              - pkgs/development/lua-modules/**/*
-              - pkgs/top-level/lua-packages.nix
-
-"6.topic: Lumina DE":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/lumina.nix
-              - pkgs/desktops/lumina/**/*
-
-"6.topic: LXQt":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/lxqt.nix
-              - pkgs/desktops/lxqt/**/*
-
-"6.topic: mate":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/x11/desktop-managers/mate.nix
-              - nixos/tests/mate.nix
-              - pkgs/desktops/mate/**/*
-              - pkgs/by-name/ca/caja/**/*
-              - pkgs/by-name/ca/caja-*/**/*
-              - pkgs/by-name/li/libmatekbd/**/*
-              - pkgs/by-name/li/libmatemixer/**/*
-              - pkgs/by-name/li/libmateweather/**/*
-              - pkgs/by-name/ma/marco/**/*
-              - pkgs/by-name/ma/mate-*/**/*
-
-"6.topic: module system":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - lib/modules.nix
-              - lib/types.nix
-              - lib/options.nix
-              - lib/tests/modules.sh
-              - lib/tests/modules/**
-
-"6.topic: musl":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/os-specific/linux/musl/**/*
-              - pkgs/by-name/mu/musl/**/*
-
-"6.topic: nim":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/nim.section.md
-              - pkgs/build-support/build-nim-package.nix
-              - pkgs/build-support/build-nim-sbom.nix
-              - pkgs/by-name/ni/nim*
-              - pkgs/top-level/nim-overrides.nix
+  - pkgs/development/interpreters/lua-5/**/*
+  - pkgs/development/interpreters/luajit/**/*
+  - pkgs/development/lua-modules/**/*
+  - pkgs/top-level/lua-packages.nix
 
 "6.topic: nixos":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/**/*
-              - pkgs/by-name/sw/switch-to-configuration-ng/**/*
-              - pkgs/by-name/ni/nixos-rebuild-ng/**/*
-              - pkgs/os-specific/linux/nixos-rebuild/**/*
-
-"6.topic: nixos-container":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/virtualisation/nixos-containers.nix
-              - pkgs/tools/virtualization/nixos-container/**/*
-
-"6.topic: nodejs":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/javascript.section.md
-              - pkgs/build-support/node/**/*
-              - pkgs/development/node-packages/**/*
-              - pkgs/development/tools/yarn/*
-              - pkgs/development/tools/yarn2nix-moretea/**/*
-              - pkgs/development/tools/pnpm/**/*
-              - pkgs/development/web/nodejs/*
-
-"6.topic: nvidia":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/hardware/video/nvidia.nix
-              - nixos/modules/services/hardware/nvidia-container-toolkit/**/*
-              - nixos/modules/services/hardware/nvidia-optimus.nix
-              - pkgs/os-specific/linux/nvidia-x11/**/*
+  - nixos/**/*
 
 "6.topic: ocaml":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/ocaml.section.md
-              - pkgs/development/compilers/ocaml/**/*
-              - pkgs/development/compilers/reason/**/*
-              - pkgs/development/ocaml-modules/**/*
-              - pkgs/development/tools/ocaml/**/*
-              - pkgs/top-level/ocaml-packages.nix
+  - doc/languages-frameworks/ocaml.section.md
+  - pkgs/development/compilers/ocaml/**/*
+  - pkgs/development/compilers/reason/**/*
+  - pkgs/development/ocaml-modules/**/*
+  - pkgs/development/tools/ocaml/**/*
+  - pkgs/top-level/ocaml-packages.nix
 
 "6.topic: pantheon":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/desktops/pantheon/**/*
-              - nixos/modules/services/desktop-managers/pantheon.nix
-              - nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
-              - nixos/tests/pantheon.nix
-              - pkgs/desktops/pantheon/**/*
+  - nixos/modules/services/desktops/pantheon/**/*
+  - nixos/modules/services/x11/desktop-managers/pantheon.nix
+  - nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
+  - nixos/tests/pantheon.nix
+  - pkgs/desktops/pantheon/**/*
 
-"6.topic: php":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/php.section.md
-              - nixos/tests/php/**/*
-              - pkgs/build-support/php/**/*
-              - pkgs/development/interpreters/php/**/*
-              - pkgs/development/php-packages/**/*
-              - pkgs/test/php/default.nix
-              - pkgs/top-level/php-packages.nix
+"6.topic: policy discussion":
+  - .github/**/*
 
 "6.topic: printing":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/services/printing/cupsd.nix
-              - pkgs/misc/cups/**/*
+  - nixos/modules/services/printing/cupsd.nix
+  - pkgs/misc/cups/**/*
 
 "6.topic: python":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/python.section.md
-              - pkgs/development/interpreters/python/**/*
-              - pkgs/development/python-modules/**/*
-              - pkgs/top-level/python-packages.nix
+  - doc/languages-frameworks/python.section.md
+  - pkgs/development/interpreters/python/**/*
+  - pkgs/development/python-modules/**/*
+  - pkgs/top-level/python-packages.nix
 
 "6.topic: qt/kde":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/qt.section.md
-              - nixos/modules/services/desktop-managers/plasma6.nix
-              - nixos/tests/plasma6.nix
-              - pkgs/kde/**/*
-
-"6.topic: R":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/science/math/R/**/*
-              - pkgs/development/r-modules/**/*
-
-"6.topic: rocm":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/rocm-modules/**/*
+  - doc/languages-frameworks/qt.section.md
+  - nixos/modules/services/x11/desktop-managers/plasma5.nix
+  - nixos/tests/plasma5.nix
+  - pkgs/applications/kde/**/*
+  - pkgs/desktops/plasma-5/**/*
+  - pkgs/development/libraries/kde-frameworks/**/*
+  - pkgs/development/libraries/qt-5/**/*
 
 "6.topic: ruby":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/ruby.section.md
-              - pkgs/development/interpreters/ruby/**/*
-              - pkgs/development/ruby-modules/**/*
-              - pkgs/top-level/ruby-packages.nix
+  - doc/languages-frameworks/ruby.section.md
+  - pkgs/development/interpreters/ruby/**/*
+  - pkgs/development/ruby-modules/**/*
 
 "6.topic: rust":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/rust.section.md
-              - pkgs/build-support/rust/**/*
-              - pkgs/development/compilers/rust/**/*
+  - doc/languages-frameworks/rust.section.md
+  - pkgs/build-support/rust/**/*
+  - pkgs/development/compilers/rust/**/*
 
 "6.topic: stdenv":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/stdenv/**/*
+  - pkgs/stdenv/**/*
 
 "6.topic: steam":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/games/steam/**/*
+  - pkgs/games/steam/**/*
 
 "6.topic: systemd":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/os-specific/linux/systemd/**/*
-              - nixos/modules/system/boot/systemd*/**/*
-
-"6.topic: tcl":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/tcl.section.md
-              - pkgs/development/interpreters/tcl/*
-              - pkgs/development/tcl-modules/**/*
-              - pkgs/top-level/tcl-packages.nix
-
-"6.topic: teams":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - maintainers/team-list.nix
-
-"6.topic: testing":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              # NOTE: Let's keep the scope limited to test frameworks that are
-              #       *developed in this repo*;
-              #       - not individual tests
-              #       - not packages for test frameworks
-              - pkgs/build-support/testers/**
-              - nixos/lib/testing/**
-              - nixos/lib/test-driver/**
-              - nixos/tests/nixos-test-driver/**
-              - nixos/lib/testing-python.nix # legacy
-              - nixos/tests/make-test-python.nix # legacy
-              # lib/debug.nix has a test framework (runTests) but it's not the main focus
+  - pkgs/os-specific/linux/systemd/**/*
+  - nixos/modules/system/boot/systemd*/**/*
 
 "6.topic: TeX":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/texlive.section.md
-              - pkgs/test/texlive/**
-              - pkgs/tools/typesetting/tex/**/*
-
-"6.topic: tree-sitter":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/packages/python-tree-sitter.section.md
-              - pkgs/applications/editors/emacs/elisp-packages/manual-packages/tree-sitter-langs/**/*
-              - pkgs/applications/editors/emacs/elisp-packages/manual-packages/treesit-grammars/**/*
-              - pkgs/applications/editors/vim/plugins/nvim-treesitter/**/*
-              - pkgs/by-name/*/*tree-sitter*/**/*
-              - pkgs/by-name/ne/neovim-unwrapped/treesitter-parsers.nix
-              - pkgs/development/python-modules/*tree-sitter*/**/*
-
-"6.topic: updaters":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/common-updater/**/*
+  - doc/languages-frameworks/texlive.section.md
+  - pkgs/tools/typesetting/tex/**/*
 
 "6.topic: vim":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/languages-frameworks/vim.section.md
-              - pkgs/applications/editors/vim/**/*
-              - pkgs/applications/editors/vim/plugins/**/*
-              - nixos/modules/programs/neovim.nix
-              - pkgs/applications/editors/neovim/**/*
-
-"6.topic: vscode":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/applications/editors/vscode/**/*
-
-"6.topic: windows":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/os-specific/windows/**/*
-
-"6.topic: xen-project":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/virtualisation/xen*
-              - pkgs/by-name/xe/xen/*
-              - pkgs/by-name/qe/qemu_xen/*
-              - pkgs/by-name/xe/xen-guest-agent/*
-              - pkgs/by-name/xt/xtf/*
-              - pkgs/build-support/xen/*
-              - pkgs/development/ocaml-modules/xen*/*
-              - pkgs/development/ocaml-modules/vchan/*
+  - doc/languages-frameworks/vim.section.md
+  - pkgs/applications/editors/vim/**/*
+  - pkgs/misc/vim-plugins/**/*
 
 "6.topic: xfce":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/doc/manual/configuration/xfce.xml
-              - nixos/modules/services/x11/desktop-managers/xfce.nix
-              - nixos/tests/xfce.nix
-              - pkgs/desktops/xfce/**/*
-              - pkgs/by-name/ga/garcon/**/*
-              - pkgs/by-name/li/libxfce4*/**/*
-              - pkgs/by-name/th/thunar/**/*
-              - pkgs/by-name/th/thunar-*/**/*
-              - pkgs/by-name/tu/tumbler/**/*
-              - pkgs/by-name/xf/xfce4-*/**/*
-              - pkgs/by-name/xf/xfconf/**/*
-              - pkgs/by-name/xf/xfdesktop/**/*
-              - pkgs/by-name/xf/xfwm4/**/*
-
-"6.topic: zig":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - pkgs/development/compilers/zig/**/*
-              - doc/hooks/zig.section.md
+  - nixos/doc/manual/configuration/xfce.xml
+  - nixos/modules/services/x11/desktop-managers/xfce.nix
+  - nixos/tests/xfce.nix
+  - pkgs/desktops/xfce/**/*
 
 "8.has: changelog":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - doc/release-notes/**/*
-              - nixos/doc/manual/release-notes/**/*
+  - nixos/doc/manual/release-notes/**/*
 
-"8.has: maintainer-list (update)":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - maintainers/maintainer-list.nix
+"8.has: documentation":
+  - doc/**/*
+  - nixos/doc/**/*
 
 "8.has: module (update)":
-  - any:
-      - changed-files:
-          - any-glob-to-any-file:
-              - nixos/modules/**/*
-
-# keep-sorted end
+  - nixos/modules/**/*

.github/stale.yml

@@ -0,0 +1,10 @@
+# Configuration for probot-stale - https://github.com/probot/stale
+daysUntilStale: 180
+daysUntilClose: false
+exemptLabels:
+  - "1.severity: security"
+  - "2.status: never-stale"
+staleLabel: "2.status: stale"
+markComment: |
+  I marked this as stale due to inactivity. → [More info](https://github.com/NixOS/nixpkgs/blob/master/.github/STALE-BOT.md)
+closeComment: false

.github/workflows/README.md

@@ -1,77 +0,0 @@
-# GitHub Actions Workflows
-
-Some architectural notes about key decisions and concepts in our workflows:
-
-- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows.
-  This has the advantage that those workflows will run without prior approval for external contributors.
-
-- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches.
-  **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible.
-  Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.
-
-- By definition `pull_request_target` runs in the context of the **base** of the pull request.
-  This means that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default.
-  To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.
-
-- To test the pull request's contents, we checkout the "test merge commit".
-  This is a temporary commit that GitHub creates automatically as "what would happen if this PR was merged into the base branch now?".
-  The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore).
-  This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout.
-  Thus, we use the `prepare` job to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.
-
-- Various workflows need to make comparisons against the base branch.
-  In this case, we checkout the parent of the "test merge commit" for best results.
-  Note that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.
-
-## Terminology
-
-- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions.
-  Same as `github.event.pull_request.base.sha`.
-- **head commit**: The HEAD commit in the pull request's branch.
-  Same as `github.event.pull_request.head.sha`.
-- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request.
-  Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.
-- **target commit**: The base branch's parent of the "test merge commit" to compare against.
-
-## Concurrency Groups
-
-We use [GitHub's Concurrency Groups](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs) to cancel older jobs on pushes to Pull Requests.
-When two workflows are in the same group, a newer workflow cancels an older workflow.
-Thus, it is important how to construct the group keys:
-
-- Because we want to run jobs for different events at same time, we add `github.event_name` to the key.
-  This is the case for the `pull_request` which runs on changes to the workflow files to test the new files and the same workflow from the base branch run via `pull_request_event`.
-
-- We don't want workflows of different Pull Requests to cancel each other, so we include `github.event.pull_request.number`.
-  The [GitHub docs](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs#example-using-a-fallback-value) show using `github.head_ref` for this purpose, but this doesn't work well with forks: Different users could have the same head branch name in their forks and run CI for their PRs at the same time.
-
-- Sometimes, there is no `pull_request.number`.
-  To ensure non-PR runs are never cancelled, we add a fallback of `github.run_id`.
-  This is a unique value for each workflow run.
-
-- Of course, we run multiple workflows at the same time, so we add `github.workflow` to the key.
-  Otherwise workflows would cancel each other.
-
-- There is a special case for reusable workflows called via `workflow_call` - they will have `github.workflow` set to their parent workflow's name.
-  Thus, they would cancel each other.
-  That's why we additionally hardcode the name of the workflow as well.
-
-This results in a key with the following semantics:
-
-```
-<running-workflow>-<triggering-workflow>-<triggered-event>-<pull-request/fallback>
-```
-
-## Required Status Checks
-
-The "Required Status Checks" branch ruleset is implemented in two top-level workflows: `pull-request-target.yml` and `merge-group.yml`.
-
-The PR workflow defines all checks that need to succeed to add a Pull Request to the Merge Queue.
-If no Merge Queue is set up for a branch, the PR workflow defines the checks required to merge into the target branch.
-
-The Merge Group workflow defines all checks that are run as part of the Merge Queue.
-Only when these pass, a Pull Request is finally merged into the target branch.
-They don't apply when no Merge Queue is set up.
-
-Both workflows work with the same `no PR failures` status check.
-This name can never be changed, because it's used in the branch ruleset for these rules.

.github/workflows/backport.yml

@@ -1,97 +0,0 @@
-# WARNING:
-# When extending this action, be aware that $GITHUB_TOKEN allows write access to
-# the GitHub repository. This means that it should not evaluate user input in a
-# way that allows code injection.
-
-name: Backport
-
-on:
-  pull_request_target:
-    types: [closed, labeled]
-
-permissions:
-  contents: read
-  issues: write # adding the 'has: port to stable' and 'has: backport failed' label
-  pull-requests: write # creating backport pull requests
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  backport:
-    name: Backport Pull Request
-    if: vars.NIXPKGS_CI_CLIENT_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
-    runs-on: ubuntu-slim
-    timeout-minutes: 3
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-contents: write
-          permission-pull-requests: write
-          permission-workflows: write
-
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-          token: ${{ steps.app-token.outputs.token }}
-          persist-credentials: true
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Create backport PRs
-        id: backport
-        uses: korthout/backport-action@66065406958f46e82238fd59546f5a99e69e22aa # v4.5.2
-        with:
-          # Config README: https://github.com/korthout/backport-action#backport-action
-          add_author_as_reviewer: true
-          copy_labels_pattern: 'severity:\ssecurity'
-          github_token: ${{ steps.app-token.outputs.token }}
-          pull_description: |-
-            Bot-based backport to `${target_branch}`, triggered by a label in #${pull_number}.
-
-            **Before merging, ensure that this backport is [acceptable for the release](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).**
-
-            Even as a non-committer, if you find that it is not acceptable, leave a comment.
-
-            > [!TIP]
-            > If you maintain all packages touched by this pull request, and they are all located under `pkgs/by-name/*`, you can comment **`@NixOS/nixpkgs-merge-bot merge`** to automatically merge this PR using the [`nixpkgs-merge-bot`](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md#nixpkgs-merge-bot).
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
-
-      - name: "Add 'has: port to stable' label"
-        if: steps.backport.outputs.created_pull_numbers != ''
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          # Not using the app on purpose to avoid triggering another workflow run after adding this label.
-          script: |
-            await github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.payload.pull_request.number,
-              labels: [ '8.has: port to stable' ]
-            })
-
-      - name: "Add 'has: failed backport' label"
-        if: steps.backport.outputs.was_successful == 'false'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          # Not using the app on purpose to avoid triggering another workflow run after adding this label.
-          script: |
-            await github.rest.issues.addLabels({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.payload.pull_request.number,
-              labels: [ '8.has: failed backport' ]
-            })

.github/workflows/bot.yml

@@ -1,130 +0,0 @@
-# WARNING:
-# When extending this action, be aware that $GITHUB_TOKEN allows some write
-# access to the GitHub API. This means that it should not evaluate user input in
-# a way that allows code injection.
-
-name: Bot
-
-on:
-  schedule:
-    # Run every 10m
-    # i.e., at each of the listed minutes, every hour
-    - cron: '05,15,25,35,45,55 * * * *'
-  workflow_call:
-    inputs:
-      headBranch:
-        required: true
-        type: string
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY:
-        required: true
-  workflow_dispatch:
-
-concurrency:
-  # This explicitly avoids using `run_id` for the concurrency key to make sure that only
-  # *one* scheduled run can run at a time.
-  group: bot-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number }}
-  # PR-triggered runs will be cancelled, but scheduled runs will be queued.
-  cancel-in-progress: ${{ github.event_name != 'schedule' }}
-
-# This is used as fallback without app only.
-# This happens when testing in forks without setting up that app.
-permissions:
-  issues: write # managing issue labels and comments
-  pull-requests: write # managing pull request labels and comments
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  run:
-    runs-on: ubuntu-slim
-    if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
-    env:
-      # TODO: Remove after 2026-03-04, when Node 24 becomes the default.
-      # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
-      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: |
-            ci/github-script
-
-      - name: Install dependencies
-        run: npm install @actions/artifact@6.2.1 bottleneck@2.19.5
-
-      # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_CLIENT_ID
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-administration: read
-          permission-contents: write
-          permission-issues: write
-          permission-members: read
-          permission-pull-requests: write
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Run bot
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          retries: 3
-          script: |
-            require('./ci/github-script/bot.js')({
-              github,
-              context,
-              core,
-              dry: context.eventName == 'pull_request'
-            })
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
-        name: Labels from touched files
-        if: |
-          github.event_name == 'pull_request_target' &&
-          !contains(fromJSON(inputs.headBranch).type, 'development')
-        with:
-          repo-token: ${{ steps.app-token.outputs.token || github.token }}
-          configuration-path: .github/labeler.yml # default
-          sync-labels: true
-
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
-        name: Labels from touched files (no sync)
-        if: |
-          github.event_name == 'pull_request_target' &&
-          !contains(fromJSON(inputs.headBranch).type, 'development')
-        with:
-          repo-token: ${{ steps.app-token.outputs.token || github.token }}
-          configuration-path: .github/labeler-no-sync.yml
-          sync-labels: false
-
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
-        name: Labels from touched files (development branches)
-        # Development branches like staging-next, haskell-updates and python-updates get special labels.
-        # This is to avoid the mass of labels there, which is mostly useless - and really annoying for
-        # the backport labels.
-        if: |
-          github.event_name == 'pull_request_target' &&
-          contains(fromJSON(inputs.headBranch).type, 'development')
-        with:
-          repo-token: ${{ steps.app-token.outputs.token || github.token }}
-          configuration-path: .github/labeler-development-branches.yml
-          sync-labels: true
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq

.github/workflows/build.yml

@@ -1,112 +0,0 @@
-name: Build
-
-on:
-  workflow_call:
-    inputs:
-      artifact-prefix:
-        required: true
-        type: string
-      baseBranch:
-        required: true
-        type: string
-      mergedSha:
-        required: true
-        type: string
-      targetSha:
-        required: true
-        type: string
-    secrets:
-      # Should only be provided in the merge queue, not in pull requests,
-      # where we're evaluating untrusted code.
-      CACHIX_AUTH_TOKEN_GHA:
-        required: false
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runner: ubuntu-24.04
-            name: x86_64-linux
-            systems: x86_64-linux
-            builds: [shell, manual-nixos, lib-tests, tarball]
-            desc: shell, docs, lib, tarball
-          - runner: ubuntu-24.04-arm
-            name: aarch64-linux
-            systems: aarch64-linux
-            builds: [shell, manual-nixos, manual-nixpkgs]
-            desc: shell, docs
-          - runner: macos-14
-            name: darwin
-            systems: aarch64-darwin x86_64-darwin
-            builds: [shell]
-            desc: shell
-    name: '${{ matrix.name }}: ${{ matrix.desc }}'
-    runs-on: ${{ matrix.runner }}
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - name: Checkout the merge commit
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
-
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-        with:
-          # Sandbox is disabled on MacOS by default.
-          extra_nix_config: sandbox = true
-
-      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        continue-on-error: true
-        with:
-          # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
-          name: ${{ vars.CACHIX_NAME || 'nixpkgs-gha' }}
-          extraPullNames: nixpkgs-gha
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-          pushFilter: '(-source$|-nixpkgs-tarball-)'
-
-      - run: nix-env --install -f nixpkgs/trusted-pinned -A nix-build-uncached
-
-      - name: Build shell
-        if: contains(matrix.builds, 'shell')
-        run: echo "${{ matrix.systems }}" | xargs -n1 nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system
-
-      - name: Build NixOS manual
-        if: |
-          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          (contains(fromJSON(inputs.baseBranch).type, 'primary')
-            || startsWith(fromJSON(inputs.baseBranch).branch, 'staging-nixos')
-          )
-        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixos --out-link nixos-manual
-
-      - name: Build Nixpkgs manual
-        if: contains(matrix.builds, 'manual-nixpkgs') && !cancelled()
-        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixpkgs
-
-      - name: Build lib tests
-        if: contains(matrix.builds, 'lib-tests') && !cancelled()
-        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A lib-tests
-
-      - name: Build tarball
-        if: contains(matrix.builds, 'tarball') && !cancelled()
-        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A tarball
-
-      - name: Upload NixOS manual
-        if: |
-          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          contains(fromJSON(inputs.baseBranch).type, 'primary')
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ inputs.artifact-prefix }}nixos-manual-${{ matrix.name }}
-          path: nixos-manual

.github/workflows/check.yml

@@ -1,173 +0,0 @@
-name: Check
-
-on:
-  workflow_call:
-    inputs:
-      baseBranch:
-        required: false
-        type: string
-      headBranch:
-        required: false
-        type: string
-      mergedSha:
-        required: true
-        type: string
-      targetSha:
-        required: true
-        type: string
-    secrets:
-      # Can be provided in pull requests because the job it is used in does
-      # not evaluate untrusted code.
-      NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY:
-        required: false
-      # Can be provided in pull requests because the job it is used in does
-      # not evaluate untrusted code.
-      NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY:
-        required: false
-      # Should only be provided in the merge queue, not in pull requests,
-      # where we're evaluating untrusted code.
-      CACHIX_AUTH_TOKEN_GHA:
-        required: false
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  commits:
-    if: inputs.baseBranch && inputs.headBranch
-    permissions:
-      pull-requests: write # submitting PR reviews
-    runs-on: ubuntu-slim
-    timeout-minutes: 3
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          path: trusted
-          sparse-checkout: |
-            ci/github-script
-
-      - name: Install dependencies
-        run: npm install bottleneck@2.19.5
-
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_COMMIT_CHECK_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Check commits
-        id: check
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          TARGETS_STABLE: ${{ fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development') }}
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          script: |
-            const targetsStable = JSON.parse(process.env.TARGETS_STABLE)
-            require('./trusted/ci/github-script/commits.js')({
-              github,
-              context,
-              core,
-              dry: context.eventName == 'pull_request',
-              cherryPicks: context.eventName == 'pull_request' || targetsStable,
-            })
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-  manual-file-edits:
-    if: inputs.baseBranch && inputs.headBranch
-    permissions:
-      pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 3
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          path: trusted
-          sparse-checkout: |
-            ci/github-script
-
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_MANUAL_EDIT_CHECK_CLIENT_ID
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_MANUAL_EDIT_CHECK_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-      - name: Discourage manual edits to certain files
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          script: |
-            require('./trusted/ci/github-script/manual-file-edits.js')({
-              github,
-              context,
-              core,
-              dry: context.eventName == 'pull_request',
-              repoPath: 'trusted',
-            })
-
-      - name: Log current API rate limits
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
-        run: gh api /rate_limit | jq
-
-  owners:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - name: Checkout merge and target commits
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
-
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-
-      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        continue-on-error: true
-        with:
-          # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
-          name: ${{ vars.CACHIX_NAME || 'nixpkgs-gha' }}
-          extraPullNames: nixpkgs-gha
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-          pushFilter: -source$
-
-      - name: Build codeowners validator
-        run: nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A codeownersValidator
-
-      - name: Validate codeowners
-        env:
-          OWNERS_FILE: nixpkgs/untrusted/ci/OWNERS
-          REPOSITORY_PATH: nixpkgs/untrusted
-          # Omits "owners", which checks whether GitHub handles exist, but fails with nested team
-          # structures.
-          CHECKS: "duppatterns,files,syntax"
-          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
-          EXPERIMENTAL_CHECKS: "avoid-shadowing"
-        run: result/bin/codeowners-validator

.github/workflows/comment.yml

@@ -1,54 +0,0 @@
-name: Comment
-
-on:
-  issue_comment:
-    types: [created]
-
-# This is used as fallback without app only.
-# This happens when testing in forks without setting up that app.
-permissions:
-  pull-requests: write # adding reactions to comments
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  # The `bot` workflow reacts to comments with @NixOS/nixpkgs-merge-bot references, but might only
-  # pick up a comment after up to 10 minutes. To give the user instant feedback, this job adds
-  # a reaction to these comments.
-  react:
-    name: React with eyes
-    runs-on: ubuntu-slim
-    timeout-minutes: 2
-    if: contains(github.event.comment.body, '@NixOS/nixpkgs-merge-bot merge')
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: |
-            ci/github-script
-
-      # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_CLIENT_ID
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          retries: 3
-          script: |
-            const { handleMergeComment } = require('./ci/github-script/merge.js')
-            const { body, node_id } = context.payload.comment
-
-            await handleMergeComment({
-              github,
-              body,
-              node_id,
-              reaction: 'EYES',
-            })

.github/workflows/direct-push.yml

@@ -0,0 +1,29 @@
+name: "Direct Push Warning"
+on:
+  push:
+    branches:
+     - master
+     - release-**
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    env:
+      GITHUB_SHA: ${{ github.sha }}
+      GITHUB_REPOSITORY: ${{ github.repository }}
+    steps:
+    - name: Check if commit is a merge commit
+      id: ismerge
+      run: |
+        ISMERGE=$(curl -H 'Accept: application/vnd.github.groot-preview+json' -H "authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" https://api.github.com/repos/${{ env.GITHUB_REPOSITORY }}/commits/${{ env.GITHUB_SHA }}/pulls | jq -r '.[] | select(.merge_commit_sha == "${{ env.GITHUB_SHA }}") | any')
+        echo "::set-output name=ismerge::$ISMERGE"
+    - name: Warn if the commit was a direct push
+      if: steps.ismerge.outputs.ismerge != 'true'
+      uses: peter-evans/commit-comment@v1
+      with:
+        body: |
+          @${{ github.actor }}, you pushed a commit directly to master/release branch
+          instead of going through a Pull Request.
+
+          That's highly discouraged beyond the few exceptions listed
+          on https://github.com/NixOS/nixpkgs/issues/118661

.github/workflows/edited.yml

@@ -1,59 +0,0 @@
-# Some workflows depend on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
-# Instead it causes an `edited` event.
-# Since `edited` is also triggered when PR title/body is changed, we use this wrapper workflow, to run the other workflows conditionally only.
-# There are already feature requests for adding a `base_changed` event:
-# - https://github.com/orgs/community/discussions/35058
-# - https://github.com/orgs/community/discussions/64119
-#
-# Instead of adding this to each workflow's pull_request_target event, we trigger this in a separate workflow.
-# This has the advantage, that we can actually skip running those jobs for simple edits like changing the title or description.
-# The actual trigger happens by closing and re-opening the pull request, which triggers the default pull_request_target events.
-# This is much simpler and reliable than other approaches.
-
-name: "Edited base branch"
-
-on:
-  pull_request_target:
-    types: [edited]
-
-concurrency:
-  group: edited-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  base:
-    name: Trigger jobs
-    runs-on: ubuntu-slim
-    if: github.event.changes.base.ref.from && github.event.changes.base.ref.from != github.event.pull_request.base.ref
-    timeout-minutes: 2
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      # We only need Pull Requests: write here, but the app is also used for backports.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          script: |
-            function changeState(state) {
-              return github.rest.pulls.update({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                pull_number: context.payload.pull_request.number,
-                state
-              })
-            }
-            await changeState('closed')
-            await changeState('open')

.github/workflows/editorconfig.yml

@@ -0,0 +1,46 @@
+name: "Checking EditorConfig"
+
+permissions: read-all
+
+on:
+  # avoids approving first time contributors
+  pull_request_target:
+    branches-ignore:
+      - 'release-**'
+
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+    - name: Get list of changed files from PR
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        echo 'PR_DIFF<<EOF' >> $GITHUB_ENV
+        gh api \
+          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
+          | jq '.[] | select(.status != "removed") | .filename' \
+          >> $GITHUB_ENV
+        echo 'EOF' >> $GITHUB_ENV
+    - uses: actions/checkout@v2
+      with:
+        # pull_request_target checks out the base branch by default
+        ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      if: env.PR_DIFF
+    - uses: cachix/install-nix-action@v13
+      if: env.PR_DIFF
+      with:
+        # nixpkgs commit is pinned so that it doesn't break
+        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/f93ecc4f6bc60414d8b73dbdf615ceb6a2c604df.tar.gz
+    - name: install editorconfig-checker
+      run: nix-env -iA editorconfig-checker -f '<nixpkgs>'
+      if: env.PR_DIFF
+    - name: Checking EditorConfig
+      if: env.PR_DIFF
+      run: |
+        echo "$PR_DIFF" | xargs editorconfig-checker -disable-indent-size
+    - if: ${{ failure() }}
+      run: |
+        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."
+

.github/workflows/eval.yml

@@ -1,495 +0,0 @@
-name: Eval
-
-on:
-  workflow_call:
-    inputs:
-      artifact-prefix:
-        required: true
-        type: string
-      mergedSha:
-        required: true
-        type: string
-      headSha:
-        required: false # only required when testVersions is true
-        type: string
-      targetSha:
-        required: true
-        type: string
-      systems:
-        required: true
-        type: string
-      testVersions:
-        required: false
-        default: false
-        type: boolean
-    secrets:
-      # Can be provided in pull requests because the job it is used in does
-      # not evaluate untrusted code.
-      NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY:
-        required: false
-      # Should only be provided in the merge queue, not in pull requests,
-      # where we're evaluating untrusted code.
-      CACHIX_AUTH_TOKEN_GHA:
-        required: false
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  versions:
-    if: inputs.testVersions
-    runs-on: ubuntu-slim
-    outputs:
-      versions: ${{ steps.versions.outputs.versions }}
-      ciPinBumpCommit: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommit }}
-      ciPinBumpCommitShort: ${{ steps.find-pinned-commit.outputs.ciPinBumpCommitShort }}
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          path: trusted
-          sparse-checkout: |
-            ci/supportedVersions.nix
-
-      - name: Check out the PR at the test merge commit
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          ref: ${{ inputs.mergedSha }}
-          path: untrusted
-          sparse-checkout: |
-            ci/pinned.json
-
-      - name: Find commit that touched ci/pinned.json
-        id: find-pinned-commit
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          TARGET_SHA: ${{ inputs.targetSha }}
-          HEAD_SHA: ${{ inputs.headSha }}
-        with:
-          script: |
-            const targetSha = process.env.TARGET_SHA
-            const headSha = process.env.HEAD_SHA
-
-            if (!targetSha || !headSha) {
-              core.setFailed('Error: Both targetSha and headSha inputs are required when testVersions is true.')
-              return
-            }
-
-            // Compare the two commits to get the list of commits in between
-            const comparison = await github.rest.repos.compareCommitsWithBasehead({
-              ...context.repo,
-              basehead: `${targetSha}...${headSha}`,
-            })
-
-            if(comparison.data.commits.length > 50) {
-              core.setFailed('Error: Too many commits in comparison, cannot reliably find pinned.json change.')
-              return
-            }
-
-            const logRateLimit = async (label) => {
-              const { data } = await github.rest.rateLimit.get()
-              const { remaining, limit, used } = data.rate
-              core.info(`[Rate Limit ${label}] ${remaining}/${limit} remaining (${used} used)`)
-            }
-
-            await logRateLimit('before commit filtering')
-
-            // Filter commits that modified ci/pinned.json
-            const commitsModifyingPinned = (
-              await Promise.all(
-                comparison.data.commits.map(async (commit) => {
-                  const commitDetails = await github.rest.repos.getCommit({
-                    ...context.repo,
-                    ref: commit.sha,
-                  })
-                  const modifiesPinned = commitDetails.data.files?.some(
-                    (file) => file.filename === "ci/pinned.json"
-                  )
-                  return modifiesPinned ? commit.sha : null
-                })
-              )
-            ).filter((sha) => sha !== null)
-
-            await logRateLimit('after commit filtering')
-
-            if (commitsModifyingPinned.length === 0) {
-              // This should not happen as testVersions should only be true
-              // when ci/pinned.json was modified in the PR.
-              core.setFailed("Error: ci/pinned.json was not modified in this PR")
-              return
-            } else if (commitsModifyingPinned.length > 1) {
-              core.setFailed([
-                "Error: Multiple commits touch ci/pinned.json in this PR:",
-                ...commitsModifyingPinned,
-                "Please ensure only a single commit modifies ci/pinned.json for accurate version matrix evaluation."
-              ].join("\n"))
-              return
-            }
-
-            const ciPinBumpCommit = commitsModifyingPinned[0]
-            core.setOutput("ciPinBumpCommit", ciPinBumpCommit)
-            core.setOutput("ciPinBumpCommitShort", ciPinBumpCommit.substring(0, 7))
-            core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-
-      - name: Load supported versions
-        id: versions
-        run: |
-          echo "versions=$(trusted/ci/supportedVersions.nix --arg pinnedJson untrusted/ci/pinned.json)" >> "$GITHUB_OUTPUT"
-
-  eval:
-    runs-on: ubuntu-24.04-arm
-    needs: versions
-    if: ${{ !cancelled() && !failure() }}
-    strategy:
-      fail-fast: false
-      matrix:
-        system: ${{ fromJSON(inputs.systems) }}
-        version:
-          - "" # Default Eval triggering rebuild labels and such.
-          - ${{ fromJSON(needs.versions.outputs.versions || '[]') }} # Only for ci/pinned.json updates.
-    # Failures for versioned Evals will be collected in a separate job below
-    # to not interrupt main Eval's compare step.
-    continue-on-error: ${{ matrix.version != '' }}
-    name: ${{ matrix.system }}${{ matrix.version && format(' @ {0} ({1})', matrix.version, needs.versions.outputs.ciPinBumpCommitShort) || '' }}
-    timeout-minutes: 20
-    steps:
-      # This is not supposed to be used and just acts as a fallback.
-      # Without swap, when Eval runs OOM, it will fail badly with a
-      # job that is sometimes not interruptible anymore.
-      # If Eval starts swapping, decrease chunkSize to keep it fast.
-      - name: Enable swap
-        run: |
-          sudo fallocate -l 10G /swap
-          sudo chmod 600 /swap
-          sudo mkswap /swap
-          sudo swapon /swap
-
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - name: Check out the PR at merged and target commits
-        uses: ./.github/actions/checkout
-        with:
-          # For versioned evals, use the target as the untrusted base and apply the pin-bump commit
-          merged-as-untrusted-at: ${{ matrix.version && inputs.targetSha || inputs.mergedSha }}
-          untrusted-pin-bump: ${{ matrix.version && needs.versions.outputs.ciPinBumpCommit }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-
-      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        continue-on-error: true
-        with:
-          # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
-          name: ${{ vars.CACHIX_NAME || 'nixpkgs-gha' }}
-          extraPullNames: nixpkgs-gha
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-          pushFilter: '(-source|-single-chunk)$'
-
-      - name: Evaluate the ${{ matrix.system }} output paths at the merge commit
-        env:
-          MATRIX_SYSTEM: ${{ matrix.system }}
-          MATRIX_VERSION: ${{ matrix.version || 'nixVersions.latest' }}
-        run: |
-          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A eval.singleSystem \
-            --argstr evalSystem "$MATRIX_SYSTEM" \
-            --arg chunkSize 8000 \
-            --argstr nixPath "$MATRIX_VERSION" \
-            --out-link merged
-          # If it uses too much memory, slightly decrease chunkSize.
-          # Note: Keep the same further down in sync!
-
-      - name: Evaluate the ${{ matrix.system }} output paths at the target commit
-        env:
-          MATRIX_SYSTEM: ${{ matrix.system }}
-        run: |
-          TARGET_DRV=$(nix-instantiate nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.singleSystem \
-            --argstr evalSystem "$MATRIX_SYSTEM" \
-            --arg chunkSize 8000 \
-            --argstr nixPath "nixVersions.latest")
-
-          # Try to fetch this from Cachix a few times, for up to 30 seconds. This avoids running Eval
-          # twice in the Merge Queue, when a later item finishes Eval at the merge commit earlier.
-          for _i in {1..6}; do
-            # Using --max-jobs 0 will cause nix-build to fail if this can't be substituted from cachix.
-            if nix-build "$TARGET_DRV" --max-jobs 0; then
-              break
-            fi
-            sleep 5
-          done
-
-          # Either fetches from Cachix or runs Eval itself. The fallback is required
-          # for pull requests into wip-branches without merge queue.
-          nix-build "$TARGET_DRV" --out-link target
-
-      - name: Compare outpaths against the target branch
-        env:
-          MATRIX_SYSTEM: ${{ matrix.system }}
-        run: |
-          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A eval.diff \
-            --arg beforeDir ./target \
-            --arg afterDir ./merged \
-            --argstr evalSystem "$MATRIX_SYSTEM" \
-            --out-link diff
-
-      - name: Upload outpaths diff and stats
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ inputs.artifact-prefix }}${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
-          path: diff/*
-
-  compare:
-    runs-on: ubuntu-24.04-arm
-    needs: [eval]
-    if: ${{ !cancelled() && !failure() }}
-    permissions:
-      pull-requests: write # submitting 'wrong branch' reviews
-      statuses: write # creating 'Eval Summary' commit statuses
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - name: Check out the PR at the target commit
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
-
-      - name: Download output paths and eval stats for all systems
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: ${{ inputs.artifact-prefix }}diff-*
-          path: diff
-          merge-multiple: true
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-
-      - name: Combine all output paths and eval stats
-        run: |
-          nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.combine \
-            --arg diffDir ./diff \
-            --out-link combined
-
-      - name: Upload the maintainer list
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ inputs.artifact-prefix }}maintainers
-          path: combined/maintainers.json
-
-      - name: Compare against the target branch
-        env:
-          TARGET_SHA: ${{ inputs.mergedSha }}
-        run: |
-          git -C nixpkgs/trusted diff --name-only "$TARGET_SHA" \
-            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
-
-          # Use the target branch to get accurate maintainer info
-          nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.compare \
-            --arg combinedDir ./combined \
-            --arg touchedFilesJson ./touched-files.json \
-            --out-link comparison
-
-          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
-
-      - name: Upload the comparison results
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: ${{ inputs.artifact-prefix }}comparison
-          path: comparison/*
-
-      - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { readFile } = require('node:fs/promises')
-            const changed = JSON.parse(await readFile('comparison/changed-paths.json', 'utf-8'))
-            const removedByKernel = Object.fromEntries(
-              Object.entries(changed.attrdiffByKernel ?? {}).map(([kernel, diff]) => [
-                kernel,
-                diff.removed.length,
-              ]),
-            )
-            const description =
-              'Package: ' + [
-                `added ${changed.attrdiff.added.length}`,
-                `removed ${changed.attrdiff.removed.length}`,
-                `changed ${changed.attrdiff.changed.length}`
-              ].join(', ') +
-              ' — Rebuild: ' + [
-                `linux ${changed.rebuildCountByKernel.linux}`,
-                `darwin ${changed.rebuildCountByKernel.darwin}`
-              ].join(', ') +
-              (
-                Object.values(removedByKernel).some((count) => count > 0)
-                  ? ' — Removed: ' + [
-                      `linux ${removedByKernel.linux ?? 0}`,
-                      `darwin ${removedByKernel.darwin ?? 0}`
-                    ].join(', ')
-                  : ''
-              )
-
-            const { serverUrl, repo, runId, payload } = context
-            const target_url =
-              `${serverUrl}/${repo.owner}/${repo.repo}/actions/runs/${runId}?pr=${payload.pull_request.number}`
-
-            await github.rest.repos.createCommitStatus({
-              ...repo,
-              sha: payload.pull_request.head.sha,
-              context: 'Eval Summary',
-              state: 'success',
-              description,
-              target_url
-            })
-
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name == 'pull_request_target' && vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      # It's fine to reuse this app in the 'pull-request-target / prepare' job,
-      # because that job has to run before this one.
-      - name: Request changes if PR is against an inappropriate branch
-        if: ${{ github.event_name == 'pull_request_target' }}
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          script: |
-            require('./nixpkgs/trusted/ci/github-script/check-target-branch.js')({
-              github,
-              context,
-              core,
-              dry: context.eventName == 'pull_request',
-            })
-
-  # Creates a matrix of Eval performance for various versions and systems.
-  report:
-    runs-on: ubuntu-slim
-    needs: [versions, eval]
-    steps:
-      - name: Download output paths and eval stats for all versions
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
-        with:
-          pattern: "*-diff-*"
-          path: versions
-
-      - name: Add version comparison table to job summary
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          ARTIFACT_PREFIX: ${{ inputs.artifact-prefix }}
-          SYSTEMS: ${{ inputs.systems }}
-          VERSIONS: ${{ needs.versions.outputs.versions }}
-          CI_PIN_BUMP_COMMIT: ${{ needs.versions.outputs.ciPinBumpCommit }}
-        with:
-          script: |
-            const { readFileSync } = require('node:fs')
-            const path = require('node:path')
-
-            const prefix = process.env.ARTIFACT_PREFIX
-            const systems = JSON.parse(process.env.SYSTEMS)
-            const versions = JSON.parse(process.env.VERSIONS)
-            const ciPinBumpCommit = process.env.CI_PIN_BUMP_COMMIT
-
-            core.summary.addHeading('Lix/Nix version comparison')
-            core.summary.addRaw(`\n*Evaluated at commit: \`${ciPinBumpCommit}\` (commit that modified ci/pinned.json)*\n`, true)
-            core.summary.addTable(
-              [].concat(
-                [
-                  [{ data: 'Version', header: true }].concat(
-                    systems.map((system) => ({ data: system, header: true })),
-                  ),
-                ],
-                versions.map((version) =>
-                  [{ data: version }].concat(
-                    systems.map((system) => {
-                      try {
-                        const artifact = path.join('versions', `${prefix}${version}-diff-${system}`)
-                        const time = Math.round(
-                          parseFloat(
-                            readFileSync(
-                              path.join(artifact, 'after', system, 'total-time'),
-                              'utf-8',
-                            ),
-                          ),
-                        )
-                        const diff = JSON.parse(
-                          readFileSync(path.join(artifact, system, 'diff.json'), 'utf-8'),
-                        )
-                        const attrs = []
-                          .concat(diff.added, diff.removed, diff.changed, diff.rebuilds)
-                          // There are some special attributes, which are ignored for rebuilds.
-                          // These only have a single path component, because they lack the `.<system>` suffix.
-                          .filter((attr) => attr.split('.').length > 1)
-                        if (attrs.length > 0) {
-                          core.setFailed(
-                            `${version} on ${system} has changed outpaths!\n` +
-                              `Note: This indicates that commit ${ciPinBumpCommit} ` +
-                              `(which modified ci/pinned.json) also contains other ` +
-                              `changes affecting package outputs. ` +
-                              `Please ensure ci/pinned.json is updated in a standalone commit.`
-                          )
-                          return { data: ':x:' }
-                        }
-                        return { data: time }
-                      } catch {
-                        core.warning(`${version} on ${system} did not produce artifact.`)
-                        return { data: ':warning:' }
-                      }
-                    }),
-                  ),
-                ),
-              ),
-            )
-            core.summary.addRaw(
-              '\n*Evaluation time in seconds without downloading dependencies.*',
-              true,
-            )
-            core.summary.addRaw('\n*:warning: Job did not report a result.*', true)
-            core.summary.addRaw(
-              '\n*:x: Job produced different outpaths than the target branch.*',
-              true,
-            )
-            core.summary.write()
-
-  misc:
-    if: ${{ github.event_name != 'push' }}
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - name: Checkout the merge commit
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-
-      - name: Ensure flake outputs on all systems still evaluate
-        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
-
-      - name: Query nixpkgs with aliases enabled to check for basic syntax errors
-        run: |
-          time nix-env -I ./nixpkgs/untrusted -f ./nixpkgs/untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null
-
-      - name: Ensure NixOS modules meta is valid
-        run: |
-          time nix-instantiate -I ./nixpkgs/untrusted --strict --eval --json ./nixpkgs/untrusted/nixos --arg configuration '{}' --attr config.meta --option restrict-eval true --option allow-import-from-derivation false

.github/workflows/labels.yml

@@ -0,0 +1,19 @@
+name: "Label PR"
+
+on:
+  pull_request_target:
+    types: [edited, opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  labels:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS'
+    steps:
+    - uses: actions/labeler@v3
+      with:
+        repo-token: ${{ secrets.GITHUB_TOKEN }}
+        sync-labels: true

.github/workflows/lint.yml

@@ -1,152 +0,0 @@
-name: Lint
-
-on:
-  workflow_call:
-    inputs:
-      mergedSha:
-        required: true
-        type: string
-      targetSha:
-        required: true
-        type: string
-    secrets:
-      # Should only be provided in the merge queue, not in pull requests,
-      # where we're evaluating untrusted code.
-      CACHIX_AUTH_TOKEN_GHA:
-        required: false
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  treefmt:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - name: Checkout the merge commit
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-
-      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
-      # because the cache would be invalidated on every commit - treefmt checks every file.
-      # Maybe we can cache treefmt's eval-cache somehow.
-
-      - name: Check that files are formatted
-        run: |
-          # Note that it's fine to run this on untrusted code because:
-          # - There's no secrets accessible here
-          # - The build is sandboxed
-          if ! nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A fmt.check; then
-            echo "Some files are not properly formatted"
-            echo "Please format them by going to the Nixpkgs root directory and running one of:"
-            echo "  nix-shell --run treefmt"
-            echo "  nix develop --command treefmt"
-            echo "  nix fmt"
-            echo "Make sure your branch is up to date with master; rebase if not."
-            echo "If you're having trouble, please ping @NixOS/nix-formatting"
-            exit 1
-          fi
-
-  parse:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - name: Checkout the merge commit
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-
-      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        continue-on-error: true
-        with:
-          # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
-          name: ${{ vars.CACHIX_NAME || 'nixpkgs-gha' }}
-          extraPullNames: nixpkgs-gha
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-          pushFilter: -source$
-
-      - name: Parse all nix files
-        run: |
-          # Tests multiple versions at once, let's make sure all of them run, so keep-going.
-          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A parse --keep-going
-
-  nixpkgs-vet:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions
-      - name: Checkout merge and target commits
-        uses: ./.github/actions/checkout
-        with:
-          merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
-
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
-
-      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
-        continue-on-error: true
-        with:
-          # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
-          name: ${{ vars.CACHIX_NAME || 'nixpkgs-gha' }}
-          extraPullNames: nixpkgs-gha
-          authToken: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-          pushFilter: -source$
-
-      - name: Running nixpkgs-vet
-        env:
-          # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
-          CLICOLOR_FORCE: 1
-        run: |
-          if nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A nixpkgs-vet --arg base "./nixpkgs/trusted" --arg head "./nixpkgs/untrusted"; then
-            exit 0
-          else
-            exitCode=$?
-            echo "To run locally: ./ci/nixpkgs-vet.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
-            echo "If you're having trouble, ping @NixOS/nixpkgs-vet"
-            exit "$exitCode"
-          fi
-
-  commits:
-    # Only check commits if we have access to the pull_request context.
-    #
-    # Luckily there's no need to lint commit messages in the Merge Queue, because
-    # changes to the target branch can't change commit messages on the base branch.
-    if: ${{ github.event.pull_request.number }}
-    runs-on: ubuntu-slim
-    timeout-minutes: 5
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: true # Needed to run git fetch for large PRs.
-          path: trusted
-      - name: Check commit messages
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const checkCommitMessages = require('./trusted/ci/github-script/lint-commits.js')
-
-            checkCommitMessages({
-              github,
-              context,
-              core,
-              repoPath: 'trusted',
-            })

.github/workflows/manual-nixos.yml

@@ -0,0 +1,30 @@
+name: "Build NixOS manual"
+
+permissions: read-all
+
+on:
+  pull_request_target:
+    branches:
+      - master
+    paths:
+      - 'nixos/**'
+
+jobs:
+  nixos:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@v13
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - uses: cachix/cachix-action@v9
+        with:
+          # This cache is for the nixos/nixpkgs manual builds and should not be trusted or used elsewhere.
+          name: nixpkgs-ci
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+      - name: Building NixOS manual
+        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

.github/workflows/manual-nixpkgs.yml

@@ -0,0 +1,30 @@
+name: "Build Nixpkgs manual"
+
+permissions: read-all
+
+on:
+  pull_request_target:
+    branches:
+      - master
+    paths:
+      - 'doc/**'
+
+jobs:
+  nixpkgs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@v13
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - uses: cachix/cachix-action@v9
+        with:
+          # This cache is for the nixos/nixpkgs manual builds and should not be trusted or used elsewhere.
+          name: nixpkgs-ci
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+      - name: Building Nixpkgs manual
+        run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual

.github/workflows/merge-group.yml

@@ -1,145 +0,0 @@
-name: Merge Group
-
-on:
-  merge_group:
-  workflow_call:
-    inputs:
-      artifact-prefix:
-        required: true
-        type: string
-      mergedSha:
-        required: true
-        type: string
-      targetSha:
-        required: true
-        type: string
-
-permissions: {}
-
-jobs:
-  prepare:
-    runs-on: ubuntu-slim
-    outputs:
-      baseBranch: ${{ steps.prepare.outputs.base }}
-      mergedSha: ${{ steps.prepare.outputs.mergedSha }}
-      targetSha: ${{ steps.prepare.outputs.targetSha }}
-      systems: ${{ steps.prepare.outputs.systems }}
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: |
-            ci/github-script/supportedSystems.js
-
-      - id: prepare
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          MERGED_SHA: ${{ inputs.mergedSha }}
-          TARGET_SHA: ${{ inputs.targetSha }}
-        with:
-          script: |
-            const { classify } = require('./ci/supportedBranches.js')
-            const supportedSystems = require('./ci/github-script/supportedSystems.js')
-
-            const baseBranch = (
-              context.payload.merge_group?.base_ref ??
-              context.payload.pull_request.base.ref
-            ).replace(/^refs\/heads\//, '')
-            const baseClassification = classify(baseBranch)
-            core.setOutput('base', baseClassification)
-            core.info('base classification:', baseClassification)
-
-            const mergedSha = context.payload.merge_group?.head_sha ?? process.env.MERGED_SHA
-            core.setOutput('mergedSha', mergedSha)
-            core.info(`mergedSha: ${mergedSha}`)
-
-            const targetSha = context.payload.merge_group?.base_sha ?? process.env.TARGET_SHA
-            core.setOutput('targetSha', targetSha)
-            core.info(`targetSha: ${targetSha}`)
-
-            const systems = await supportedSystems({ github, context, targetSha })
-            core.setOutput('systems', systems)
-
-  check:
-    name: Check
-    needs: [prepare]
-    uses: ./.github/workflows/check.yml
-    permissions:
-      pull-requests: write # cherry-picks: unused in merge queue but required for check workflow
-    secrets:
-      CACHIX_AUTH_TOKEN_GHA: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-    with:
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-
-  lint:
-    name: Lint
-    needs: [prepare]
-    uses: ./.github/workflows/lint.yml
-    secrets:
-      CACHIX_AUTH_TOKEN_GHA: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-    with:
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-
-  eval:
-    name: Eval
-    needs: [prepare]
-    uses: ./.github/workflows/eval.yml
-    # The eval workflow requests these permissions so we must explicitly allow them,
-    # even though they are unused when working with the merge queue.
-    permissions:
-      pull-requests: write # compare: unused in merge queue but required by eval workflow
-      statuses: write # compare: unused in merge queue but required by eval workflow
-    secrets:
-      CACHIX_AUTH_TOKEN_GHA: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-    with:
-      artifact-prefix: ${{ inputs.artifact-prefix }}
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-      systems: ${{ needs.prepare.outputs.systems }}
-
-  build:
-    name: Build
-    needs: [prepare]
-    uses: ./.github/workflows/build.yml
-    secrets:
-      CACHIX_AUTH_TOKEN_GHA: ${{ secrets.CACHIX_AUTH_TOKEN_GHA }}
-    with:
-      artifact-prefix: ${{ inputs.artifact-prefix }}
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-
-  # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
-  # It "needs" all the jobs that should block the Merge Queue.
-  unlock:
-    if: github.event_name != 'pull_request' && always()
-    # Modify this list to add or remove jobs from required status checks.
-    needs:
-      - check
-      - lint
-      - eval
-      - build
-    runs-on: ubuntu-slim
-    permissions:
-      statuses: write # creating 'no PR failures' commit status
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          RESULTS: ${{ toJSON(needs.*.result) }}
-        with:
-          script: |
-            const { serverUrl, repo, runId, payload } = context
-            const target_url =
-              `${serverUrl}/${repo.owner}/${repo.repo}/actions/runs/${runId}`
-            await github.rest.repos.createCommitStatus({
-              ...repo,
-              sha: payload.merge_group.head_sha,
-              // WARNING:
-              // Do NOT change the name of this, otherwise the rule will not catch it anymore.
-              // This would prevent all PRs from merging.
-              context: 'no PR failures',
-              state: JSON.parse(process.env.RESULTS).every(result => result == 'success') ? 'success' : 'error',
-              target_url,
-            })

.github/workflows/merge-staging.yml

@@ -0,0 +1,41 @@
+name: "merge staging(-next)"
+
+on:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    # Merge every 6 hours
+    - cron:  '0 */6 * * *'
+
+jobs:
+  sync-branch:
+    if: github.repository == 'NixOS/nixpkgs'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: Merge master into staging-next
+        id: staging_next
+        uses: devmasx/merge-branch@v1.3.1
+        with:
+          type: now
+          from_branch: master
+          target_branch: staging-next
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Merge staging-next into staging
+        id: staging
+        uses: devmasx/merge-branch@v1.3.1
+        with:
+          type: now
+          from_branch: staging-next
+          target_branch: staging
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on failure
+        uses: peter-evans/create-or-update-comment@v1
+        if: ${{ failure() }}
+        with:
+          issue-number: 105153
+          body: |
+            An automatic merge${{ (steps.staging_next.outcome == 'failure' && ' from master to staging-next') || ((steps.staging.outcome == 'failure' && ' from staging-next to staging') || '') }} [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
+

.github/workflows/pending-clear.yml

@@ -0,0 +1,21 @@
+name: "clear pending status"
+
+on:
+  check_suite:
+    types: [ completed ]
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    steps:
+    - name: clear pending status
+      if: github.repository_owner == 'NixOS' && github.event.check_suite.app.name == 'OfBorg'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        curl \
+          -X POST \
+          -H "Accept: application/vnd.github.v3+json" \
+          -H "Authorization: token $GITHUB_TOKEN" \
+          -d '{"state": "success", "target_url": " ", "description": " ", "context": "Wait for ofborg"}' \
+          "https://api.github.com/repos/NixOS/nixpkgs/statuses/${{ github.event.check_suite.head_sha }}"

.github/workflows/pending-set.yml

@@ -0,0 +1,20 @@
+name: "set pending status"
+
+on:
+  pull_request_target:
+
+jobs:
+  action:
+    runs-on: ubuntu-latest
+    steps:
+    - name: set pending status
+      if: github.repository_owner == 'NixOS'
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        curl \
+          -X POST \
+          -H "Accept: application/vnd.github.v3+json" \
+          -H "Authorization: token $GITHUB_TOKEN" \
+          -d '{"state": "pending", "target_url": " ", "description": "This pending status will be cleared when ofborg starts eval.", "context": "Wait for ofborg"}' \
+          "https://api.github.com/repos/NixOS/nixpkgs/statuses/${{ github.event.pull_request.head.sha }}"

.github/workflows/periodic-merge-24h.yml

@@ -1,86 +0,0 @@
-# This action periodically merges base branches into staging branches.
-# This is done to
-#  * prevent conflicts or rather resolve them early
-#  * make all potential breakage happen on the staging branch
-#  * and make sure that all major rebuilds happen before the staging
-#    branch get’s merged back into its base branch.
-
-name: "Periodic Merges (24h)"
-
-on:
-  schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Merge every 24 hours
-    - cron: '0 0 * * *'
-  workflow_dispatch:
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  periodic-merge:
-    if: github.repository_owner == 'NixOS' || github.event_name == 'workflow_dispatch'
-    strategy:
-      # don't fail fast, so that all pairs are tried
-      fail-fast: false
-      # certain branches need to be merged in order, like master->staging-next->staging
-      # and disabling parallelism ensures the order of the pairs below.
-      max-parallel: 1
-      matrix:
-        pairs:
-          - from: release-25.11
-            into: staging-next-25.11
-          - from: staging-next-25.11
-            into: staging-25.11
-          - from: release-25.11
-            into: staging-nixos-25.11
-          - from: release-26.05
-            into: staging-next-26.05
-          - from: staging-next-26.05
-            into: staging-26.05
-          - from: release-26.05
-            into: staging-nixos-26.05
-          - name: merge-base(master,staging) → haskell-updates
-            from: master staging
-            into: haskell-updates
-    uses: ./.github/workflows/periodic-merge.yml
-    with:
-      from: ${{ matrix.pairs.from }}
-      into: ${{ matrix.pairs.into }}
-    name: ${{ matrix.pairs.name || format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-
-  # Resets the target branch of the current haskell-updates PR.
-  # This makes GitHub hide all the commits that are already part of staging and gives us a much clearer PR view.
-  haskell-updates:
-    needs: periodic-merge
-    runs-on: ubuntu-slim
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Find PR and update target branch
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            // There will at most be a single haskell-updates PR anyway, so no need to paginate.
-            await Promise.all(
-              (
-                await github.rest.pulls.list({
-                  ...context.repo,
-                  state: 'open',
-                  head: `${context.repo.owner}:haskell-updates`,
-                })
-              ).data.map((pr) =>
-                github.rest.pulls.update({
-                  ...context.repo,
-                  pull_number: pr.number,
-                  // Just updating to the same branch to trigger a UI update.
-                  // This is staging most of the time, but could be staging-next in rare cases.
-                  base: pr.base.ref,
-                }),
-              ),
-            )

.github/workflows/periodic-merge-6h.yml

@@ -1,46 +0,0 @@
-# This action periodically merges base branches into staging branches.
-# This is done to
-#  * prevent conflicts or rather resolve them early
-#  * make all potential breakage happen on the staging branch
-#  * and make sure that all major rebuilds happen before the staging
-#    branch get’s merged back into its base branch.
-
-name: "Periodic Merges (6h)"
-
-on:
-  schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Merge every 6 hours
-    - cron: '0 */6 * * *'
-  workflow_dispatch:
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  periodic-merge:
-    if: github.repository_owner == 'NixOS' || github.event_name == 'workflow_dispatch'
-    strategy:
-      # don't fail fast, so that all pairs are tried
-      fail-fast: false
-      # certain branches need to be merged in order, like master->staging-next->staging
-      # and disabling parallelism ensures the order of the pairs below.
-      max-parallel: 1
-      matrix:
-        pairs:
-          - from: master
-            into: staging-next
-          - from: staging-next
-            into: staging
-          - from: master
-            into: staging-nixos
-    uses: ./.github/workflows/periodic-merge.yml
-    with:
-      from: ${{ matrix.pairs.from }}
-      into: ${{ matrix.pairs.into }}
-    name: ${{ format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}

.github/workflows/periodic-merge.yml

@@ -1,69 +0,0 @@
-name: "Merge"
-
-on:
-  workflow_call:
-    inputs:
-      from:
-        description: Branch to merge into target branch. Can also be two branches separated by space to find the merge base between them.
-        required: true
-        type: string
-      into:
-        description: Target branch to merge into.
-        required: true
-        type: string
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY:
-        required: true
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  merge:
-    runs-on: ubuntu-24.04-arm
-    timeout-minutes: 5
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered
-      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-contents: write
-          permission-pull-requests: write
-
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - name: Find merge base between two branches
-        if: contains(inputs.from, ' ')
-        id: merge_base
-        env:
-          branches: ${{ inputs.from }}
-        run: |
-          # turn into bash array, split on space
-          read -ra branches <<< "$branches"
-          git fetch --shallow-since="1 month ago" origin "${branches[@]}"
-          merge_base="$(git merge-base "refs/remotes/origin/${branches[0]}" "refs/remotes/origin/${branches[1]}")"
-          echo "Found merge base: $merge_base" >&2
-          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
-
-      - name: ${{ inputs.from }} → ${{ inputs.into }}
-        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
-        with:
-          type: now
-          from_branch: ${{ steps.merge_base.outputs.merge_base || inputs.from }}
-          target_branch: ${{ inputs.into }}
-          github_token: ${{ steps.app-token.outputs.token }}
-
-      - name: Comment on failure
-        if: ${{ failure() }}
-        env:
-          BODY_TEXT: |
-            Periodic merge from `${{ inputs.from }}` into [`${{ inputs.into }}`](https://github.com/NixOS/nixpkgs/tree/${{ inputs.into }}) has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          gh pr comment 105153 --body "$BODY_TEXT"

.github/workflows/pull-request-target.yml

@@ -1,169 +0,0 @@
-name: PR
-
-on:
-  pull_request_target:
-  workflow_call:
-    inputs:
-      artifact-prefix:
-        required: true
-        type: string
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY:
-        required: true
-      NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY:
-        required: true
-      NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY:
-        required: true
-      NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY:
-        required: true
-
-concurrency:
-  group: pr-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  prepare:
-    runs-on: ubuntu-slim
-    permissions:
-      pull-requests: write # submitting 'wrong branch' reviews
-    outputs:
-      baseBranch: ${{ steps.prepare.outputs.base }}
-      headBranch: ${{ steps.prepare.outputs.head }}
-      mergedSha: ${{ steps.prepare.outputs.mergedSha }}
-      targetSha: ${{ steps.prepare.outputs.targetSha }}
-      systems: ${{ steps.prepare.outputs.systems }}
-      touched: ${{ steps.prepare.outputs.touched }}
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout-cone-mode: true # default, for clarity
-          sparse-checkout: |
-            ci/github-script
-
-      # It's fine to reuse this app in the 'eval / compare' job,
-      # because this job has to run before that one.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID && github.actor != 'dependabot[bot]'
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_BRANCH_CHECK_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - id: prepare
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          retries: 10
-          # The default for this includes code 422, which happens regularly for us when comparing commits:
-          #   422 - Server Error: Sorry, this diff is taking too long to generate.
-          # Listing all other values from here to effectively remove 422:
-          #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
-          retry-exempt-status-codes: 400,401,403,404
-          script: |
-            require('./ci/github-script/prepare.js')({
-              github,
-              context,
-              core,
-              dry: context.eventName == 'pull_request',
-            })
-
-  check:
-    name: Check
-    needs: [prepare]
-    uses: ./.github/workflows/check.yml
-    permissions:
-      # cherry-picks
-      pull-requests: write
-    secrets:
-      NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY }}
-      NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY }}
-    with:
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
-      headBranch: ${{ needs.prepare.outputs.headBranch }}
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-
-  lint:
-    name: Lint
-    needs: [prepare]
-    uses: ./.github/workflows/lint.yml
-    with:
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-
-  eval:
-    name: Eval
-    needs: [prepare]
-    uses: ./.github/workflows/eval.yml
-    permissions:
-      # compare
-      pull-requests: write
-      statuses: write
-    secrets:
-      NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY }}
-    with:
-      artifact-prefix: ${{ inputs.artifact-prefix }}
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      headSha: ${{ github.event.pull_request.head.sha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-      systems: ${{ needs.prepare.outputs.systems }}
-      testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
-
-  bot:
-    name: Bot
-    needs: [prepare, eval]
-    uses: ./.github/workflows/bot.yml
-    permissions:
-      issues: write
-      pull-requests: write
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-    with:
-      headBranch: ${{ needs.prepare.outputs.headBranch }}
-
-  build:
-    name: Build
-    needs: [prepare]
-    uses: ./.github/workflows/build.yml
-    with:
-      artifact-prefix: ${{ inputs.artifact-prefix }}
-      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-
-  # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
-  # It "needs" all the jobs that should block merging a PR.
-  unlock:
-    if: github.event_name != 'pull_request' && always()
-    # Modify this list to add or remove jobs from required status checks.
-    needs:
-      - check
-      - lint
-      - eval
-      - build
-    runs-on: ubuntu-slim
-    permissions:
-      statuses: write
-    steps:
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          RESULTS: ${{ toJSON(needs.*.result) }}
-        with:
-          script: |
-            const { serverUrl, repo, runId, payload } = context
-            const target_url =
-              `${serverUrl}/${repo.owner}/${repo.repo}/actions/runs/${runId}?pr=${payload.pull_request.number}`
-            await github.rest.repos.createCommitStatus({
-              ...repo,
-              sha: payload.pull_request.head.sha,
-              // WARNING:
-              // Do NOT change the name of this, otherwise the rule will not catch it anymore.
-              // This would prevent all PRs from merging.
-              context: 'no PR failures',
-              state: JSON.parse(process.env.RESULTS).every(status => status == 'success') ? 'success' : 'error',
-              target_url,
-            })

.github/workflows/rebase.yml

@@ -0,0 +1,134 @@
+on:
+  issue_comment:
+    types:
+      - created
+
+# This action allows people with write access to the repo to rebase a PRs base branch
+# by commenting `/rebase ${branch}` on the PR while avoiding CODEOWNER notifications.
+
+jobs:
+  rebase:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'NixOS' && github.event.issue.pull_request != '' && contains(github.event.comment.body, '/rebase')
+    steps:
+      - uses: peter-evans/create-or-update-comment@v1
+        with:
+          comment-id: ${{ github.event.comment.id }}
+          reactions: eyes
+      - uses: scherermichael-oss/action-has-permission@1.0.6
+        id: check-write-access
+        with:
+          required-permission: write
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: check permissions
+        run: |
+          echo "Commenter doesn't have write access to the repo"
+          exit 1
+        if: "! steps.check-write-access.outputs.has-permission"
+      - name: setup
+        run: |
+          curl "https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.issue.number }}" 2>/dev/null >pr.json
+          cat <<EOF >>"$GITHUB_ENV"
+          CAN_MODIFY=$(jq -r '.maintainer_can_modify' pr.json)
+          COMMITS=$(jq -r '.commits' pr.json)
+          CURRENT_BASE=$(jq -r '.base.ref' pr.json)
+          PR_BRANCH=$(jq -r '.head.ref' pr.json)
+          COMMENT_BRANCH=$(echo ${{ github.event.comment.body }} | awk "/^\/rebase / {print \$2}")
+          PULL_REQUEST=${{ github.event.issue.number }}
+          EOF
+          rm pr.json
+      - name: check branch
+        env:
+          PERMANENT_BRANCHES: "haskell-updates|master|nixos|nixpkgs|python-unstable|release|staging"
+          VALID_BRANCHES: "haskell-updates|master|python-unstable|release-20.09|staging|staging-20.09|staging-next"
+        run: |
+          message() {
+            cat <<EOF
+          Can't rebase $PR_BRANCH from $CURRENT_BASE onto $COMMENT_BRANCH (PR:$PULL_REQUEST COMMITS:$COMMITS)
+          EOF
+          }
+          if ! [[ "$COMMENT_BRANCH" =~ ^($VALID_BRANCHES)$ ]]; then
+            cat <<EOF
+          Check that the branch from the comment is valid:
+
+          $(message)
+
+          This action can only rebase onto these branches:
+
+          $VALID_BRANCHES
+
+          \`/rebase \${branch}\` must be at the start of the line
+          EOF
+            exit 1
+          fi
+          if [[ "$COMMENT_BRANCH" == "$CURRENT_BASE" ]]; then
+            cat <<EOF
+          Check that the branch from the comment isn't the current base branch:
+
+          $(message)
+          EOF
+            exit 1
+          fi
+          if [[ "$COMMENT_BRANCH" == "$PR_BRANCH" ]]; then
+            cat <<EOF
+          Check that the branch from the comment isn't the current branch:
+
+          $(message)
+          EOF
+            exit 1
+          fi
+          if [[ "$PR_BRANCH" =~ ^($PERMANENT_BRANCHES) ]]; then
+            cat <<EOF
+          Check that the PR branch isn't a permanent branch:
+
+          $(message)
+          EOF
+            exit 1
+          fi
+          if [[ "$CAN_MODIFY" != "true" ]]; then
+            cat <<EOF
+          Check that maintainers can edit the PR branch:
+
+          $(message)
+          EOF
+            exit 1
+          fi
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+      - name: rebase pull request
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "github-actions[bot]"
+          git fetch origin
+          gh pr checkout "$PULL_REQUEST"
+          git rebase \
+            --onto="$(git merge-base origin/"$CURRENT_BASE" origin/"$COMMENT_BRANCH")" \
+            "HEAD~$COMMITS"
+          git push --force
+          curl \
+            -X POST \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -d "{ \"base\": \"$COMMENT_BRANCH\" }" \
+            "https://api.github.com/repos/${{ github.repository }}/pulls/$PULL_REQUEST"
+          curl \
+            -X PATCH \
+            -H "Accept: application/vnd.github.v3+json" \
+            -H "Authorization: token $GITHUB_TOKEN" \
+            -d '{ "state": "closed" }' \
+            "https://api.github.com/repos/${{ github.repository }}/pulls/$PULL_REQUEST"
+      - uses: peter-evans/create-or-update-comment@v1
+        with:
+          issue-number: ${{ github.event.issue.number }}
+          body: |
+            Rebased, please reopen the pull request to restart CI
+      - uses: peter-evans/create-or-update-comment@v1
+        if: failure()
+        with:
+          issue-number: ${{ github.event.issue.number }}
+          body: |
+            [Failed to rebase](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})

.github/workflows/review.yml

@@ -1,92 +0,0 @@
-name: Review
-
-on:
-  workflow_run:
-    workflows:
-      - Reviewed
-    types: [completed]
-
-# This is used as fallback without app only.
-# This happens when testing in forks without setting up that app.
-permissions:
-  pull-requests: write # minimizing dismissed reviews and adding reactions
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  process:
-    runs-on: ubuntu-slim
-    timeout-minutes: 2
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: |
-            ci/github-script
-
-      # Use the GitHub App to make sure the reaction happens with the same user who will later merge.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_CLIENT_ID
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-pull-requests: write
-
-      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token || github.token }}
-          retries: 3
-          script: |
-            const { handleMergeComment } = require('./ci/github-script/merge.js')
-
-            // PRs from forks don't have any PRs associated by default.
-            // Thus, we request the PR number with an API call *to* the fork's repo.
-            // Multiple pull requests can be open from the same head commit, either via
-            // different base branches or head branches.
-            const { head_repository, head_sha, repository } = context.payload.workflow_run
-            await Promise.all(
-              (await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit, {
-                owner: head_repository.owner.login,
-                repo: head_repository.name,
-                commit_sha: head_sha
-              }))
-              .filter(pull_request => pull_request.base.repo.id == repository.id)
-              .map(async (pull_request) =>
-                Promise.all(
-                  (await github.paginate(github.rest.pulls.listReviews, {
-                    owner: context.repo.owner,
-                    repo: context.repo.repo,
-                    pull_number: pull_request.number
-                  })).map(review => {
-                    // The `check` workflow creates review comments which reviewers
-                    // are encouraged to manually dismiss if they're not relevant.
-                    // When a CI-generated review is dismissed, this job automatically minimizes
-                    // it, preventing it from cluttering the PR.
-                    if (review.user?.login == 'github-actions[bot]' && review.state == 'DISMISSED')
-                      return github.graphql(`
-                        mutation($node_id:ID!) {
-                          minimizeComment(input: {
-                            classifier: RESOLVED,
-                            subjectId: $node_id
-                          })
-                          { clientMutationId }
-                        }`,
-                        { node_id: review.node_id }
-                      )
-
-                    // The `bot` workflow reacts to comments with @NixOS/nixpkgs-merge-bot references, but might only
-                    // pick up a comment after up to 10 minutes. To give the user instant feedback, this job adds
-                    // a reaction to these comments.
-                    return handleMergeComment({
-                      github,
-                      body: review.body,
-                      node_id: review.node_id,
-                      reaction: 'EYES',
-                    })
-                  })
-                )
-              )
-            )

.github/workflows/reviewed.yml

@@ -1,17 +0,0 @@
-name: Reviewed
-
-on:
-  pull_request_review:
-    types: [submitted, dismissed]
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  trigger:
-    runs-on: ubuntu-slim
-    steps:
-      - run: echo This is a no-op only used as a trigger for workflow_run.

.github/workflows/teams.yml

@@ -1,80 +0,0 @@
-name: Teams
-
-on:
-  schedule:
-    # Every Tuesday at 19:42 (randomly chosen)
-    - cron: '42 19 * * 1'
-  workflow_dispatch:
-
-permissions: {}
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  sync:
-    if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
-    runs-on: ubuntu-slim
-    steps:
-      # Use a GitHub App to create the PR so that CI gets triggered and to
-      # request team member lists.
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        id: app-token
-        with:
-          client-id: ${{ vars.NIXPKGS_CI_CLIENT_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-administration: read
-          permission-contents: write
-          permission-members: read
-          permission-pull-requests: write
-
-      - name: Fetch source
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout: |
-            ci/github-script
-            maintainers/github-teams.json
-
-      - name: Install dependencies
-        run: npm install bottleneck@2.19.5
-
-      - name: Synchronise teams
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          github-token: ${{ steps.app-token.outputs.token }}
-          script: |
-            require('./ci/github-script/get-teams.js')({
-              github,
-              context,
-              core,
-              outFile: "maintainers/github-teams.json"
-            })
-
-      - name: Get GitHub App User Git String
-        id: user
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
-        run: |
-          name="${APP_SLUG}[bot]"
-          userId=$(gh api "/users/$name" --jq .id)
-          email="$userId+$name@users.noreply.github.com"
-          echo "git-string=$name <$email>" >> "$GITHUB_OUTPUT"
-
-      - name: Create Pull Request
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          add-paths: maintainers/github-teams.json
-          author: ${{ steps.user.outputs.git-string }}
-          committer: ${{ steps.user.outputs.git-string }}
-          commit-message: "maintainers/github-teams.json: Automated sync"
-          branch: pr/github-team-sync
-          title: "maintainers/github-teams.json: Automated sync"
-          body: |
-            This is an automated PR to sync the GitHub teams with access to this repository to the `lib.teams` list.
-
-            This PR can be merged without taking any further action.
-

.github/workflows/test.yml

@@ -1,123 +0,0 @@
-name: Test
-
-on:
-  pull_request:
-
-concurrency:
-  group: test-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  prepare:
-    runs-on: ubuntu-slim
-    outputs:
-      merge-group: ${{ steps.files.outputs.merge-group }}
-      mergedSha: ${{ steps.prepare.outputs.mergedSha }}
-      pr: ${{ steps.files.outputs.pr }}
-      push: ${{ steps.files.outputs.push }}
-      targetSha: ${{ steps.prepare.outputs.targetSha }}
-    steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-          sparse-checkout-cone-mode: true # default, for clarity
-          sparse-checkout: |
-            ci/github-script
-      - id: prepare
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          retries: 10
-          # The default for this includes code 422, which happens regularly for us when comparing commits:
-          #   422 - Server Error: Sorry, this diff is taking too long to generate.
-          # Listing all other values from here to effectively remove 422:
-          #   https://github.com/octokit/plugin-retry.js/blob/9a2443746c350b3beedec35cf26e197ea318a261/src/index.ts#L14
-          retry-exempt-status-codes: 400,401,403,404
-          script: |
-            require('./ci/github-script/prepare.js')({
-              github,
-              context,
-              core,
-              // Review comments will be posted by the main PR workflow on the pull_request_target event.
-              dry: true,
-            })
-
-      - name: Determine changed files
-        id: files
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const files = (await github.paginate(github.rest.pulls.listFiles, {
-              ...context.repo,
-              pull_number: context.payload.pull_request.number,
-              per_page: 100,
-            })).map(file => file.filename)
-
-            if (files.some(file => [
-              '.github/workflows/build.yml',
-              '.github/workflows/check.yml',
-              '.github/workflows/eval.yml',
-              '.github/workflows/lint.yml',
-              '.github/workflows/merge-group.yml',
-              '.github/workflows/test.yml',
-              'ci/github-script/supportedSystems.js',
-              'ci/pinned.json',
-              'ci/supportedBranches.js',
-            ].includes(file))) core.setOutput('merge-group', true)
-
-            if (files.some(file => [
-              '.github/actions/checkout/action.yml',
-              '.github/workflows/bot.yml',
-              '.github/workflows/build.yml',
-              '.github/workflows/check.yml',
-              '.github/workflows/eval.yml',
-              '.github/workflows/lint.yml',
-              '.github/workflows/pull-request-target.yml',
-              '.github/workflows/test.yml',
-              'ci/github-script/bot.js',
-              'ci/github-script/check-target-branch.js',
-              'ci/github-script/commits.js',
-              'ci/github-script/get-pr-commit-details.js',
-              'ci/github-script/lint-commits.js',
-              'ci/github-script/merge.js',
-              'ci/github-script/prepare.js',
-              'ci/github-script/reviewers.js',
-              'ci/github-script/reviews.js',
-              'ci/github-script/supportedSystems.js',
-              'ci/github-script/withRateLimit.js',
-              'ci/pinned.json',
-              'ci/supportedBranches.js',
-            ].includes(file))) core.setOutput('pr', true)
-
-  merge-group:
-    if: needs.prepare.outputs.merge-group
-    name: Merge Group
-    needs: [prepare]
-    uses: ./.github/workflows/merge-group.yml
-    # Those are actually only used on the merge_group event, but will throw an error if not set.
-    permissions:
-      pull-requests: write # unused on pull_request, required by merge-group workflow
-      statuses: write # unused on pull_request, required by merge-group workflow
-    with:
-      artifact-prefix: mg-
-      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
-      targetSha: ${{ needs.prepare.outputs.targetSha }}
-
-  pr:
-    if: needs.prepare.outputs.pr
-    name: PR
-    needs: [prepare]
-    uses: ./.github/workflows/pull-request-target.yml
-    # Those are actually only used on the pull_request_target event, but will throw an error if not set.
-    permissions:
-      issues: write # unused on pull_request, required by bot workflow
-      pull-requests: write # unused on pull_request, required by PR workflow
-      statuses: write # unused on pull_request, required by PR workflow
-    secrets:
-      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-      NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_BRANCH_CHECK_APP_PRIVATE_KEY }}
-      NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_COMMIT_CHECK_APP_PRIVATE_KEY }}
-      NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_MANUAL_EDIT_CHECK_APP_PRIVATE_KEY }}
-    with:
-      artifact-prefix: pr-

.github/zizmor.yml

@@ -1,14 +0,0 @@
-# This file defines the ignore rules for zizmor.
-#
-# For rules that contain a high number of false positives, prefer listing them here
-# instead of adding ignore comments. Note that zizmor cannot ignore by line-within-a-string, so
-# there are some ignore items that encompass multiple problems within one `run` block. An issue
-# tracking this is at https://github.com/woodruffw/zizmor/issues/648.
-#
-# For more info, see the documentation: https://woodruffw.github.io/zizmor/usage/#ignoring-results
-
-rules:
-  dangerous-triggers:
-    disable: true
-  secrets-outside-env:
-    disable: true

.gitignore

@@ -2,26 +2,13 @@
 ,*
 .*.swp
 .*.swo
-.\#*
-\#*\#
-.idea/
-.nixos-test-history
-.vscode/
-.helix/
-outputs/
-result-*
 result
-repl-result-*
-tags
-!pkgs/development/python-modules/result
+result-*
 /doc/NEWS.html
 /doc/NEWS.txt
 /doc/manual.html
 /doc/manual.pdf
-/source/
 .version-suffix
-.direnv
-.envrc
 
 .DS_Store
 .mypy_cache
@@ -33,10 +20,3 @@ __pycache__
 
 # generated by pkgs/common-updater/update-script.nix
 update-git-commits.txt
-/*.log
-
-# JetBrains IDEA module declaration file
-/nixpkgs.iml
-
-# Usually used for manual backports
-.worktree/

.mailmap

@@ -1,45 +0,0 @@
-ajs124 <git@ajs124.de> <ajs124@users.noreply.github.com>
-Anderson Torres <torres.anderson.85@protonmail.com>
-Atemu <git@atemu.net> <atemu.main@gmail.com>
-Christina Sørensen <christina@cafkafk.com>
-Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
-Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
-Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
-Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
-Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
-Fiona Behrens <me@kloenk.dev>
-Fiona Behrens <me@kloenk.dev> <me@kloenk.de>
-goatastronaut0212 <goatastronaut0212@outlook.com> <goatastronaut0212@proton.me>
-Janne Heß <janne@hess.ooo> <dasJ@users.noreply.github.com>
-jopejoe1 <nixpkgs@missing.ninja>
-jopejoe1 <nixpkgs@missing.ninja> <johannes@joens.email>
-jopejoe1 <nixpkgs@missing.ninja> <34899572+jopejoe1@users.noreply.github.com>
-jopejoe1 <nixpkgs@missing.ninja> <jopejoe1@missing.ninja>
-jopejoe1 <nixpkgs@missing.ninja> <jopejoe1>
-Jörg Thalheim <joerg@thalheim.io> <Mic92@users.noreply.github.com>
-Lin Jian <me@linj.tech> <linj.dev@outlook.com>
-Lin Jian <me@linj.tech> <75130626+jian-lin@users.noreply.github.com>
-Martin Weinelt <hexa@darmstadt.ccc.de> <mweinelt@users.noreply.github.com>
-Martin Häcker <spamfaenger@gmx.de> <spamfaenger@gmx.de>
-moni <lythe1107@gmail.com> <lythe1107@icloud.com>
-Noah Biewesch <dev@noahbiewesch.com> <90870942+trueNAHO@users.noreply.github.com>
-quantenzitrone <nix@dev.quantenzitrone.eu>
-quantenzitrone <nix@dev.quantenzitrone.eu> <74491719+Quantenzitrone@users.noreply.github.com>
-quantenzitrone <nix@dev.quantenzitrone.eu> <74491719+quantenzitrone@users.noreply.github.com>
-quantenzitrone <nix@dev.quantenzitrone.eu> <general@dev.quantenzitrone.eu>
-quantenzitrone <nix@dev.quantenzitrone.eu> <quantenzitrone@protonmail.com>
-R. RyanTM <ryantm-bot@ryantm.com>
-Robert Hensing <robert@roberthensing.nl> <roberth@users.noreply.github.com>
-Sandro Jäckel <sandro.jaeckel@gmail.com>
-Sandro Jäckel <sandro.jaeckel@gmail.com> <sandro.jaeckel@sap.com>
-superherointj <5861043+superherointj@users.noreply.github.com>
-Tomodachi94 <tomodachi94@protonmail.com> Tomo <68489118+Tomodachi94@users.noreply.github.com>
-toastal <toastal@posteo.net>
-toastal <toastal@posteo.net> <561087+toastal@users.noreply.github.com>
-toastal <toastal@posteo.net> <toastal@protonmail.com>
-Vladimír Čunát <v@cunat.cz> <vcunat@gmail.com>
-Vladimír Čunát <v@cunat.cz> <vladimir.cunat@nic.cz>
-Yifei Sun <ysun@hey.com>
-Yifei Sun <ysun@hey.com> StepBroBD <ysun@hey.com>
-Yifei Sun <ysun@hey.com> StepBroBD <Hi@StepBroBD.com>
-Yifei Sun <ysun@hey.com> <ysun+git@stepbrobd.com>

.version

@@ -1 +0,0 @@
-lib/.version

.version

@@ -0,0 +1 @@
+21.05

CONTRIBUTING.md

@@ -1,965 +0,0 @@
-# Contributing to Nixpkgs
-
-This document is for people wanting to contribute to Nixpkgs.
-This involves changes that are proposed using [GitHub](https://github.com) [pull requests](https://docs.github.com/pull-requests) to the [Nixpkgs repository](https://github.com/nixos/nixpkgs).
-
-A GitHub account is recommended, which you can sign up for [here](https://github.com/signup).
-See [here](https://discourse.nixos.org/t/about-the-patches-category/477) for how to contribute without a GitHub account.
-
-This document assumes that you already know how to use GitHub and Git.
-If that's not the case, we recommend learning about it [here](https://docs.github.com/en/get-started/quickstart/hello-world).
-
-## Overview
-[overview]: #overview
-
-This file contains general contributing information.
-More specific information about individual parts of Nixpkgs can be found here:
-- [`doc`](./doc/README.md): Sources and infrastructure for the [Nixpkgs manual](https://nixos.org/manual/nixpkgs/stable/)
-- [`lib`](./lib/README.md): Sources and documentation of the [library functions](https://nixos.org/manual/nixpkgs/stable/#chap-functions)
-- [`maintainers`](./maintainers/README.md): Nixpkgs maintainer and team listings, maintainer scripts
-- [`nixos`](./nixos/README.md): Implementation of [NixOS](https://nixos.org/manual/nixos/stable/)
-- [`pkgs`](./pkgs/README.md): Package and [builder](https://nixos.org/manual/nixpkgs/stable/#part-builders) definitions
-
-# How to's
-
-## How to create pull requests
-[pr-create]: #how-to-create-pull-requests
-
-This section describes how changes can be proposed with a pull request (PR).
-
-> [!Note]
-> Be aware that contributing implies licensing those contributions under the terms of [COPYING](./COPYING), an MIT-like license.
-
-0. Set up a local version of Nixpkgs to work with:
-   1. [Fork](https://docs.github.com/en/get-started/quickstart/fork-a-repo#forking-a-repository) the [Nixpkgs repository](https://github.com/nixos/nixpkgs).
-   1. [Clone the forked repository](https://docs.github.com/en/get-started/quickstart/fork-a-repo#cloning-your-forked-repository) into a local `nixpkgs` directory.
-   1. [Configure the upstream Nixpkgs repository](https://docs.github.com/en/get-started/quickstart/fork-a-repo#configuring-git-to-sync-your-fork-with-the-upstream-repository).
-
-1. Select the appropriate [base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/about-branches#working-with-branches) for the change, as [described here][branch].
-   If in doubt, use `master`.
-   This can be changed later by [rebasing][rebase].
-
-2. Create a new Git branch, ideally such that:
-   - The name of the branch hints at your change, e.g. `update-hello`.
-   - The branch contains the most recent base branch.
-
-   We'll assume the base branch `master` here.
-
-   ```bash
-   # Make sure you have the latest changes from upstream Nixpkgs
-   git fetch upstream
-
-   # Create and switch to a new branch, based on the base branch in Nixpkgs
-   git switch --create update-hello upstream/master
-   ```
-
-   To avoid potentially having to download and build many derivations, you can base on a specific [Git commit](https://www.git-scm.com/docs/gitglossary#def_commit) instead:
-   - The commit of the latest `nixpkgs-unstable` channel, available [here](https://channels.nixos.org/nixpkgs-unstable/git-revision).
-   - The commit of a local Nixpkgs downloaded using [nix-channel](https://nixos.org/manual/nix/stable/command-ref/nix-channel), available using `nix-instantiate --eval --expr '(import <nixpkgs/lib>).trivial.revisionWithDefault null'`
-   - If you're using NixOS, the commit of your NixOS installation, available with `nixos-version --revision`.
-
-   You can use this commit instead of `upstream/master` in the above command:
-   ```bash
-   # Here, b9c03fbb is an example commit from nixpkgs-unstable
-   git switch --create update-hello b9c03fbb
-   ```
-
-3. Make your changes in the local Nixpkgs repository and:
-   - Adhere to both the [general code conventions][code-conventions], and the relevant [specific code conventions][overview].
-   - Test the changes.
-   - If necessary, document the changes.
-
-   See the [overview section][overview] for more specific information.
-
-4. Commit your changes using `git commit`.
-   Make sure to adhere to the [commit conventions](#commit-conventions).
-
-   Repeat the steps 3-4 as many times as necessary.
-   Advance to the next step once all the commits make sense together.
-   You can view your commits with `git log`.
-
-5. Push your commits to your fork of Nixpkgs:
-   ```
-   git push --set-upstream origin HEAD
-   ```
-
-   The above command will output a link to directly do the next step:
-   ```
-   remote: Create a pull request for 'update-hello' on GitHub by visiting:
-   remote:      https://github.com/myUser/nixpkgs/pull/new/update-hello
-   ```
-
-6. [Create a pull request](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request#creating-the-pull-request) from the new branch in your Nixpkgs fork to the upstream Nixpkgs repository.
-   Use the branch from step 1 as the PR's base branch.
-   Go through the [pull request template][pr-template].
-
-7. Respond to review comments and potentially to CI failures and merge conflicts by updating the PR.
-   Always keep it in a mergeable state.
-
-   The non-technical side of this process is covered in [I opened a PR, how do I get it merged?](#i-opened-a-pr-how-do-i-get-it-merged).
-
-   The [ofborg](https://github.com/NixOS/ofborg) CI system will perform checks to ensure code quality.
-   You can see the results at the bottom of the PR.
-   See [the ofborg Readme](https://github.com/NixOS/ofborg#readme) for more details.
-
-   - To add new commits, repeat steps 3-4 and push the result:
-     ```
-     git push
-     ```
-
-   - To change existing commits, [rewrite the Git history](https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History).
-     Useful Git commands for this are `git commit --patch --amend` and `git rebase --interactive`.
-     With a rewritten history you need to force-push the commits:
-     ```
-     git push --force-with-lease
-     ```
-
-   - If there are merge conflicts, you will have to [rebase the branch](https://git-scm.com/book/en/v2/Git-Branching-Rebasing) onto the current **base branch**.
-     Sometimes this can be done [on GitHub directly](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/keeping-your-pull-request-in-sync-with-the-base-branch#updating-your-pull-request-branch).
-     To rebase locally:
-     ```
-     git fetch upstream
-     git rebase upstream/master
-     git push --force-with-lease
-     ```
-
-     Use the base branch from step 1 instead of `upstream/master`.
-
-   - If you need to change the base branch, [rebase][rebase].
-
-8. If your PR is merged and [acceptable for releases][release-acceptable], you may [backport][pr-backport] it.
-
-### Pull request template
-[pr-template]: #pull-request-template
-
-The pull request template helps to determine which steps have been taken so far.
-Details not covered by the title and links to existing related issues should go at the top.
-
-When a PR is created, it will be pre-populated with some checkboxes.
-
-#### Tested using sandboxing
-
-When sandbox builds are enabled, Nix will set up an isolated environment for each build process.
-It is used to remove further hidden dependencies set by the build environment, to improve reproducibility.
-This includes access to the network during the build outside of `fetch*` functions and files outside the Nix store.
-Depending on the operating system, access to other resources is blocked as well; see [sandbox](https://nixos.org/manual/nix/stable/command-ref/conf-file#conf-sandbox) in the Nix manual for details.
-
-Please test builds with sandboxing enabled, because it is also used in [Hydra](https://nixos.org/hydra).
-
-If you are on Linux, sandboxing is enabled by default.
-On other platforms, sandboxing is disabled by default due to a small performance hit on each build.
-
-Please enable sandboxing **before** building the package by adding the following to `/etc/nix/nix.conf`:
-
-  ```ini
-  sandbox = true
-  ```
-
-#### Built on platform(s)
-
-Many Nix packages are designed to run on multiple platforms.
-As such, it’s important to let the maintainer know which platforms you have tested on.
-It’s not always practical to test all platforms, and it’s not required for a pull request to be merged.
-Only check the platforms you tested the build on in this section.
-
-#### Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
-
-Packages with automated tests are likely merged quicker, because they don’t require as much manual testing.
-If there are existing tests for the package, they should be run.
-NixOS tests can only be run on linux.
-For more details on writing and running tests, see the [section in the NixOS manual](https://nixos.org/nixos/manual/index.html#sec-nixos-tests).
-
-#### Tested compilation of all pkgs that depend on this change using `nixpkgs-review`
-
-If you are modifying a package, you can use `nixpkgs-review` to make sure all packages that depend on the updated package still build.
-It can work on uncommitted changes with the `wip` option or on a specific pull request.
-
-Review changes from pull request number 12345:
-
-```ShellSession
-nix-shell -p nixpkgs-review --run "nixpkgs-review pr 12345"
-```
-
-Alternatively, with flakes (and analogously for the other commands below):
-
-```ShellSession
-nix run nixpkgs#nixpkgs-review -- pr 12345
-```
-
-Review uncommitted changes:
-
-```ShellSession
-nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
-```
-
-Review changes from the last commit:
-
-```ShellSession
-nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"
-```
-
-#### Tested execution of all binary files (usually in `./result/bin/`)
-
-It's important to test a modified package's executables.
-Look into `./result/bin` and run all files in there, or at a minimum, the main executable.
-For example, if you make a change to `texlive`, you probably would only check the binaries associated with the change you made, rather than testing all of them.
-
-#### Meets Nixpkgs contribution standards
-
-The last two checkboxes are about whether it fits the guidelines in this `CONTRIBUTING.md` file.
-This document details our standards for commit messages, reviews, licensing of contributions, etc...
-Everyone should read and understand these standards before submitting a pull request.
-
-### Rebasing between branches (i.e. from `master` to `staging`)
-[rebase]: #rebasing-between-branches-ie-from-master-to-staging
-
-Sometimes, changes must be rebased between branches.
-One example is, if the number of rebuilds caused is too large for the original target branch.
-
-In the following example, the current `feature` branch is based on `master`, and we rebase it to have the PR target `staging`.
-We rebase on the _merge base_ between `master` and `staging` to avoid too many local rebuilds.
-
-
-```console
-# Rebase your commits onto the common merge base
-git rebase --onto upstream/staging... upstream/master
-# Force push your changes
-git push origin feature --force-with-lease
-```
-
-The syntax `upstream/staging...` is equivalent to `upstream/staging...HEAD` and stands for the merge base between `upstream/staging` and `HEAD` (hence between `upstream/staging` and `upstream/master`).
-
-Then use the *Edit* button in the upper right corner of the GitHub PR, and switch the base branch from `master` to `staging`.
-*After* the PR has been retargeted, a final rebase onto the target branch might be needed to resolve merge conflicts.
-
-```console
-# Rebase onto target branch
-git rebase upstream/staging
-# Review and fixup possible conflicts
-git status
-# Force push your changes
-git push origin feature --force-with-lease
-```
-
-## How to backport pull requests
-[pr-backport]: #how-to-backport-pull-requests
-
-Once a PR has been merged, a backport to the corresponding `release-YY.MM` branch can be created.
-
-### Automatically backporting changes
-
-> [!Note]
-> You have to be a [Nixpkgs maintainer](./maintainers) to automatically create a backport pull request.
-
-Add the [`backport release-YY.MM` label](https://github.com/NixOS/nixpkgs/labels?q=backport) to the PR on the `master` branch.
-This will cause [a GitHub Action](.github/workflows/backport.yml) to open a new PR to the `release-YY.MM` branch a few minutes later.
-This can be done on both open or already merged pull requests.
-
-### Manually backporting changes
-
-To manually create a backport, follow [the standard pull request process][pr-create], but:
-
-- Use `release-YY.MM` for the base branch, both for the local branch and the pull request.
-
-> [!Warning]
-> Do not use the `nixos-YY.MM` branch.
-> It points to the latest _tested_ release channel commit.
-
-- Instead of manually making and committing the changes, use [`git cherry-pick -x`](https://git-scm.com/docs/git-cherry-pick) for each commit.
-  Use `git cherry-pick -x <commit>` when the reason is obvious, for example for minor version bumps and fixes.
-  Otherwise, use `git cherry-pick -xe <commit>` to add a reason for the backport.
-  Here is [an example](https://github.com/nixos/nixpkgs/commit/5688c39af5a6c5f3d646343443683da880eaefb8).
-
-> [!Warning]
-> Ensure the commits exist on the `master` branch.
-> In the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the `master` pull request.
-
-- In the pull request description, link to the original pull request to `master`.
-  The pull request title should include `[YY.MM]` matching the release you're backporting to.
-
-## How to review pull requests
-[pr-review]: #how-to-review-pull-requests
-
-The Nixpkgs project receives a high number of pull requests.
-Anyone may review and approve PRs and it is an important contribution to the project.
-
-The high change rate makes any PR that remains open for too long subject to merge conflicts.
-To avoid extra work, reviewing PRs timely and being responsive is key.
-GitHub provides sort filters to see the [most recently updated](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+sort%3Aupdated-desc) pull requests.
-We highly encourage looking at [this list of ready to merge, unreviewed pull requests](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+review%3Anone+status%3Asuccess+no%3Aproject+no%3Aassignee+no%3Amilestone).
-
-Controversial changes can lead to controversial opinions, but it is important to respect every community member and their work.
-Always be nice and polite.
-
-GitHub provides reactions for quick feedback to pull requests or comments.
-The thumb-down reaction should be used with care and, if possible, accompanied with explanation for the submitter to improve their contribution.
-
-When doing a review:
-- Aim to drive the proposal to a timely conclusion.
-- Focus on the proposed changes and keep the scope narrow.
-- Help the contributor prioritise their efforts towards getting their change merged.
-
-If you find anything related that could be improved but is not immediately required for acceptance, consider:
-- Implementing the changes yourself in a follow-up pull request,
-- Tracking your idea in an issue,
-- Offering to review a follow-up pull request,
-- Making concrete [suggestions](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/incorporating-feedback-in-your-pull-request) in the same pull request.
-
-For example, follow-up changes could involve refactoring code in the affected files.
-
-But please remember not to make such additional considerations a blocker, and communicate that to the contributor, for example by following the [conventional comments](https://conventionalcomments.org) pattern.
-If the related change is essential for the contribution at hand, make clear why you think it is important to address that first.
-
-Pull request reviews should include a list of what has been reviewed in a comment, so other reviewers and mergers can know the state of the review.
-
-All the review templates provided are generic examples.
-Their usage is optional and the reviewer is free to adapt them.
-
-To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].
-
-If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-team](https://github.com/orgs/nixos/teams/documentation-team) on the pull request.
-
-If you have enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic.
-The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests or git-blaming the code can give some hints.
-
-## How to merge pull requests yourself
-[pr-merge]: #how-to-merge-pull-requests
-
-You can invoke the nixpkgs-merge-bot by commenting `@NixOS/nixpkgs-merge-bot merge`.
-The bot will verify the following conditions, refusing to merge otherwise:
-
-- the PR author should be @r-ryantm or a Nixpkgs committer;
-- the invoker should be among the package maintainers on the targeted branch;
-- the package should reside in `pkgs/by-name`.
-
-Required status checks prevent PRs that fail them ("PR / ..." jobs) from being merged. Ofborg is not required by the checks.
-
-For other pull requests, please see [I opened a PR, how do I get it merged?](#i-opened-a-pr-how-do-i-get-it-merged).
-
-In case the PR is stuck waiting for the author to apply a trivial change and the author allowed members to modify the PR, consider applying it yourself.
-You should pay extra attention to make sure the addition doesn't go against the idea of the original PR and would not be opposed by the author.
-
-Please see the [`nixpkgs-committers` repository](https://github.com/NixOS/nixpkgs-committers) for information on how to proceed to be granted this level of access.
-
-As a maintainer, when you leave the Nix community, please create an issue or post on [Discourse](https://discourse.nixos.org) with references to the packages and modules you maintained, so they can be taken over by other contributors.
-
-# Flow of merged pull requests
-
-After a pull request is merged, it eventually makes it to [Hydra](https://hydra.nixos.org).
-Hydra regularly evaluates and builds Nixpkgs, updating [the official channels](https://channels.nixos.org) when their jobs succeed.
-See [Nix Channel Status](https://status.nixos.org) for the current channel states.
-
-Our primary development branches and their related channels are:
-
-- `master`: The main branch, used for the unstable channels `nixos-unstable`, `nixos-unstable-small` and `nixpkgs-unstable`.
-- `release-YY.MM`: The release branches, used for the stable channels `nixos-YY.MM`, `nixos-YY.MM-small` and `nixpkgs-YY.MM-darwin`.
-
-When a channel is updated, its corresponding branch is also updated to the same commit.
-Example: The [`nixpkgs-unstable` branch](https://github.com/nixos/nixpkgs/tree/nixpkgs-unstable) corresponds to the commit from the [`nixpkgs-unstable` channel](https://channels.nixos.org/nixpkgs-unstable).
-
-Nixpkgs is tied to the NixOS release process, which is documented in the [NixOS Release Wiki](https://nixos.github.io/release-wiki/).
-
-See [this section][branch] to know when to use the release branches.
-
-## Staging
-[staging]: #staging
-
-The staging workflow exists to batch Hydra builds of many packages together.
-It is coordinated in the [Staging room](https://matrix.to/#/#staging:nixos.org) on Matrix.
-
-It works by directing commits that cause [mass rebuilds][mass-rebuild] to a separate `staging` branch that isn't directly built by Hydra.
-Regularly, the `staging` branch is _manually_ merged into a `staging-next` branch to be built by Hydra using the [`nixpkgs:staging-next` jobset](https://hydra.nixos.org/jobset/nixpkgs/staging-next).
-The `staging-next` branch should then only receive changes that fix Hydra builds; **for anything else, ask the [Staging room](https://matrix.to/#/#staging:nixos.org) first**.
-Once it is verified that there are no major regressions, `staging-next` is merged into `master` using [a pull request](https://github.com/NixOS/nixpkgs/issues?q=label%3A%224.workflow%3A+staging%22).
-This is done manually to ensure it's a good use of Hydra's computing resources.
-Since `staging-next` is separate from `staging`, you may merge changes into `staging` at any time.
-
-In order for the `staging` and `staging-next` branches to be up-to-date with the latest commits on `master`, there are regular _automated_ merges from `master` into `staging-next`, and from `staging-next` into `staging`.
-This is implemented using GitHub workflows [here](.github/workflows/periodic-merge-6h.yml) and [here](.github/workflows/periodic-merge-24h.yml).
-
-> [!Note]
-> Changes must be well tested before being merged into any branch.
-> Hydra builds should not be used as a testing platform.
-
-Here is a Git history diagram showing the flow of commits between the three branches:
-```mermaid
-%%{init: {
-    'theme': 'base',
-    'themeVariables': {
-        'gitInv0': '#ff0000',
-        'gitInv1': '#ff0000',
-        'git2': '#ff4444',
-        'commitLabelFontSize': '15px'
-    },
-    'gitGraph': {
-        'showCommitLabel':true,
-        'mainBranchName': 'master',
-        'rotateCommitLabel': true
-    }
-} }%%
-gitGraph
-    commit id:" "
-    branch staging
-    commit id:"  "
-    branch staging-next
-
-    merge master id:"automatic"
-    checkout staging
-    merge staging-next id:"automatic "
-
-    checkout staging-next
-    merge staging type:HIGHLIGHT id:"manual"
-    commit id:"fixup"
-
-    checkout master
-    checkout staging
-    checkout master
-    commit id:"       "
-    checkout staging-next
-    merge master id:"automatic  "
-    checkout staging
-    merge staging-next id:"automatic   "
-
-    checkout staging-next
-    commit id:"fixup "
-    checkout master
-    merge staging-next type:HIGHLIGHT id:"manual (PR)"
-```
-
-
-Here's an overview of the different branches:
-
-| branch | `master` | `staging-next` | `staging` | [`staging-nixos`][test-driver-rebuild] |
-| --- | --- | --- | --- | --- |
-| Used for development | ✔️ | ❌ | ✔️ | ✔️ |
-| Built by Hydra | ✔️ | ✔️ | ❌ | ❌ |
-| [Mass rebuilds][mass-rebuild] | ❌ | ⚠️  Only to fix Hydra builds | ✔️ | ❌[^1]  |
-| Critical security fixes | ✔️ for non-mass-rebuilds | ✔️ for mass-rebuilds | ❌ | ✔️ |
-| Automatically merged into | `staging-next` & `staging-nixos` | `staging` | - | - |
-| Manually merged into | - | `master` | `staging-next` | `master` |
-
-The staging workflow is used for all stable branches with corresponding names:
-- `master`/`release-YY.MM`
-- `staging`/`staging-YY.MM`
-- `staging-next`/`staging-next-YY.MM`
-- `staging-nixos`/`staging-nixos-YY.MM`
-
-[^1]: Except changes that cause no more rebuilds than kernel updates
-
-# Conventions
-
-## Branch conventions
-<!-- This section is relevant to both contributors and reviewers -->
-[branch]: #branch-conventions
-
-Most changes should go to `master`, but sometimes other branches should be used instead.
-Use the following decision process to figure out the right branch:
-
-Is the change [acceptable for releases][release-acceptable] and do you wish to have the change in the release?
-- No: Use the `master` branch, do not backport the pull request.
-- Yes: Can the change be implemented the same way on the `master` and release branches?
-  For example, a package's major version might differ between the `master` and release branches, such that separate security patches are required.
-  - Yes: Use the `master` branch and [backport the pull request](#how-to-backport-pull-requests).
-  - No: Create separate pull requests to the `master` and `release-YY.MM` branches.
-
-If the change causes a [mass rebuild][mass-rebuild], use the `staging` branch instead:
-- Mass rebuilds to `master` should go to `staging` instead.
-- Mass rebuilds to `release-YY.MM` should go to `staging-YY.MM` instead.
-
-See [this section][staging] for how such changes propagate between the branches.
-
-### Changes acceptable for releases
-[release-acceptable]: #changes-acceptable-for-releases
-
-Only changes to _supported_ releases may be accepted.
-The oldest supported release (`YYMM`) can be found using
-```
-nix-instantiate --eval -A lib.trivial.oldestSupportedRelease
-```
-
-The release branches should generally only receive backwards-compatible changes, both for the Nix expressions and derivations.
-Here are some examples of changes that are okay to backport:
-- ✔️ New packages, modules and functions
-- ✔️ Security fixes
-- ✔️ Package version updates
-  - ✔️ Patch versions with fixes
-  - ✔️ Minor versions with new functionality, but no breaking changes
-
-In addition, major package version updates with breaking changes are also acceptable for:
-- ✔️ Services that would fail without up-to-date client software, such as `spotify`, `steam`, and `discord`
-- ✔️ Security critical applications, such as `firefox` and `chromium`
-
-### Changes causing mass rebuilds
-[mass-rebuild]: #changes-causing-mass-rebuilds
-
-Which changes cause mass rebuilds is not formally defined.
-In order to help the decision, CI automatically assigns [`rebuild` labels](https://github.com/NixOS/nixpkgs/labels?q=rebuild) to pull requests based on the number of packages they cause rebuilds for.
-As a rule of thumb, if the number of rebuilds is **500 or more**, consider targeting the `staging` branch instead of `master`; if the number is **1000 or more**, the pull request causes a mass rebuild, and should target the `staging` branch.
-See [previously merged pull requests to the staging branches](https://github.com/NixOS/nixpkgs/issues?q=base%3Astaging+-base%3Astaging-next+is%3Amerged) to get a sense for what changes are considered mass rebuilds.
-
-Please note that changes to the Linux kernel are an exception to this rule.
-These PRs go to `staging-nixos`, see [the next section for more context](#changes-rebuilding-all-tests).
-
-### Changes rebuilding all NixOS tests
-[test-driver-rebuild]: #changes-rebuilding-all-nixos-tests
-
-Changes causing a rebuild of all NixOS tests get a special [`10.rebuild-nixos-tests`](https://github.com/NixOS/nixpkgs/issues?q=state%3Aopen%20label%3A10.rebuild-nixos-tests) label.
-These changes pose a significant impact on the build infrastructure.
-
-Hence, these PRs should either target a `staging`-branch or `staging-nixos`-branch, provided one of following conditions applies:
-
-* The label `10.rebuild-nixos-tests` is set, or
-* The PR is a change affecting the Linux kernel.
-
-The branch gets merged whenever mainline kernel updates or critical security fixes land on the branch.
-This usually happens on a weekly basis.
-
-Backports are not handled by such a branch.
-The relevant PRs from this branch must be backported manually.
-
-## Commit conventions
-[commit-conventions]: #commit-conventions
-
-- Create one commit for each logical unit.
-
-- If you have commits `pkg-name: oh, forgot to insert whitespace`: squash commits in this case.
-  Use `git rebase -i`.
-  See [Squashing Commits](https://git-scm.com/book/en/v2/Git-Tools-Rewriting-History#_squashing) for additional information.
-
-- For consistency, there should not be a period at the end of the commit message's summary line (the first line of the commit message).
-
-- When adding yourself to `maintainer-list.nix`, make a separate commit with the message `maintainers: add <handle>`.
-  Add the commit before those making changes to the package or module.
-  See [Nixpkgs Maintainers](./maintainers/README.md) for details.
-
-- Make sure you read about any commit conventions specific to the area you're touching.
-  See:
-  - [Commit conventions](./doc/README.md#commit-conventions) for changes to `doc`, the Nixpkgs manual.
-  - [Commit conventions](./lib/README.md#commit-conventions) for changes to `lib`.
-  - [Commit conventions](./nixos/README.md#commit-conventions) for changes to `nixos`.
-  - [Commit conventions](./pkgs/README.md#commit-conventions) for changes to `pkgs`.
-
-### Writing good commit messages
-[writing-good-commit-messages]: #writing-good-commit-messages
-
-It's important to include relevant information in the *commit message*, so others can later understand *why* a change was made.
-While this potentially can be understood by reading code, PR discussion or upstream changes, doing so often requires a lot of work.
-
-Simple package version updates need to include the attribute name, old and new versions, as well as a reference to the release notes or changelog.
-Package upgrades with more extensive changes require more verbose commit messages.
-
-## Review and Merge conventions
-
-Comments on Pull Requests are considered non-blocking by default.
-Every blocking comment must be explicitly marked as such by using GitHub's "Request Changes" review type.
-A reviewer who submits a blocking review should be available for discussion and re-review.
-An abandoned review may be dismissed after reasonable time was given at the discretion of the merger.
-
-All suggestions for change, blocking or not, should be acknowledged before merge.
-This can happen implicitly by applying the suggestion, or explicitly by rejecting it.
-
-To make changes on commit structure and commit messages or apply simple suggestions, committers are encouraged to [checkout the PR](https://cli.github.com/manual/gh_pr_checkout) and push directly to the contributor's branch before merging.
-Committers will carefully weigh the cost of another review cycle against the feelings of the contributor when pushing to their branch.
-They should also transparently communicate which changes they made.
-If a contributor does not want committers to push to their branch, they must uncheck the "Allow edits and access to secrets by maintainers" box explicitly.
-
-> [!WARNING]
-> Committers: Branches created via `gh pr checkout` can't be pushed with `--force-with-lease`, so do a sanity check before pushing.
-
-## Code conventions
-[code-conventions]: #code-conventions
-
-### Release notes
-
-If you removed packages or made some major NixOS changes, write about it in the next release notes in [`nixos/doc/manual/release-notes`](./nixos/doc/manual/release-notes).
-
-### File naming and organisation
-
-Names of files and directories should be in lowercase, with dashes between words — kebab case, not camel case.
-For instance, it should be `all-packages.nix`, not `allPackages.nix` or `AllPackages.nix`.
-
-### Formatting
-
-CI [enforces](./.github/workflows/lint.yml) all Nix files to be formatted using the [official Nix formatter](https://github.com/NixOS/nixfmt).
-
-You can ensure this locally using either of these commands:
-```
-nix-shell --run treefmt
-nix develop --command treefmt
-nix fmt
-```
-
-If you're starting your editor in `nix-shell` or `nix develop`, you can also set it up to automatically run `treefmt` on save.
-
-If you have any problems with formatting, please ping the [formatting team](https://nixos.org/community/teams/formatting/) via [@NixOS/nix-formatting](https://github.com/orgs/NixOS/teams/nix-formatting).
-
-### Syntax
-
-- Set up [editorconfig](https://editorconfig.org) for your editor, such that [the settings](./.editorconfig) are automatically applied.
-
-- Use `lowerCamelCase` for variable names, not `UpperCamelCase`.
-  Note, this rule does not apply to package attribute names, which instead follow the rules in [package naming](./pkgs/README.md#package-naming).
-
-- Functions should list their expected arguments as precisely as possible.
-  That is, write
-
-  ```nix
-  {
-    stdenv,
-    fetchurl,
-    perl,
-  }:
-  <...>
-  ```
-
-  instead of
-
-  ```nix
-  args: with args; <...>
-  ```
-
-  or
-
-  ```nix
-  {
-    stdenv,
-    fetchurl,
-    perl,
-    ...
-  }:
-  <...>
-  ```
-
-  For functions that are truly generic in the number of arguments, but have some required arguments, you should write them using an `@`-pattern:
-
-  ```nix
-  {
-    stdenv,
-    doCoverageAnalysis ? false,
-    ...
-  }@args:
-
-  stdenv.mkDerivation (args // { foo = if doCoverageAnalysis then "bla" else ""; })
-  ```
-
-  instead of
-
-  ```nix
-  args:
-
-  args.stdenv.mkDerivation (
-    args
-    // {
-      foo = if args ? doCoverageAnalysis && args.doCoverageAnalysis then "bla" else "";
-    }
-  )
-  ```
-
-- Unnecessary string conversions should be avoided.
-  Do
-
-  ```nix
-  { tag = version; }
-  ```
-
-  instead of
-
-  ```nix
-  { tag = "${version}"; }
-  ```
-
-- Building lists conditionally _should_ be done with `lib.optional(s)` instead of using `if cond then [ ... ] else null` or `if cond then [ ... ] else [ ]`.
-
-  ```nix
-  { buildInputs = lib.optional stdenv.hostPlatform.isDarwin iconv; }
-  ```
-
-  instead of
-
-  ```nix
-  { buildInputs = if stdenv.hostPlatform.isDarwin then [ iconv ] else null; }
-  ```
-
-  As an exception, an explicit conditional expression with null can be used when fixing an important bug without triggering a mass rebuild.
-  If this is done a follow up pull request _should_ be created to change the code to `lib.optional(s)`.
-
-- Any style choices not covered here but that can be expressed as general rules should be left at the discretion of the authors of changes and _not_ commented in reviews.
-  The purpose of this is:
-   - to avoid churn as contributors with different style preferences undo each other's changes,
-   - to ensure that style rules are written down and consistent (and can thus be followed when authoring changes, reducing review cycles),
-   - and to encourage reviews to focus on more impactful considerations.
-
-# Practical contributing advice
-
-To contribute effectively and efficiently, you need to be aware of how the process generally works.
-This section aims to document the process as we live it in Nixpkgs to set the right expectations and give practical tips on how to work with it.
-
-## I opened a PR, how do I get it merged?
-[i-opened-a-pr-how-do-i-get-it-merged]:#i-opened-a-pr-how-do-i-get-it-merged
-
-In order for your PR to be merged, a committer needs to review and merge it.
-Because committers are mostly independent, unpaid volunteers, this can take time.
-It is entirely normal for your PR to sit around without any feedback for days, weeks or sometimes even months.
-We strive to avoid this, but the reality is that it happens frequently.
-Even when you get feedback, follow-ups may take just as long.
-Don't be intimidated and kindly ask for feedback again every so often.
-If your change is good, it will eventually be merged.
-
-You can often speed up the process by understanding the committer's perspective and preparing your PR with reviewing in mind.
-
-### The committer's perspective
-
-PRs have varying quality and even the best people make mistakes.
-Committers need to assess whether a PR's changes are good or not.
-To merge, at least one committer has to be confident about its quality.
-
-Committers typically assess three aspects:
-
-1. Whether the change's intention is necessary and desirable.
-2. Whether the code quality of your changes is good.
-3. Whether the produced artifacts are good.
-
-To get your PR merged quickly and smoothly, you should help convince committers in these aspects.
-
-### How to help committers assess your PR
-
-It's best to explain *why* you've made your change, because guessing the intention is not always possible.
-This does not apply to trivial changes like version updates, because the intention is obvious.
-For more nuanced changes or even major version upgrades, it helps if you explain the background behind your change.
-For example, if you're adding a package, explain what it is and why it should be in Nixpkgs.
-This goes hand in hand with [Writing good commit messages](#writing-good-commit-messages).
-
-To show the quality of your code, you should focus on making it *reviewable*.
-First, take a look at your code changes yourself and try to put yourself into the shoes of someone who didn't just write that code.
-Would you immediately know what the code does or why it is needed by glancing at it?
-If not, reviewers will notice this and will ask you to clarify the code by refactoring it and/or adding code comments.
-Doing this preemptively can save a lot of time.
-Doing multiple unrelated changes in a single commit can become hard to review quickly.
-Thus, consider multiple atomic commits to tell the story of your change.
-There is a balance to strike however: over-fragmentation causes friction.
-
-The artifacts are the hardest to assess because PRs touch all sorts of components: applications, libraries, NixOS modules, editor plugins and many other things.
-Any individual committer can only really assess components that they themselves know how to use.
-Yet, they must still be convinced somehow.
-There isn't a good generic solution to this but there are some ways to ease it:
-
-- Provide smoke tests that can be run without much research or setup.
-
-  Committers usually don't have the time or interest to learn how your component works and how they could test its functionality.
-  Try to provide a quick guide on how to use it in a meaningful way or a ready-made command that demonstrates that it works as expected.
-  The committer can use this to convince themselves that your change is good.
-  If it can be automated, you could even turn this into an automated NixOS test which reviewers could simply run.
-
-- Invite other users of the component to try it out and report their findings.
-
-  Seeing other users testing the changes and having it work for them can convince committers, too.
-
-- Describe what you have done to test your PR.
-
-  It also helps, if you can additionally show that you have done sufficient quality assurance on your changes.
-
-- Become a maintainer of the component.
-
-  Listed maintainers generally receive more trust when it comes to changes to their maintained components.
-
-Even if you adhere to all of these recommendations, it is still quite possible for your PR to be forgotten or abandoned by any given committer.
-Please remain mindful of them doing this work on their own volition and unpaid in their free time and therefore [owing you nothing](https://mikemcquaid.com/open-source-maintainers-owe-you-nothing/).
-Causing a stink in such a situation is a surefire way to get any other potential committer to not want to look at your PR either.
-Ask them nicely whether they still intend to review your PR and find yourself another committer to look at your PR if not.
-
-### How can I get a committer to look at my PR?
-
-- Improve skimmability: use a simple descriptive PR title outlining _what_ is done and _why_.
-  Details go in commit messages.
-- Improve discoverability: apply all relevant labels, tick all relevant PR body checkboxes.
-- Wait.
-  Reviewers frequently browse open PRs and may happen to run across yours and take a look.
-- Get non-committers to review/approve.
-  Many committers filter open PRs for low-hanging fruit that have already been reviewed.
-- [@-mention](https://github.blog/news-insights/mention-somebody-they-re-notified/) someone and ask them nicely.
-- Post in one of the channels made for this purpose if there has been no activity for at least one week:
-  - The current "PRs ready for review" or "PRs already reviewed" threads in the [NixOS Discourse](https://discourse.nixos.org/c/dev/14).
-  - The [Nixpkgs Review Requests Matrix room](https://matrix.to/#/#review-requests:nixos.org).
-  - Similar threads/rooms in unofficial NixOS spaces, such as Discord.
-
-### CI failed or got stuck on my PR, what do I do?
-
-First, ensure that the failure is actually related to your change.
-Sometimes, the CI system simply has a hiccup or the check was broken by someone else before.
-Read through the error message; it's usually quite easy to tell whether it is caused by changes to the component you touched.
-If it is indeed caused by your change, try to fix it.
-Don't be afraid of asking for advice if you're uncertain how to do that, others might have fixed such issues already and can help you out.
-Your PR will not be merged while CI is still failing.
-
-ofborg builds can often get stuck, particularly in PRs targeting `staging` and in builders for the Darwin platform.
-Reviewers will know how to handle them or when to ignore them.
-Don't worry about it.
-However, if there is a build failure and it was caused by your change, you need to investigate it.
-If ofborg reveals the build to be broken on a platform that you don't have access to, consider setting your package's `meta.broken`, `meta.badPlatforms` or `meta.platforms` accordingly.
-
-When in any doubt, please ask via comments or through one of the help channels.
-
-## I received a review, how do I get it over the finish line?
-
-Most likely, a reviewer wants you to change a few things or requires further input.
-
-A reviewer may have taken a look at the code and it looked good to them ("Diff LGTM"), but they still need to be convinced of the artifact's quality.
-They might also be waiting on input from other users or maintainers on whether the intention and direction of your PR makes sense.
-If you know of people who could help clarify any of this, please bring the PR to their attention.
-The current state of the PR is frequently not clearly communicated, so please don't hesitate to ask about it if it's unclear to you.
-
-It's also possible for the reviewer to not be convinced that your PR is necessary or that the method you've chosen is the right one.
-
-Please explain your intentions and reasoning to the committer in such a case.
-There may be constraints you had to work with which they're not aware of or qualities of your approach that they didn't immediately notice.
-If these weren't clear to the reviewer, that's a good sign you should explain them in your commit message or code comments!
-
-There are some further pitfalls and realities to be aware of:
-
-### Aim to reduce cycles
-
-Be prepared for it to take a while for the reviewer to get back to you after you respond.
-This is simply the reality of projects at the scale of Nixpkgs.
-As such, make sure to respond to _all_ feedback at once.
-It wastes everyone's time to wait for a couple of days just to have the reviewer need to remind you to address something they asked for.
-
-### A reviewer requested a bunch of insubstantial changes
-
-The people involved in Nixpkgs care about code quality.
-Once in Nixpkgs, the code needs to be maintained for many years to come.
-Therefore, you will likely be asked to do something different or adhere to a standard.
-
-Sometimes however, they also care a bit too much and may ask you to adhere to a personal preference of theirs.
-It's not always easy to tell whether or not the requested changes must be addressed.
-Sometimes, another reviewer may even have a _conflicting_ opinion on some points.
-
-It is convention to mark review comments that are not required to merge as nitpicks, but this is not always followed.
-As the author, you should still take a look at these, as they will often reveal best practices and unwritten rules.
-Those usually have good reasons behind them and you may want to pick them up as well.
-
-Please keep in mind that reviewers always mean well.
-Their intent is not to denounce your code, they want your code to be as good as it can be.
-Through their experience, they may also take notice of a seemingly insignificant issue that has caused problems before.
-
-Sometimes however, they can also get a bit carried away and become too perfectionistic.
-If you feel some of the requests are unreasonable, out of scope, or merely a matter of personal preference, try to nicely ask the reviewers whether these requests are *critical* to the PR's success.
-
-While we do have a set of [official standards for the Nix community](https://github.com/NixOS/rfcs), we don't have standards for everything and there are often multiple valid ways to achieve the same goal.
-Unless there are standards forbidding the patterns used in your code or there are serious technical, maintainability or readability issues with your code, you can disregard these requests.
-Please communicate this clearly though; a simple "I prefer it this way and see no major issue maintaining it" can save a lot of arguing.
-
-If you are unsure about some change requests, please ask reviewers *why* they requested them.
-This will usually reveal how important they deem it to be and will help educate you about standards, best practices, unwritten rules as well as preferences people have and why.
-
-Some committers have stronger opinions on some things and may not want to merge your PR if you don't follow their requests.
-It is totally fine to get yourself a second or third opinion in such a case.
-
-### Committers work on a push-basis
-
-It's possible for you to get a review but nothing happens afterwards, even if you respond to review comments.
-A committer not following up on your PR does not necessarily mean they're disinterested, they may have simply had other circumstances preventing them from doing so.
-
-Committers typically handle many PRs at the same time and it is not realistic for them to keep up with all of them immediately.
-If someone approved and didn't merge a few days later, they most likely just forgot.
-
-Please see it as your responsibility to actively remind reviewers of your open PRs.
-
-The easiest way to do so is to notify them via GitHub.
-GitHub notifies people involved, whenever you add a comment or push to your PR or re-request their review.
-Doing any of that will get their attention again.
-Everyone deserves proper attention, and yes, that includes you!
-However, please be mindful that committers can sadly not always give everyone the attention they deserve.
-
-It may very well be the case that you have to do this every time you need the committer to follow up upon your PR.
-Again, this is a community project so please be mindful of people's circumstances here; be nice when requesting reviews again.
-
-It may also be the case that the committer has lost interest or isn't familiar enough with the component you're touching to be comfortable to merge.
-They will likely not immediately state that fact, so please ask for clarification and don't hesitate to find yourself another committer to take a look.
-
-### Nothing helped
-
-If you followed these guidelines but still got no results or if you feel that you have been wronged, please explicitly reach out to the greater community.
-
-The [NixOS Discourse](https://discourse.nixos.org) is a great place to do this, as it has historically been the asynchronous medium with the greatest concentration of committers and other people who are involved in Nixpkgs.
-There is a dedicated discourse thread [PRs in distress](https://discourse.nixos.org/t/prs-in-distress/3604) where you can link your PR, if everything else fails.
-The [Nixpkgs / NixOS contributions Matrix channel](https://matrix.to/#/#dev:nixos.org) is the best synchronous channel with the same qualities.
-
-Please reserve these for cases where you've made a serious effort in trying to get the attention of multiple active committers and provided realistic means for them to assess your PR's quality.
-As mentioned previously, it is unfortunately perfectly normal for a PR to sit around for weeks.
-
-Please don't blow up situations where progress is happening but is merely not going fast enough for your tastes.
-Honking in a traffic jam will not make you go any faster.
-
-# Automation/AI policy
-
-Every contribution to Nixpkgs and related development venues, including code, documentation, and communication on GitHub and Matrix, must have a **responsible person in the loop** who is accountable for that contribution and reviews it before submission, and must **transparently disclose** any non‐trivial use of automation to produce it, including but not limited to LLM‐based AI tools.
-
-The following sections give more detail.
-
-## Scope
-
-Any use of automated tools to generate non‐trivial amounts of output as part of a contribution, in whole or in part, verbatim or edited, is covered by this policy, except as listed in the Exemptions section.
-Both LLM‐based AI tools and hand‐written automation are covered.
-Contributions include code and documentation in commits, commit messages, pull request summaries and reviews, issue and vulnerability reports, GitHub comments, Matrix messages, and Discourse posts.
-The covered venues are the GitHub repositories for Nixpkgs and [related projects](https://github.com/orgs/NixOS/teams/nixpkgs-core/repositories) under the jurisdiction of the Nixpkgs core team, Matrix rooms that are focused on development of those projects, and Discourse topics about Nixpkgs development.
-
-## Accountability
-
-Everyone who submits a contribution to Nixpkgs is responsible for it, regardless of the use of automated tooling.
-Before submission, they must establish a reasonable level of understanding of the contribution and expectation of its correctness.
-A contributor submitting a contribution intended for inclusion in Nixpkgs is also responsible for ensuring that it is [appropriately licensed](https://github.com/NixOS/nixpkgs/blob/master/COPYING) and credited, and not encumbered by any incompatible copyright.
-
-When output from automated tooling is used in contributions, a contributor must establish confidence in that output.
-This can be achieved by establishing confidence in the correctness of the tooling’s logic, manual review of the included output, or using further automation to verify the output (e.g. programmatically checking whether a refactor avoids causing rebuilds).
-As the inner workings of LLM‐based AI tools cannot be sufficiently understood at present, only the latter two options are available when those are used; vibe coding without review is not permitted.
-When automation is used to verify output, the verification tooling itself must be disclosed and reviewed in line with this policy.
-
-This policy applies equally to any further discussion of a contribution.
-Comments and reviews must separately satisfy the same requirements of understanding, review, and disclosure.
-Contributors are expected to be able to answer questions about their contribution and respond to feedback appropriately, without simply forwarding messages back and forth to automated tools.
-
-It is not permitted to submit automated contributions without any manual review or intervention, outside of standard community automation.
-Automation without any manual review must not be used as the sole arbiter of whether to merge a change.
-
-## Transparency
-
-All covered use of automated tooling for a contribution must be disclosed as part of that contribution.
-
-In the case of LLM‐based AI tooling used for commits, this **must** be in the form of an `Assisted-by:` Git commit trailer, including at least the tool name and the primary model name and version used for the contribution.
-A `Co-authored-by:` trailer does not satisfy this policy.
-
-Any adequate form of disclosure is permitted for other kinds of tooling and contribution.
-Pull request summaries and review comments must be disclosed separately to commits.
-
-## Exemptions
-
-The following situations are fully or partially exempt:
-
-* Use of standard deterministic editor/IDE/formatter/text transformation tooling to produce changes that the author manually reviews and understands is exempt, including inline “auto‐completion” (even if LLM‐based) of short, rote snippets of text that do not contribute anything beyond boilerplate the author would have written anyway.
-
-* Use of standard community automation is exempt, such as `nix-update`, the official Nixpkgs CI bots, the @r-ryantm update bot, other maintainer‐approved bots that run update scripts, and the Nixpkgs security tracker bot.
-
-* Use of AI tools for research, testing, debugging, or private review is out of scope, if no substantial amount of their output is included in the resulting contribution.
-  However, if these tools had a significant technical influence on your contribution, you are still responsible for it per the Accountability section, and are expected to disclose this where relevant.
-
-* Use of machine translation is exempt from the requirement to understand the translated output.
-  However, the requirements of appropriate confidence in the original text, responsibility, and disclosure still apply, and you are encouraged to additionally include the original untranslated contribution.
-
-* Use of automation in a contribution clearly marked as not being ready for merge (e.g. a draft pull request) is exempt from the requirement for full self‐review, as long as some amount of review has been done and it is expected that the requirements will be met by the time it is marked as ready.
-  This does not waive any other requirement.
-
-* Use of automated tools to develop upstream software packaged inside Nixpkgs is not in scope.
-
-## Enforcement
-
-If you believe that someone is using automation without appropriate disclosure and review, you can politely ask them if that’s the case and point them to this policy as appropriate.
-Please assume good faith and remain civil; it’s not always possible to determine, and it is more likely that someone overlooked this policy than deliberately violated it.
-If you think someone is continuing to break the policy after this, please escalate to the [Nixpkgs core team](https://nixos.org/community/teams/nixpkgs-core/) rather than fighting over it.
-
-If a contribution is clearly in violation of the policy (e.g. the contributor admits it was not followed, or there are AI tool attributions that do not meet our required format), it can be closed or hidden, preferably after informing the contributor of the policy and giving them a chance to address the violations.
-Deliberate violations of this policy are considered to break the [Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) clause against “Wasting other people’s time with low quality contributions, including but not limited to LLM and bot spam”.
-Repeated violations are grounds for further moderation action.
-
-## Credits
-
-This policy takes inspiration from similar policies in [LLVM](https://llvm.org/docs/AIToolPolicy.html), [Mesa](https://gitlab.freedesktop.org/mesa/mesa/-/blob/mesa-26.1.0-rc1/docs/submittingpatches.rst?ref_type=tags), [Fedora](https://docs.fedoraproject.org/en-US/council/policy/ai-contribution-policy/), and the [Linux kernel](https://docs.kernel.org/7.0/process/coding-assistants.html), along with [a proposal by the author of Anubis](https://xeiaso.net/notes/2025/assisted-by-footer/).

COPYING

@@ -1,4 +1,4 @@
-Copyright (c) 2003-2026 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2021 Eelco Dolstra and the Nixpkgs/NixOS contributors
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

README.md

@@ -1,20 +1,16 @@
 <p align="center">
-  <a href="https://nixos.org">
-    <picture>
-      <source media="(prefers-color-scheme: light)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg">
-      <source media="(prefers-color-scheme: dark)" srcset="https://brand.nixos.org/logos/nixos-logo-default-gradient-white-regular-horizontal-minimal.svg">
-      <img src="https://brand.nixos.org/logos/nixos-logo-default-gradient-black-regular-horizontal-minimal.svg" width="500px" alt="NixOS logo">
-    </picture>
-  </a>
+  <a href="https://nixos.org/nixos"><img src="https://nixos.org/logo/nixos-hires.png" width="500px" alt="NixOS logo" /></a>
 </p>
 
 <p align="center">
-  <a href="CONTRIBUTING.md"><img src="https://img.shields.io/github/contributors-anon/NixOS/nixpkgs" alt="Contributors badge" /></a>
-  <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=supporters&color=brightgreen" alt="Open Collective supporters" /></a>
+  <a href="https://www.codetriage.com/nixos/nixpkgs"><img src="https://www.codetriage.com/nixos/nixpkgs/badges/users.svg" alt="Code Triagers badge" /></a>
+  <a href="https://opencollective.com/nixos"><img src="https://opencollective.com/nixos/tiers/supporter/badge.svg?label=Supporter&color=brightgreen" alt="Open Collective supporters" /></a>
 </p>
 
-[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over 140,000 software packages that can be installed with the [Nix](https://nixos.org/nix/) package manager.
-It also implements [NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
+[Nixpkgs](https://github.com/nixos/nixpkgs) is a collection of over
+60,000 software packages that can be installed with the
+[Nix](https://nixos.org/nix/) package manager. It also implements
+[NixOS](https://nixos.org/nixos/), a purely-functional Linux distribution.
 
 # Manuals
 
@@ -25,14 +21,16 @@ It also implements [NixOS](https://nixos.org/nixos/), a purely-functional Linux
 # Community
 
 * [Discourse Forum](https://discourse.nixos.org/)
-* [Matrix Chat](https://matrix.to/#/#space:nixos.org)
-* [Official wiki](https://wiki.nixos.org/)
-* [Community-maintained list of ways to get in touch](https://wiki.nixos.org/wiki/Get_In_Touch#Chat) (Discord, Telegram, IRC, etc.)
+* [IRC - #nixos on freenode.net](irc://irc.freenode.net/#nixos)
+* [NixOS Weekly](https://weekly.nixos.org/)
+* [Community-maintained wiki](https://nixos.wiki/)
+* [Community-maintained list of ways to get in touch](https://nixos.wiki/wiki/Get_In_Touch#Chat) (Discord, Matrix, Telegram, other IRC channels, etc.)
 
 # Other Project Repositories
 
-The sources of all official Nix-related projects are in the [NixOS organization on GitHub](https://github.com/NixOS/).
-Here are some of the main ones:
+The sources of all official Nix-related projects are in the [NixOS
+organization on GitHub](https://github.com/NixOS/). Here are some of
+the main ones:
 
 * [Nix](https://github.com/NixOS/nix) - the purely functional package manager
 * [NixOps](https://github.com/NixOS/nixops) - the tool to remotely deploy NixOS machines
@@ -40,37 +38,66 @@ Here are some of the main ones:
 * [Nix RFCs](https://github.com/NixOS/rfcs) - the formal process for making substantial changes to the community
 * [NixOS homepage](https://github.com/NixOS/nixos-homepage) - the [NixOS.org](https://nixos.org) website
 * [hydra](https://github.com/NixOS/hydra) - our continuous integration system
-* [NixOS Branding](https://github.com/NixOS/branding) - NixOS branding
+* [NixOS Artwork](https://github.com/NixOS/nixos-artwork) - NixOS artwork
 
 # Continuous Integration and Distribution
 
-Nixpkgs and NixOS are built and tested by our continuous integration system, [Hydra](https://hydra.nixos.org/).
+Nixpkgs and NixOS are built and tested by our continuous integration
+system, [Hydra](https://hydra.nixos.org/).
 
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 26.05 release](https://hydra.nixos.org/jobset/nixos/release-26.05)
+* [Continuous package builds for the NixOS 20.09 release](https://hydra.nixos.org/jobset/nixos/release-20.09)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 26.05 release](https://hydra.nixos.org/job/nixos/release-26.05/tested#tabs-constituents)
+* [Tests for the NixOS 20.09 release](https://hydra.nixos.org/job/nixos/release-20.09/tested#tabs-constituents)
 
-Artifacts successfully built with Hydra are published to cache at https://cache.nixos.org/.
-When successful build and test criteria are met, the Nixpkgs expressions are distributed via [Nix channels](https://nix.dev/manual/nix/stable/command-ref/nix-channel.html).
+Artifacts successfully built with Hydra are published to cache at
+https://cache.nixos.org/. When successful build and test criteria are
+met, the Nixpkgs expressions are distributed via [Nix
+channels](https://nixos.org/nix/manual/#sec-channels).
 
 # Contributing
 
-Nixpkgs is among the most active projects on GitHub.
-While thousands of open issues and pull requests might seem like a lot at first, it helps to consider it in the context of the scope of the project.
-Nixpkgs describes how to build tens of thousands of pieces of software and implements a Linux distribution.
-The [GitHub Insights](https://github.com/NixOS/nixpkgs/pulse) page gives a sense of the project activity.
+Nixpkgs is among the most active projects on GitHub. While thousands
+of open issues and pull requests might seem a lot at first, it helps
+consider it in the context of the scope of the project. Nixpkgs
+describes how to build tens of thousands of pieces of software and implements a
+Linux distribution. The [GitHub Insights](https://github.com/NixOS/nixpkgs/pulse)
+page gives a sense of the project activity.
 
-Community contributions are always welcome through GitHub Issues and Pull Requests.
+Community contributions are always welcome through GitHub Issues and
+Pull Requests. When pull requests are made, our tooling automation bot,
+[OfBorg](https://github.com/NixOS/ofborg) will perform various checks
+to help ensure expression quality.
 
-For more information about contributing to the project, please visit the [contributing page](CONTRIBUTING.md).
+The *Nixpkgs maintainers* are people who have assigned themselves to
+maintain specific individual packages. We encourage people who care
+about a package to assign themselves as a maintainer. When a pull
+request is made against a package, OfBorg will notify the appropriate
+maintainer(s). The *Nixpkgs committers* are people who have been given
+permission to merge.
+
+Most contributions are based on and merged into these branches:
+
+* `master` is the main branch where all small contributions go
+* `staging` is branched from master, changes that have a big impact on
+  Hydra builds go to this branch
+* `staging-next` is branched from staging and only fixes to stabilize
+  and security fixes with a big impact on Hydra builds should be
+  contributed to this branch. This branch is merged into master when
+  deemed of sufficiently high quality
+
+For more information about contributing to the project, please visit
+the [contributing page](https://github.com/NixOS/nixpkgs/blob/master/.github/CONTRIBUTING.md).
 
 # Donations
 
-The infrastructure for NixOS and related projects is maintained by a nonprofit organization, the [NixOS Foundation](https://nixos.org/nixos/foundation.html).
-To ensure the continuity and expansion of the NixOS infrastructure, we are looking for donations to our organization.
+The infrastructure for NixOS and related projects is maintained by a
+nonprofit organization, the [NixOS
+Foundation](https://nixos.org/nixos/foundation.html). To ensure the
+continuity and expansion of the NixOS infrastructure, we are looking
+for donations to our organization.
 
-You can donate to the NixOS Foundation through [SEPA bank transfers](https://nixos.org/donate.html) or by using Open Collective:
+You can donate to the NixOS foundation by using Open Collective:
 
 <a href="https://opencollective.com/nixos#support"><img src="https://opencollective.com/nixos/tiers/supporter.svg?width=890" /></a>
 
@@ -78,7 +105,9 @@ You can donate to the NixOS Foundation through [SEPA bank transfers](https://nix
 
 Nixpkgs is licensed under the [MIT License](COPYING).
 
-> [!Note]
-> MIT license does not apply to the packages built by Nixpkgs, merely to the files in this repository (the Nix expressions, build scripts, NixOS modules, etc.).
-It also might not apply to patches included in Nixpkgs, which may be derivative works of the packages to which they apply.
-The aforementioned artifacts are all covered by the licenses of the respective packages.
+Note: MIT license does not apply to the packages built by Nixpkgs,
+merely to the files in this repository (the Nix expressions, build
+scripts, NixOS modules, etc.). It also might not apply to patches
+included in Nixpkgs, which may be derivative works of the packages to
+which they apply. The aforementioned artifacts are all covered by the
+licenses of the respective packages.

ci/OWNERS

@@ -1,538 +0,0 @@
-# This file is used to describe who owns what in this repository.
-# Users/teams will get review requests for PRs that change their files.
-#
-# This file does not replace `meta.maintainers`
-# but is instead used for other things than derivations and modules,
-# like documentation, package sets, and other assets.
-#
-# This file uses the same syntax as the natively supported CODEOWNERS file,
-# see https://help.github.com/articles/about-codeowners/ for documentation.
-# However it comes with some notable differences:
-# - There is no need for user/team listed here to have write access.
-# - No reviews will be requested for PRs that target the wrong base branch.
-#
-# Processing of this file is implemented in workflows/codeowners-v2.yml
-
-# CI
-/.github/*_TEMPLATE*                    @SigmaSquadron
-/.github/actions                        @NixOS/nixpkgs-ci
-/.github/workflows                      @NixOS/nixpkgs-ci
-/ci                                     @NixOS/nixpkgs-ci
-/ci/OWNERS                              @infinisil @philiptaron
-
-# Development support
-/.editorconfig @Mic92
-/shell.nix @infinisil @NixOS/Security
-
-# Libraries
-/lib                        @infinisil @hsjobeki
-/lib/generators.nix         @infinisil @hsjobeki
-/lib/cli.nix                @infinisil @hsjobeki
-/lib/debug.nix              @infinisil @hsjobeki
-/lib/asserts.nix            @infinisil @hsjobeki
-/lib/path/*                 @infinisil @hsjobeki
-/lib/fileset                @infinisil @hsjobeki
-/maintainers/github-teams.json @infinisil
-/maintainers/computed-team-list.nix @infinisil
-## Standard environment–related libraries
-/lib/customisation.nix      @alyssais @NixOS/stdenv
-/lib/derivations.nix        @NixOS/stdenv
-/lib/fetchers.nix           @alyssais @NixOS/stdenv
-/lib/meta.nix               @alyssais @NixOS/stdenv
-/lib/source-types.nix       @alyssais @NixOS/stdenv
-/lib/systems                @alyssais @NixOS/stdenv
-## Libraries / Module system
-/lib/modules.nix            @infinisil @roberth @hsjobeki
-/lib/types.nix              @infinisil @roberth @hsjobeki
-/lib/options.nix            @infinisil @roberth @hsjobeki
-/lib/tests/modules.sh       @infinisil @roberth @hsjobeki
-/lib/tests/modules          @infinisil @roberth @hsjobeki
-
-# Nixpkgs Internals
-/default.nix                                     @Ericson2314
-/pkgs/top-level/default.nix                      @Ericson2314
-/pkgs/top-level/impure.nix                       @Ericson2314
-/pkgs/top-level/stage.nix                        @Ericson2314
-/pkgs/top-level/splice.nix                       @Ericson2314
-/pkgs/top-level/release-cross.nix                @Ericson2314
-/pkgs/top-level/by-name-overlay.nix              @infinisil @philiptaron
-/pkgs/top-level/config.nix                       @jopejoe1
-/pkgs/top-level/make-tarball.nix                 @jopejoe1
-/pkgs/top-level/packages-config.nix              @jopejoe1
-/pkgs/top-level/packages-info.nix                @jopejoe1
-/pkgs/top-level/release-lib.nix                  @jopejoe1
-/pkgs/top-level/release.nix                      @jopejoe1
-/pkgs/stdenv                                     @philiptaron @NixOS/stdenv
-/pkgs/stdenv/generic                             @Ericson2314 @NixOS/stdenv
-/pkgs/stdenv/generic/problems.nix                @infinisil
-/pkgs/test/problems                              @infinisil
-/pkgs/stdenv/generic/check-meta.nix              @infinisil @Ericson2314 @adisbladis @NixOS/stdenv
-/pkgs/stdenv/generic/meta-types.nix              @infinisil @adisbladis @NixOS/stdenv
-/pkgs/stdenv/cross                               @Ericson2314 @NixOS/stdenv
-/pkgs/build-support                              @philiptaron
-/pkgs/build-support/cc-wrapper                   @Ericson2314
-/pkgs/build-support/bintools-wrapper             @Ericson2314
-/pkgs/build-support/setup-hooks                  @Ericson2314
-/pkgs/build-support/setup-hooks/arrayUtilities   @ConnorBaker
-/pkgs/build-support/setup-hooks/auto-patchelf.sh @layus
-/pkgs/by-name/au/auto-patchelf                   @layus
-
-## Format generators/serializers
-/pkgs/pkgs-lib                                   @Stunkymonkey @h7x4
-/pkgs/pkgs-lib/formats/json2x                    @Stunkymonkey @h7x4 @figsoda
-
-# Nixpkgs build-support
-/pkgs/build-support/writers @lassulus
-
-# Nixpkgs make-disk-image
-/doc/build-helpers/images/makediskimage.section.md  @raitobezarius
-/nixos/lib/make-disk-image.nix                 @raitobezarius
-
-# Nix, the package manager
-# @raitobezarius is not "code owner", but is listed here to be notified of changes
-# pertaining to the Nix package manager.
-# i.e. no authority over those files.
-# Otherwise keep in-sync with lib.teams.nix.
-pkgs/tools/package-management/nix/                    @Artturin @Ericson2314 @lovesegfault @Mic92 @philiptaron @roberth @tomberek @xokdvium @raitobezarius
-nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lovesegfault @Mic92 @philiptaron @roberth @tomberek @xokdvium @raitobezarius
-
-# Nixpkgs documentation
-/maintainers/scripts/db-to-md.sh @jtojnar @ryantm
-/maintainers/scripts/doc @jtojnar @ryantm
-
-# Contributor documentation
-/CONTRIBUTING.md @infinisil
-/.github/PULL_REQUEST_TEMPLATE.md @infinisil
-/doc/contributing/ @infinisil
-/doc/contributing/contributing-to-documentation.chapter.md @jtojnar @infinisil
-/lib/README.md @infinisil
-/doc/README.md @infinisil
-/nixos/README.md @infinisil
-/pkgs/README.md @infinisil
-/pkgs/by-name/README.md @infinisil
-/maintainers/README.md @infinisil
-
-# User-facing development documentation
-/doc/development.md @infinisil
-/doc/development @infinisil
-
-# NixOS Internals
-/nixos/default.nix                                    @infinisil
-/nixos/lib/from-env.nix                               @infinisil
-/nixos/lib/eval-config.nix                            @infinisil
-/nixos/modules/misc/ids.nix                           @R-VdP
-/nixos/modules/system/activation/bootspec.nix         @grahamc @cole-h @raitobezarius
-/nixos/modules/system/activation/bootspec.cue         @grahamc @cole-h @raitobezarius
-
-# NixOS Render Docs
-/pkgs/by-name/ni/nixos-render-docs @GetPsyched @hsjobeki
-/doc/redirects.json                @GetPsyched
-/nixos/doc/manual/redirects.json   @GetPsyched
-
-# NixOS integration test driver
-/nixos/lib/test-driver  @tfc
-/nixos/lib/testing      @tfc
-
-# NixOS QEMU virtualisation
-/nixos/modules/virtualisation/qemu-vm.nix                 @raitobezarius
-/nixos/modules/services/backup/libvirtd-autosnapshot.nix  @6543
-
-# ACME
-/nixos/modules/security/acme                @NixOS/acme
-
-# Systemd
-/nixos/modules/system/boot/systemd.nix      @NixOS/systemd
-/nixos/modules/system/boot/systemd          @NixOS/systemd
-/nixos/lib/systemd-*.nix                    @NixOS/systemd
-/pkgs/os-specific/linux/systemd             @NixOS/systemd
-
-# Systemd-boot
-/nixos/modules/system/boot/loader/systemd-boot      @JulienMalka
-
-# Limine
-/nixos/modules/system/boot/loader/limine        @lzcunt @programmerlexi @johnrtitor
-/nixos/tests/limine                             @johnrtitor
-
-# Images and installer media
-/nixos/modules/profiles/installation-device.nix @ElvishJerricco
-/nixos/modules/installer/cd-dvd/                @ElvishJerricco
-/nixos/modules/installer/sd-card/
-
-# Amazon
-/nixos/modules/virtualisation/amazon-init.nix                  @arianvp
-/nixos/modules/virtualisation/ec2-data.nix                     @arianvp
-/nixos/modules/virtualisation/amazon-options.nix               @arianvp
-/nixos/modules/virtualisation/amazon-image.nix                 @arianvp
-/nixos/maintainers/scripts/ec2/                                @arianvp
-/nixos/modules/services/misc/amazon-ssm-agent.nix              @arianvp
-/nixos/tests/amazon-ssm-agent.nix                              @arianvp
-/nixos/modules/system/boot/grow-partition.nix                  @arianvp
-/nixos/modules/services/monitoring/amazon-cloudwatch-agent.nix @philipmw
-/nixos/tests/amazon-cloudwatch-agent.nix                       @philipmw
-
-# Monitoring
-/nixos/modules/services/monitoring/fluent-bit.nix @arianvp
-/nixos/tests/fluent-bit.nix                       @arianvp
-
-# nixos-rebuild-ng
-/pkgs/by-name/ni/nixos-rebuild-ng                 @thiagokokada
-
-# Updaters
-## update.nix
-/maintainers/scripts/update.nix   @jtojnar
-/maintainers/scripts/update.py    @jtojnar
-## common-updater-scripts
-/pkgs/common-updater/scripts/update-source-version    @jtojnar
-
-# Android tools, libraries, and environments
-/pkgs/development/android*                    @NixOS/android
-/pkgs/development/mobile/android*             @NixOS/android
-/pkgs/applications/editors/android-studio*    @NixOS/android
-/doc/languages-frameworks/android*            @NixOS/android
-/pkgs/by-name/an/android*                     @NixOS/android
-
-# Python-related code and docs
-/doc/languages-frameworks/python.section.md   @mweinelt @natsukium
-/maintainers/scripts/update-python-libraries  @mweinelt @natsukium
-/pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
-/pkgs/development/interpreters/python         @mweinelt @natsukium
-
-# CUDA
-/pkgs/top-level/cuda-packages.nix             @NixOS/cuda-maintainers
-/pkgs/top-level/release-cuda.nix              @NixOS/cuda-maintainers
-/pkgs/development/cuda-modules                @NixOS/cuda-maintainers
-
-# ROCm
-/pkgs/development/rocm-modules                @NixOS/rocm
-
-# Haskell
-/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @wolfgangwalther
-/maintainers/scripts/haskell                  @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/compilers/ghc               @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix  @sternenseemann @maralorn @wolfgangwalther @OPNA2608
-/pkgs/development/haskell-modules             @sternenseemann @maralorn @wolfgangwalther
-/pkgs/test/haskell                            @sternenseemann @maralorn @wolfgangwalther
-/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @wolfgangwalther
-/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @wolfgangwalther
-
-# Perl
-/pkgs/development/interpreters/perl @stigtsp @marcusramberg
-/pkgs/top-level/perl-packages.nix   @stigtsp @marcusramberg
-/pkgs/development/perl-modules      @stigtsp @marcusramberg
-
-# R
-/pkgs/applications/science/math/R   @jbedo
-/pkgs/development/r-modules         @jbedo
-
-# Rust
-/pkgs/development/compilers/rust @alyssais @Mic92 @winterqt
-/pkgs/build-support/rust @winterqt
-/pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
-/doc/languages-frameworks/rust.section.md @winterqt
-
-# Tcl
-/pkgs/development/interpreters/tcl  @fgaz
-/pkgs/development/libraries/tk      @fgaz
-/pkgs/top-level/tcl-packages.nix    @fgaz
-/pkgs/development/tcl-modules       @fgaz
-/doc/languages-frameworks/tcl.section.md @fgaz
-
-# C compilers
-/pkgs/development/compilers/gcc
-/pkgs/development/compilers/llvm @NixOS/llvm
-/pkgs/development/compilers/emscripten @raitobezarius
-/doc/toolchains/llvm.chapter.md @NixOS/llvm
-/doc/languages-frameworks/emscripten.section.md @raitobezarius
-
-# Audio
-/nixos/modules/services/audio/botamusique.nix @mweinelt
-/nixos/modules/services/audio/snapserver.nix @mweinelt
-/nixos/tests/botamusique.nix @mweinelt
-/nixos/tests/snapcast.nix @mweinelt
-
-# Browsers
-/pkgs/build-support/build-mozilla-mach @mweinelt
-/pkgs/applications/networking/browsers/firefox/update.nix
-/pkgs/applications/networking/browsers/firefox/packages/firefox.nix @mweinelt
-/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-*.nix @mweinelt
-/pkgs/applications/networking/browsers/chromium @emilylange @networkException
-/nixos/tests/chromium.nix @emilylange @networkException
-
-# Certificate Authorities
-pkgs/by-name/ca/cacert @ajs124 @lukegb @mweinelt
-pkgs/development/libraries/nss/ @ajs124 @lukegb @mweinelt
-pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
-
-# Java
-/doc/languages-frameworks/java.section.md @NixOS/java
-/doc/languages-frameworks/gradle.section.md @NixOS/java
-/doc/languages-frameworks/maven.section.md @NixOS/java
-/nixos/modules/programs/java.nix @NixOS/java
-/pkgs/top-level/java-packages.nix @NixOS/java
-
-# Jetbrains
-/pkgs/applications/editors/jetbrains @leona-ya @theCapypara
-
-# Licenses
-/lib/licenses @alyssais @emilazy @jopejoe1
-
-# Qt
-/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000
-/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000
-
-# KDE Frameworks 5
-/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000
-
-# KDE / Plasma 6
-/pkgs/kde @K900 @NickCao @SuperSandro2000
-/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000
-
-# PostgreSQL and related stuff
-/pkgs/by-name/po/postgresqlTestHook @NixOS/postgres
-/pkgs/by-name/ps/psqlodbc @NixOS/postgres
-/pkgs/servers/sql/postgresql @NixOS/postgres
-/pkgs/development/tools/rust/cargo-pgrx @NixOS/postgres
-/nixos/modules/services/databases/postgresql.md @NixOS/postgres
-/nixos/modules/services/databases/postgresql.nix @NixOS/postgres
-/nixos/tests/postgresql @NixOS/postgres
-
-# MySQL/MariaDB and related stuff
-/nixos/modules/services/databases/mysql.nix     @6543
-/nixos/modules/services/backup/mysql-backup.nix @6543
-
-# Home Automation
-/nixos/modules/services/home-automation/home-assistant.nix @mweinelt
-/nixos/modules/services/home-automation/zigbee2mqtt.nix @mweinelt
-/nixos/tests/home-assistant.nix @mweinelt
-/nixos/tests/zigbee2mqtt.nix @mweinelt
-/pkgs/servers/home-assistant @mweinelt
-/pkgs/by-name/es/esphome @mweinelt
-
-# Linux kernel
-/doc/packages/linux.section.md @NixOS/linux-kernel
-/lib/kernel.nix @NixOS/linux-kernel
-/nixos/doc/manual/configuration/linux-kernel.chapter.md @NixOS/linux-kernel
-/nixos/modules/system/boot/kernel.nix @NixOS/linux-kernel
-/nixos/tests/kernel-generic/ @NixOS/linux-kernel
-/pkgs/build-support/kernel/ @NixOS/linux-kernel
-/pkgs/os-specific/linux/kernel/ @NixOS/linux-kernel
-/pkgs/top-level/linux-kernels.nix @NixOS/linux-kernel
-
-# Network Time Daemons
-/pkgs/by-name/ch/chrony @thoughtpolice
-/pkgs/by-name/nt/ntp @thoughtpolice
-/pkgs/by-name/op/openntpd @thoughtpolice
-/nixos/modules/services/networking/ntp @thoughtpolice
-
-# Network
-/pkgs/by-name/ke/kea @mweinelt
-/pkgs/by-name/ba/babeld @mweinelt
-/nixos/modules/services/networking/babeld.nix @mweinelt
-/nixos/modules/services/networking/kea.nix @mweinelt
-/nixos/modules/services/networking/knot.nix @mweinelt
-/nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
-/nixos/tests/babeld.nix @mweinelt
-/nixos/tests/kea.nix @mweinelt
-/nixos/tests/knot.nix @mweinelt
-
-# Web servers
-/doc/packages/nginx.section.md @raitobezarius
-/pkgs/servers/http/nginx/ @raitobezarius
-/nixos/modules/services/web-servers/nginx/ @raitobezarius
-
-# D
-/pkgs/build-support/dlang @jtbx @TomaSajt
-
-# Dhall
-/pkgs/development/dhall-modules      @Gabriella439
-/pkgs/development/interpreters/dhall @Gabriella439
-
-# Agda
-/pkgs/build-support/agda                  @NixOS/agda
-/pkgs/top-level/agda-packages.nix         @NixOS/agda
-/pkgs/development/libraries/agda          @NixOS/agda
-/doc/languages-frameworks/agda.section.md @NixOS/agda
-/nixos/tests/agda                         @NixOS/agda
-
-# Idris
-/pkgs/development/idris-modules @Infinisil
-/pkgs/development/compilers/idris2 @mattpolzin
-
-# NixOS modules for e-mail and dns services
-/nixos/modules/services/mail/mailman.nix    @peti
-/nixos/modules/services/mail/postfix.nix    @peti
-/nixos/modules/services/networking/bind.nix @peti
-/nixos/modules/services/mail/rspamd.nix     @peti
-
-# Emacs
-/pkgs/applications/editors/emacs/elisp-packages @NixOS/emacs
-/pkgs/applications/editors/emacs                @NixOS/emacs
-/pkgs/top-level/emacs-packages.nix              @NixOS/emacs
-/doc/packages/emacs.section.md                  @NixOS/emacs
-/nixos/modules/services/editors/emacs.md        @NixOS/emacs
-
-# Kakoune
-/pkgs/applications/editors/kakoune     @philiptaron
-
-# LuaPackages
-/pkgs/development/lua-modules         @NixOS/lua
-
-# Neovim
-/pkgs/applications/editors/neovim      @NixOS/neovim
-
-# VimPlugins
-/pkgs/applications/editors/vim/plugins         @NixOS/neovim
-## nvim-treesitter
-/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @NixOS/neovim @figsoda
-/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @NixOS/neovim @figsoda
-
-# VsCode Extensions
-/pkgs/applications/editors/vscode/extensions
-
-# PHP interpreter, packages, extensions, tests and documentation
-/doc/languages-frameworks/php.section.md          @aanderse @ma27 @talyz
-/nixos/tests/php                                  @aanderse @ma27 @talyz
-/pkgs/build-support/php/build-pecl.nix            @aanderse @ma27 @talyz
-/pkgs/development/interpreters/php       @jtojnar @aanderse @ma27 @talyz
-/pkgs/development/php-packages                    @aanderse @ma27 @talyz
-/pkgs/top-level/php-packages.nix         @jtojnar @aanderse @ma27 @talyz
-
-# Docker tools
-/pkgs/build-support/docker                       @roberth @jhol
-/nixos/tests/docker-tools*                       @roberth @jhol
-/doc/build-helpers/images/dockertools.section.md @roberth @jhol
-
-# Blockchains
-/pkgs/applications/blockchains  @mmahut @RaghavSood
-
-# Go
-/doc/languages-frameworks/go.section.md @kalbasit @katexochen @Mic92
-/pkgs/build-support/go @kalbasit @katexochen @Mic92
-/pkgs/development/compilers/go @kalbasit @katexochen @Mic92
-
-# GNOME
-/pkgs/desktops/gnome                              @jtojnar
-/pkgs/desktops/gnome/extensions                   @jtojnar
-/pkgs/build-support/make-hardcode-gsettings-patch @jtojnar
-
-# Cinnamon
-/pkgs/by-name/ci/cinnamon-*    @mkg20001
-/pkgs/by-name/cj/cjs           @mkg20001
-/pkgs/by-name/mu/muffin        @mkg20001
-/pkgs/by-name/ne/nemo          @mkg20001
-/pkgs/by-name/ne/nemo-*        @mkg20001
-
-# Xfce
-/doc/hooks/xfce4-dev-tools.section.md @NixOS/xfce
-
-# terraform providers
-/pkgs/applications/networking/cluster/terraform-providers @zowoq
-
-# Forgejo
-nixos/modules/services/misc/forgejo.* @adamcstephens @bendlas @christoph-heiss @emilylange @nycodeghg @pyrox0 @tebriel
-pkgs/by-name/fo/forgejo/              @adamcstephens @bendlas @christoph-heiss @emilylange @nycodeghg @pyrox0 @tebriel
-nixos/tests/forgejo.nix               @adamcstephens @bendlas @christoph-heiss @emilylange @nycodeghg @pyrox0 @tebriel
-
-# Dotnet
-/pkgs/build-support/dotnet                  @corngood
-/pkgs/development/compilers/dotnet          @corngood
-/pkgs/test/dotnet                           @corngood
-/doc/languages-frameworks/dotnet.section.md @corngood
-
-# Node.js
-/pkgs/build-support/node/build-npm-package      @winterqt
-/pkgs/build-support/node/prefetch-npm-deps      @winterqt
-/doc/languages-frameworks/javascript.section.md @winterqt
-/pkgs/development/tools/pnpm                    @Scrumplex @gepbird
-/pkgs/build-support/node/fetch-pnpm-deps        @Scrumplex @gepbird
-/pkgs/test/pnpm                                 @Scrumplex @gepbird
-
-# OCaml
-/pkgs/build-support/ocaml           @ulrikstrid
-/pkgs/development/compilers/ocaml   @ulrikstrid
-/pkgs/development/ocaml-modules     @ulrikstrid
-
-# ZFS
-/nixos/modules/tasks/filesystems/zfs.nix @adamcstephens @amarshall
-/nixos/tests/zfs.nix                     @adamcstephens @amarshall
-/pkgs/os-specific/linux/zfs              @adamcstephens @amarshall
-
-# Zig
-/pkgs/development/compilers/zig @RossComputerGuy
-/doc/hooks/zig.section.md       @RossComputerGuy
-
-# Buildbot
-nixos/modules/services/continuous-integration/buildbot @Mic92 @zowoq
-nixos/tests/buildbot.nix                               @Mic92 @zowoq
-pkgs/development/tools/continuous-integration/buildbot @Mic92 @zowoq
-
-# Pretix
-pkgs/by-name/pr/pretix/ @mweinelt
-pkgs/by-name/pr/pretalx/ @mweinelt
-nixos/modules/services/web-apps/pretix.nix @mweinelt
-nixos/modules/services/web-apps/pretalx.nix @mweinelt
-nixos/tests/web-apps/pretix.nix @mweinelt
-nixos/tests/web-apps/pretalx.nix @mweinelt
-
-# incus/lxc
-nixos/maintainers/scripts/incus/        @adamcstephens
-nixos/modules/virtualisation/incus.nix  @adamcstephens
-nixos/modules/virtualisation/lxc*       @adamcstephens
-nixos/tests/incus/                      @adamcstephens
-pkgs/by-name/in/incus/                  @adamcstephens
-pkgs/by-name/lx/lxc*                    @adamcstephens
-
-# ExpidusOS, Flutter
-/pkgs/development/compilers/flutter @RossComputerGuy
-/pkgs/desktops/expidus              @RossComputerGuy
-
-# GNU Tar & Zip
-/pkgs/by-name/gn/gnutar        @RossComputerGuy
-/pkgs/by-name/zi/zip           @RossComputerGuy
-
-# SELinux
-/pkgs/by-name/ch/checkpolicy @RossComputerGuy
-/pkgs/by-name/li/libselinux  @RossComputerGuy
-/pkgs/by-name/li/libsepol    @RossComputerGuy
-
-# installShellFiles
-/pkgs/by-name/in/installShellFiles/*     @Ericson2314
-/pkgs/test/install-shell-files/*         @Ericson2314
-/doc/hooks/installShellFiles.section.md  @Ericson2314
-
-# Darwin
-/pkgs/by-name/ap/apple-sdk                     @NixOS/darwin-core
-/pkgs/os-specific/darwin                       @NixOS/darwin-core
-/pkgs/stdenv/darwin                            @NixOS/darwin-core
-
-# BEAM
-pkgs/development/beam-modules/          @NixOS/beam
-pkgs/development/interpreters/erlang/   @NixOS/beam
-pkgs/development/interpreters/elixir/   @NixOS/beam
-pkgs/development/interpreters/lfe/      @NixOS/beam
-
-# Authelia
-pkgs/by-name/au/authelia/ @06kellyjac @nicomem
-
-# OctoDNS
-pkgs/by-name/oc/octodns/ @anthonyroussel
-
-# Teleport
-/pkgs/build-support/teleport  @arianvp @justinas @sigma @tomberek @techknowlogick @JuliusFreudenberger
-pkgs/by-name/te/teleport*     @arianvp @justinas @sigma @tomberek @techknowlogick @JuliusFreudenberger
-
-# Warp-terminal
-pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
-
-# Nim
-/doc/languages-frameworks/nim.section.md  @NixOS/nim
-/pkgs/build-support/build-nim-package.nix @NixOS/nim
-/pkgs/build-support/build-nim-sbom.nix    @NixOS/nim
-/pkgs/top-level/nim-overrides.nix         @NixOS/nim
-
-# Radicle
-/pkgs/build-support/fetchradicle/      @NixOS/radicle
-/pkgs/build-support/fetchradiclepatch/ @NixOS/radicle
-
-# Zellij plugins
-/pkgs/by-name/ze/zellij/plugins/   @PerchunPak

ci/README.md

@@ -1,106 +0,0 @@
-# CI support files
-
-This directory contains files to support CI, such as [GitHub Actions](https://github.com/NixOS/nixpkgs/tree/master/.github/workflows) and [Ofborg](https://github.com/nixos/ofborg).
-This is in contrast with [`maintainers/scripts`](../maintainers/scripts) which is for human use instead.
-
-## Pinned Nixpkgs
-
-CI may need certain packages from Nixpkgs.
-In order to ensure that the needed packages are generally available without building, [`pinned.json`](./pinned.json) contains a pinned Nixpkgs version tested by Hydra.
-
-Run [`update-pinned.sh`](./update-pinned.sh) to update it.
-
-## GitHub specific code
-
-Some of the code is specific to GitHub.
-This code is currently spread out over multiple places and written in both Bash and JavaScript.
-The goal is to eventually have all GitHub specific code in `ci/github-script` and written in JavaScript via `actions/github-script`.
-A lot of code has already been migrated, but some Bash code still remains.
-New CI features need to be introduced in JavaScript, not Bash.
-
-## Nixpkgs merge bot
-
-The Nixpkgs merge bot empowers package maintainers by enabling them to merge PRs related to their own packages.
-It serves as a bridge for maintainers to quickly respond to user feedback, facilitating a more self-reliant approach.
-Especially when considering there are roughly 20 maintainers for every committer, this bot is a game-changer.
-
-Following [RFC 172], the merge bot was originally implemented as a [python webapp](https://github.com/NixOS/nixpkgs-merge-bot), which has now been integrated into [`ci/github-script/bot.js`](./github-script/bot.js) and [`ci/github-script/merge.js`](./github-script/merge.js).
-
-### Using the merge bot
-
-To merge a PR, maintainers can simply comment:
-```gfm
-@NixOS/nixpkgs-merge-bot merge
-```
-
-The next time the bot runs it will verify the below constraints, then (if satisfied) merge the PR.
-
-The merge bot will reference [#306934](https://github.com/NixOS/nixpkgs/issues/306934) on PRs it merges successfully, [#305350](https://github.com/NixOS/nixpkgs/issues/305350) for unsuccessful attempts, or [#371492](https://github.com/NixOS/nixpkgs/issues/371492) if an error occurs.
-These issues effectively list PRs the merge bot has interacted with.
-
-### Merge bot constraints
-
-To ensure security and a focused utility, the bot adheres to specific limitations:
-
-- The PR targets one of the [development branches](#branch-classification).
-- The PR only touches files of packages located under `pkgs/by-name/*`.
-- The PR is either:
-  - approved by a [committer][@NixOS/nixpkgs-committers].
-  - backported via label.
-  - opened by a [committer][@NixOS/nixpkgs-committers].
-  - opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).
-- The user attempting to merge is a member of [@NixOS/nixpkgs-maintainers].
-- The user attempting to merge is a maintainer of all packages touched by the PR.
-
-### Approving merge bot changes
-
-Changes to the bot can usually be approved by the [@NixOS/nixpkgs-ci] team, as with other CI changes.
-However, additional acknowledgement from the [@NixOS/nixpkgs-core] team is required for changes to what the merge bot will merge, who is eligible to use the merge bot, or similar changes in scope.
-
-## `ci/nixpkgs-vet.sh BASE_BRANCH [REPOSITORY]`
-
-Runs the [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) on the HEAD commit, closely matching what CI does.
-This can't do exactly the same as CI, because CI needs to rely on GitHub's server-side Git history to compute the mergeability of PRs before the check can be started.
-In turn, when contributors are running this tool locally, we don't want to have to push commits to test them, and we can also rely on the local Git history to do the mergeability check.
-
-Arguments:
-
-- `BASE_BRANCH`: The base branch to use, e.g. master or release-24.05
-- `REPOSITORY`: The repository from which to fetch the base branch.
-  Defaults to <https://github.com/NixOS/nixpkgs.git>.
-
-# Branch classification
-
-For the purposes of CI, branches in the NixOS/nixpkgs repository are classified as follows:
-
-- **Channel** branches
-  - `nixos-` or `nixpkgs-` prefix
-  - Are only updated from `master` or `release-` branches, when hydra passes.
-  - Otherwise not worked on, Pull Requests are not allowed.
-  - Long-lived, no deletion, no force push.
-- **Primary development** branches
-  - `release-` prefix and `master`
-  - Pull Requests required.
-  - Long-lived, no deletion, no force push.
-- **Secondary development** branches
-  - `staging-` prefix and `haskell-updates`
-  - Pull Requests normally required, except when merging development branches into each other.
-  - Long-lived, no deletion, no force push.
-- **Work-In-Progress** branches
-  - `backport-`, `revert-` and `wip-` prefixes.
-  - Deprecated: All other branches, not matched by channel/development.
-  - Pull Requests are optional.
-  - Short-lived, force push allowed, deleted after merge.
-
-Some branches also have a version component, which is either `unstable` or `YY.MM`.
-
-`ci/supportedBranches.js` is a script imported by CI to classify the base and head branches of a Pull Request.
-This classification will then be used to skip certain jobs.
-This script can also be run locally to print basic test cases.
-
-
-[@NixOS/nixpkgs-maintainers]: https://github.com/orgs/NixOS/teams/nixpkgs-maintainers
-[@NixOS/nixpkgs-committers]: https://github.com/orgs/NixOS/teams/nixpkgs-committers
-[@NixOS/nixpkgs-ci]: https://github.com/orgs/NixOS/teams/nixpkgs-ci
-[@NixOS/nixpkgs-core]: https://github.com/orgs/NixOS/teams/nixpkgs-core
-[RFC 172]: https://github.com/NixOS/rfcs/pull/172

ci/codeowners-validator/default.nix

@@ -1,31 +0,0 @@
-{
-  buildGoModule,
-  fetchFromGitHub,
-  fetchpatch,
-}:
-buildGoModule {
-  name = "codeowners-validator";
-  src = fetchFromGitHub {
-    owner = "mszostok";
-    repo = "codeowners-validator";
-    rev = "f3651e3810802a37bd965e6a9a7210728179d076";
-    hash = "sha256-5aSmmRTsOuPcVLWfDF6EBz+6+/Qpbj66udAmi1CLmWQ=";
-  };
-  patches = [
-    # https://github.com/mszostok/codeowners-validator/pull/222
-    (fetchpatch {
-      name = "user-write-access-check";
-      url = "https://github.com/mszostok/codeowners-validator/compare/f3651e3810802a37bd965e6a9a7210728179d076...840eeb88b4da92bda3e13c838f67f6540b9e8529.patch";
-      hash = "sha256-t3Dtt8SP9nbO3gBrM0nRE7+G6N/ZIaczDyVHYAG/6mU=";
-    })
-    # Undoes part of the above PR: We don't want to require write access
-    # to the repository, that's only needed for GitHub's native CODEOWNERS.
-    # Furthermore, it removes an unnecessary check from the code
-    # that breaks tokens generated for GitHub Apps.
-    ./permissions.patch
-    # Allows setting a custom CODEOWNERS path using the OWNERS_FILE env var
-    ./owners-file-name.patch
-  ];
-  postPatch = "rm -r docs/investigation";
-  vendorHash = "sha256-R+pW3xcfpkTRqfS2ETVOwG8PZr0iH5ewroiF7u8hcYI=";
-}

ci/codeowners-validator/owners-file-name.patch

@@ -1,15 +0,0 @@
-diff --git a/pkg/codeowners/owners.go b/pkg/codeowners/owners.go
-index 6910bd2..e0c95e9 100644
---- a/pkg/codeowners/owners.go
-+++ b/pkg/codeowners/owners.go
-@@ -39,6 +39,10 @@ func NewFromPath(repoPath string) ([]Entry, error) {
- // openCodeownersFile finds a CODEOWNERS file and returns content.
- // see: https://help.github.com/articles/about-code-owners/#codeowners-file-location
- func openCodeownersFile(dir string) (io.Reader, error) {
-+	if file, ok := os.LookupEnv("OWNERS_FILE"); ok {
-+		return fs.Open(file)
-+	}
-+
- 	var detectedFiles []string
- 	for _, p := range []string{".", "docs", ".github"} {
- 		pth := path.Join(dir, p)

ci/codeowners-validator/permissions.patch

@@ -1,36 +0,0 @@
-diff --git a/internal/check/valid_owner.go b/internal/check/valid_owner.go
-index a264bcc..610eda8 100644
---- a/internal/check/valid_owner.go
-+++ b/internal/check/valid_owner.go
-@@ -16,7 +16,6 @@ import (
- const scopeHeader = "X-OAuth-Scopes"
- 
- var reqScopes = map[github.Scope]struct{}{
--	github.ScopeReadOrg: {},
- }
- 
- type ValidOwnerConfig struct {
-@@ -223,10 +222,7 @@ func (v *ValidOwner) validateTeam(ctx context.Context, name string) *validateErr
- 	for _, t := range v.repoTeams {
- 		// GitHub normalizes name before comparison
- 		if strings.EqualFold(t.GetSlug(), team) {
--			if t.Permissions["push"] {
--				return nil
--			}
--			return newValidateError("Team %q cannot review PRs on %q as neither it nor any parent team has write permissions.", team, v.orgRepoName)
-+			return nil
- 		}
- 	}
- 
-@@ -245,10 +241,7 @@ func (v *ValidOwner) validateGitHubUser(ctx context.Context, name string) *valid
- 	for _, u := range v.repoUsers {
- 		// GitHub normalizes name before comparison
- 		if strings.EqualFold(u.GetLogin(), userName) {
--			if u.Permissions["push"] {
--				return nil
--			}
--			return newValidateError("User %q cannot review PRs on %q as they don't have write permissions.", userName, v.orgRepoName)
-+			return nil
- 		}
- 	}
- 

ci/default.nix

@@ -1,205 +0,0 @@
-let
-  pinned = (builtins.fromJSON (builtins.readFile ./pinned.json)).pins;
-in
-{
-  system ? builtins.currentSystem,
-
-  nixpkgs ? null,
-  nixPath ? "nixVersions.latest",
-}:
-let
-  nixpkgs' =
-    if nixpkgs == null then
-      fetchTarball {
-        inherit (pinned.nixpkgs) url;
-        sha256 = pinned.nixpkgs.hash;
-      }
-    else
-      nixpkgs;
-
-  pkgs = import nixpkgs' {
-    inherit system;
-    # Nixpkgs generally — and CI specifically — do not use aliases,
-    # because we want to ensure they are not load-bearing.
-    allowAliases = false;
-  };
-
-  fmt =
-    let
-      treefmtNixSrc = fetchTarball {
-        inherit (pinned.treefmt-nix) url;
-        sha256 = pinned.treefmt-nix.hash;
-      };
-      treefmtEval = (import treefmtNixSrc).evalModule pkgs {
-        # Important: The auto-rebase script uses `git filter-branch --tree-filter`,
-        # which creates trees within the Git repository under `.git-rewrite/t`,
-        # notably without having a `.git` themselves.
-        # So if this projectRootFile were the default `.git/config`,
-        # having the auto-rebase script use treefmt on such a tree would make it
-        # format all files in the _parent_ Git tree as well.
-        projectRootFile = ".git-blame-ignore-revs";
-
-        # Be a bit more verbose by default, so we can see progress happening
-        settings.verbose = 1;
-
-        # By default it's info, which is too noisy since we have many unmatched files
-        settings.on-unmatched = "debug";
-
-        programs.actionlint.enable = true;
-
-        programs.biome = {
-          enable = true;
-          # Disable settings validation because its inputs are liable to hash mismatch
-          validate.enable = false;
-          settings.formatter = {
-            useEditorconfig = true;
-          };
-          settings.javascript.formatter = {
-            quoteStyle = "single";
-            semicolons = "asNeeded";
-          };
-          settings.json.formatter.enabled = false;
-        };
-        settings.formatter.biome.excludes = [
-          "*.min.js"
-          "pkgs/*"
-        ];
-
-        programs.keep-sorted.enable = true;
-
-        # This uses nixfmt underneath, the default formatter for Nix code.
-        # See https://github.com/NixOS/nixfmt
-        programs.nixfmt = {
-          enable = true;
-          package = pkgs.nixfmt;
-        };
-
-        programs.yamlfmt = {
-          enable = true;
-          settings.formatter = {
-            retain_line_breaks = true;
-          };
-        };
-        settings.formatter.yamlfmt.excludes = [
-          # Aligns comments with whitespace
-          "pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml"
-          # TODO: Fix formatting for auto-generated file
-          "pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml"
-        ];
-
-        programs.nixf-diagnose = {
-          enable = true;
-          ignore = [
-            # Rule names can currently be looked up here:
-            # https://github.com/nix-community/nixd/blob/main/libnixf/src/Basic/diagnostic.py
-            # TODO: Remove the following and fix things.
-            "sema-unused-def-lambda-noarg-formal"
-            "sema-unused-def-lambda-witharg-arg"
-            "sema-unused-def-lambda-witharg-formal"
-            "sema-unused-def-let"
-            # Keep this rule, because we have `lib.or`.
-            "or-identifier"
-            # TODO: remove after outstanding prelude diagnostics issues are fixed:
-            # https://github.com/nix-community/nixd/issues/761
-            # https://github.com/nix-community/nixd/issues/762
-            "sema-primop-removed-prefix"
-            "sema-primop-overridden"
-            "sema-constant-overridden"
-            "sema-primop-unknown"
-          ];
-        };
-        settings.formatter.nixf-diagnose = {
-          # Ensure nixfmt cleans up after nixf-diagnose.
-          priority = -1;
-          excludes = [
-            # Auto-generated; violates sema-extra-with
-            # Can only sensibly be removed when --auto-fix supports multiple fixes at once:
-            # https://github.com/inclyc/nixf-diagnose/issues/13
-            "pkgs/servers/home-assistant/component-packages.nix"
-            # https://github.com/nix-community/nixd/issues/708
-            "nixos/maintainers/scripts/azure-new/examples/basic/system.nix"
-          ];
-        };
-
-        settings.formatter.editorconfig-checker = {
-          command = "${pkgs.lib.getExe pkgs.editorconfig-checker}";
-          options = [
-            "-disable-indent-size"
-            # TODO: Remove this once this upstream issue is fixed:
-            #   https://github.com/editorconfig-checker/editorconfig-checker/issues/505
-            "-disable-charset"
-          ];
-          includes = [ "*" ];
-          priority = 1;
-        };
-
-        # TODO: Upstream this into treefmt-nix eventually:
-        #   https://github.com/numtide/treefmt-nix/issues/387
-        settings.formatter.markdown-code-runner = {
-          command = pkgs.lib.getExe pkgs.markdown-code-runner;
-          options =
-            let
-              config = pkgs.writers.writeTOML "markdown-code-runner-config" {
-                presets.nixfmt = {
-                  language = "nix";
-                  command = [ (pkgs.lib.getExe pkgs.nixfmt) ];
-                };
-              };
-            in
-            [ "--config=${config}" ];
-          includes = [ "*.md" ];
-        };
-
-        programs.zizmor.enable = true;
-      };
-      fs = pkgs.lib.fileset;
-      nixFilesSrc = fs.toSource {
-        root = ../.;
-        fileset = fs.difference ../. (fs.maybeMissing ../.git);
-      };
-    in
-    {
-      shell = treefmtEval.config.build.devShell;
-      pkg = treefmtEval.config.build.wrapper;
-      check = treefmtEval.config.build.check nixFilesSrc;
-    };
-
-in
-rec {
-  inherit pkgs fmt;
-  codeownersValidator = pkgs.callPackage ./codeowners-validator { };
-
-  # FIXME(lf-): it might be useful to test other Nix implementations
-  # (nixVersions.stable and Lix) here somehow at some point to ensure we don't
-  # have eval divergence.
-  eval = pkgs.callPackage ./eval {
-    nix = pkgs.lib.getAttrFromPath (pkgs.lib.splitString "." nixPath) pkgs;
-  };
-
-  # CI jobs
-  lib-tests = import ../lib/tests/release.nix { inherit pkgs; };
-  manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
-  manual-nixpkgs = (import ../doc { inherit pkgs; });
-  nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix {
-    nix = pkgs.nixVersions.latest;
-  };
-  parse = pkgs.lib.recurseIntoAttrs {
-    nix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };
-    nix_2_28 = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.nix_2_28; };
-    lix = pkgs.callPackage ./parse.nix { nix = pkgs.lix; };
-    lix_latest = pkgs.callPackage ./parse.nix { nix = pkgs.lixPackageSets.latest.lix; };
-  };
-  shell = import ../shell.nix { inherit nixpkgs system; };
-  tarball = import ../pkgs/top-level/make-tarball.nix {
-    # Mirrored from top-level release.nix:
-    nixpkgs = {
-      outPath = pkgs.lib.cleanSource ../.;
-      revCount = 1234;
-      shortRev = "abcdef";
-      revision = "0000000000000000000000000000000000000000";
-    };
-    officialRelease = false;
-    inherit pkgs lib-tests;
-    nix = pkgs.nixVersions.latest;
-  };
-}

ci/eval/README.md

@@ -1,48 +0,0 @@
-# Nixpkgs CI evaluation
-
-The code in this directory is used by the [eval.yml](../../.github/workflows/eval.yml) GitHub Actions workflow to evaluate the majority of Nixpkgs for all PRs, effectively making sure that when the development branches are processed by Hydra, no evaluation failures are encountered.
-
-Furthermore it also allows local evaluation using:
-
-```
-nix-build ci -A eval.baseline
-```
-
-The two most important arguments are:
-- `--arg evalSystems`: The set of systems for which `nixpkgs` should be evaluated.
-  Defaults to the [supported systems](../../pkgs/top-level/release-supported-systems.json) for the branch.
-  Example: `--arg evalSystems '["x86_64-linux" "aarch64-darwin"]'`
-- `--arg quickTest`: Enables testing a single chunk of the current system only for quick iteration.
-  Example: `--arg quickTest true`
-
-The following arguments can be used to fine-tune performance:
-- `--max-jobs`: The maximum number of derivations to run at the same time.
-  Only each supported system gets a separate derivation, so it doesn't make sense to set this higher than that number.
-- `--cores`: The number of cores to use for each job.
-  Recommended to set this to the number of cores on your system divided by `--max-jobs`.
-- `--arg chunkSize`: The number of attributes that are evaluated simultaneously on a single core.
-  Lowering this decreases memory usage at the cost of increased evaluation time.
-  If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.
-  The default is 5000.
-  Example: `--arg chunkSize 10000`
-
-Note that 16GB memory is the recommended minimum, while with less than 8GB memory evaluation time suffers greatly.
-
-## Local eval with rebuilds / comparison
-
-To compare two commits locally, first run the following on the baseline commit:
-
-```
-nix-build ci -A eval.baseline --out-link baseline
-```
-
-Then, on the commit with your changes:
-
-```
-nix-build ci -A eval.full --arg baseline ./baseline
-```
-
-Keep in mind to otherwise pass the same set of arguments for both commands (`evalSystems`, `quickTest`, `chunkSize`).
-Running this command will evaluate the difference between the baseline statistics and the ones at the time of running the command.
-From that difference, it will produce a human-readable report in `$out/step-summary.md`.
-If no packages were added or removed, then performance statistics will also be generated as part of this report.

ci/eval/attrpaths.nix

@@ -1,85 +0,0 @@
-# This expression will, as efficiently as possible, dump a
-# *superset* of all attrpaths of derivations which might be
-# part of a release on *any* platform.
-#
-# This expression runs single-threaded under all current Nix
-# implementations, but much faster and with much less memory
-# used than ./outpaths.nix itself.
-#
-# Once you have the list of attrnames you can split it up into
-# $NUM_CORES batches and evaluate the outpaths separately for each
-# batch, in parallel.
-#
-# To dump the attrnames:
-#
-#   nix-instantiate --eval --strict --json ci/eval/attrpaths.nix -A names
-#
-{
-  lib ? import (path + "/lib"),
-  trace ? false,
-  path ? ./../..,
-  extraNixpkgsConfigJson ? "{}",
-}:
-let
-
-  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
-  # https://github.com/NixOS/nixpkgs/pull/395160
-  justAttrNames =
-    path: value:
-    let
-      result =
-        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
-          [ ]
-        else if lib.isDerivation value then
-          [ path ]
-        else
-          lib.pipe value [
-            (lib.mapAttrsToList (
-              name: value:
-              lib.addErrorContext "while evaluating package set attribute path '${
-                lib.showAttrPath (path ++ [ name ])
-              }'" (justAttrNames (path ++ [ name ]) value)
-            ))
-            lib.concatLists
-          ];
-    in
-    lib.traceIf trace "** ${lib.showAttrPath path}" result;
-
-  outpaths = import ./outpaths.nix {
-    inherit path;
-    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
-    attrNamesOnly = true;
-  };
-
-  paths = [
-    # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
-    # Until these have been removed from release.nix / hydra, we manually add them to the list.
-    [
-      "pkgsLLVM"
-      "stdenv"
-    ]
-    [
-      "pkgsArocc"
-      "stdenv"
-    ]
-    [
-      "pkgsZig"
-      "stdenv"
-    ]
-    [
-      "pkgsStatic"
-      "stdenv"
-    ]
-    [
-      "pkgsMusl"
-      "stdenv"
-    ]
-  ]
-  ++ justAttrNames [ ] outpaths;
-
-  names = map lib.showAttrPath paths;
-
-in
-{
-  inherit paths names;
-}

ci/eval/chunk.nix

@@ -1,47 +0,0 @@
-# This turns ./outpaths.nix into chunks of a fixed size.
-{
-  lib ? import ../../lib,
-  path ? ../..,
-  # The file containing all available attribute paths, which are split into chunks here
-  attrpathFile,
-  chunkSize,
-  myChunk,
-  includeBroken,
-  systems,
-  extraNixpkgsConfigJson,
-}:
-
-let
-  attrpaths = lib.importJSON attrpathFile;
-  myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize attrpaths;
-
-  unfiltered = import ./outpaths.nix {
-    inherit path;
-    inherit includeBroken systems;
-    extraNixpkgsConfig = builtins.fromJSON extraNixpkgsConfigJson;
-  };
-
-  # Turns the unfiltered recursive attribute set into one that is limited to myAttrpaths
-  filtered =
-    let
-      recurse =
-        index: paths: attrs:
-        lib.mapAttrs (
-          name: values:
-          if attrs ? ${name} then
-            if lib.any (value: lib.length value <= index + 1) values then
-              attrs.${name}
-            else
-              recurse (index + 1) values attrs.${name}
-              # Make sure nix-env recurses as well
-              // {
-                recurseForDerivations = true;
-              }
-          else
-            null
-        ) (lib.groupBy (a: lib.elemAt a index) paths);
-    in
-    recurse 0 myAttrpaths unfiltered;
-
-in
-filtered

ci/eval/compare/cmp-stats.py

@@ -1,317 +0,0 @@
-import argparse
-import json
-import numpy as np
-import os
-import pandas as pd
-
-from dataclasses import asdict, dataclass
-from pathlib import Path
-from scipy.stats import ttest_rel
-from tabulate import tabulate
-from typing import Final
-
-
-def flatten_data(json_data: dict) -> dict:
-    """
-    Extracts and flattens metrics from JSON data.
-    This is needed because the JSON data can be nested.
-    For example, the JSON data entry might look like this:
-
-    "gc":{"cycles":13,"heapSize":5404549120,"totalBytes":9545876464}
-
-    Flattened:
-
-    "gc.cycles": 13
-    "gc.heapSize": 5404549120
-    ...
-
-    See https://github.com/NixOS/nix/blob/187520ce88c47e2859064704f9320a2d6c97e56e/src/libexpr/eval.cc#L2846
-    for the ultimate source of this data.
-
-    Args:
-        json_data (dict): JSON data containing metrics.
-    Returns:
-        dict: Flattened metrics with keys as metric names.
-    """
-    flat_metrics = {}
-    for key, value in json_data.items():
-        # This key is duplicated as `time.cpu`; we keep that copy.
-        if key == "cpuTime":
-            continue
-
-        if isinstance(value, (int, float)):
-            flat_metrics[key] = value
-        elif isinstance(value, dict):
-            for subkey, subvalue in value.items():
-                assert isinstance(subvalue, (int, float)), subvalue
-                flat_metrics[f"{key}.{subkey}"] = subvalue
-        else:
-            assert isinstance(value, (float, int, dict)), (
-                f"Value `{value}` has unexpected type"
-            )
-
-    return flat_metrics
-
-
-def load_all_metrics(path: Path) -> dict:
-    """
-    Loads all stats JSON files in the specified file or directory and extracts metrics.
-    These stats JSON files are created by Nix when the `NIX_SHOW_STATS` environment variable is set.
-
-    If the provided path is a directory, it must have the structure $path/$system/$stats,
-    where $path is the provided path, $system is some system from `lib.systems.doubles.*`,
-    and $stats is a stats JSON file.
-
-    If the provided path is a file, it is a stats JSON file.
-
-    Args:
-        path (Path): Directory containing JSON files or a stats JSON file.
-
-    Returns:
-        dict: Dictionary with filenames as keys and extracted metrics as values.
-    """
-    metrics = {}
-    if path.is_dir():
-        for system_dir in path.iterdir():
-            assert system_dir.is_dir()
-
-            for chunk_output in system_dir.iterdir():
-                with chunk_output.open() as f:
-                    data = json.load(f)
-
-                metrics[f"{system_dir.name}/${chunk_output.name}"] = flatten_data(data)
-    else:
-        with path.open() as f:
-            metrics[path.name] = flatten_data(json.load(f))
-
-    return metrics
-
-
-def metric_table_name(name: str, explain: bool) -> str:
-    """
-    Returns the name of the metric, plus a footnote to explain it if needed.
-    """
-    return f"{name}[^{name}]" if explain else name
-
-
-METRIC_EXPLANATION_FOOTNOTE: Final[str] = """
-
-[^time.cpu]: Number of seconds of CPU time accounted by the OS to the Nix evaluator process. On UNIX systems, this comes from [`getrusage(RUSAGE_SELF)`](https://man7.org/linux/man-pages/man2/getrusage.2.html).
-[^time.gc]: Number of seconds of CPU time accounted by the Boehm garbage collector to performing GC.
-[^time.gcFraction]: What fraction of the total CPU time is accounted towards performing GC.
-[^gc.cycles]: Number of times garbage collection has been performed.
-[^gc.heapSize]: Size in bytes of the garbage collector heap.
-[^gc.totalBytes]: Size in bytes of all allocations in the garbage collector.
-[^envs.bytes]: Size in bytes of all `Env` objects allocated by the Nix evaluator. These are almost exclusively created by [`nix-env`](https://nix.dev/manual/nix/stable/command-ref/nix-env.html).
-[^list.bytes]: Size in bytes of all [lists](https://nix.dev/manual/nix/stable/language/syntax.html#list-literal) allocated by the Nix evaluator.
-[^sets.bytes]: Size in bytes of all [attrsets](https://nix.dev/manual/nix/stable/language/syntax.html#list-literal) allocated by the Nix evaluator.
-[^symbols.bytes]: Size in bytes of all items in the Nix evaluator symbol table.
-[^values.bytes]: Size in bytes of all values allocated by the Nix evaluator.
-[^envs.number]: The count of all `Env` objects allocated.
-[^nrAvoided]: The number of thunks avoided being created.
-[^nrExprs]: The number of expression objects ever created.
-[^nrFunctionCalls]: The number of function calls ever made.
-[^nrLookups]: The number of lookups into an attrset ever made.
-[^nrOpUpdateValuesCopied]: The number of attrset values copied in the process of merging attrsets.
-[^nrOpUpdates]: The number of attrsets merge operations (`//`) performed.
-[^nrPrimOpCalls]: The number of function calls to primops (Nix builtins) ever made.
-[^nrThunks]: The number of [thunks](https://nix.dev/manual/nix/latest/language/evaluation.html#laziness) ever made. A thunk is a delayed computation, represented by an expression reference and a closure.
-[^sets.number]: The number of attrsets ever made.
-[^symbols.number]: The number of symbols ever added to the symbol table.
-[^values.number]: The number of values ever made.
-[^envs.elements]: The number of values contained within an `Env` object.
-[^list.concats]: The number of list concatenation operations (`++`) performed.
-[^list.elements]: The number of values contained within a list.
-[^sets.elements]: The number of values contained within an attrset.
-[^sizes.Attr]: Size in bytes of the `Attr` type.
-[^sizes.Bindings]: Size in bytes of the `Bindings` type.
-[^sizes.Env]: Size in bytes of the `Env` type.
-[^sizes.Value]: Size in bytes of the `Value` type.
-"""
-
-
-@dataclass(frozen=True)
-class PairwiseTestResults:
-    updated: pd.DataFrame
-    equivalent: pd.DataFrame
-
-    @staticmethod
-    def tabulate(table, headers) -> str:
-        return tabulate(
-            table, headers, tablefmt="github", floatfmt=".4f", missingval="-"
-        )
-
-    def updated_to_markdown(self, explain: bool) -> str:
-        assert not self.updated.empty
-        # Header (get column names and format them)
-        return self.tabulate(
-            headers=[str(column) for column in self.updated.columns],
-            table=[
-                [
-                    # The metric acts as its own footnote name
-                    metric_table_name(row["metric"], explain),
-                    # Check for no change and NaN in p_value/t_stat
-                    *[
-                        None if np.isnan(val) or np.allclose(val, 0) else val
-                        for val in row[1:]
-                    ],
-                ]
-                for _, row in self.updated.iterrows()
-            ],
-        )
-
-    def equivalent_to_markdown(self, explain: bool) -> str:
-        assert not self.equivalent.empty
-        return self.tabulate(
-            headers=[str(column) for column in self.equivalent.columns],
-            table=[
-                [
-                    # The metric acts as its own footnote name
-                    metric_table_name(row["metric"], explain),
-                    row["value"],
-                ]
-                for _, row in self.equivalent.iterrows()
-            ],
-        )
-
-    def to_markdown(self, explain: bool) -> str:
-        result = ""
-
-        if not self.equivalent.empty:
-            result += "## Unchanged values\n\n"
-            result += self.equivalent_to_markdown(explain)
-
-        if not self.updated.empty:
-            result += ("\n\n" if result else "") + "## Updated values\n\n"
-            result += self.updated_to_markdown(explain)
-
-        if explain:
-            result += METRIC_EXPLANATION_FOOTNOTE
-
-        return result
-
-
-@dataclass(frozen=True)
-class Equivalent:
-    metric: str
-    value: float
-
-
-@dataclass(frozen=True)
-class Comparison:
-    metric: str
-    mean_before: float
-    mean_after: float
-    mean_diff: float
-    mean_pct_change: float
-
-
-@dataclass(frozen=True)
-class ComparisonWithPValue(Comparison):
-    p_value: float
-    t_stat: float
-
-
-def metric_sort_key(name: str) -> str:
-    if name in ("time.cpu", "time.gc", "time.gcFraction"):
-        return (1, name)
-    elif name.startswith("gc"):
-        return (2, name)
-    elif name.endswith(("bytes", "Bytes")):
-        return (3, name)
-    elif name.startswith("nr") or name.endswith("number"):
-        return (4, name)
-    else:
-        return (5, name)
-
-
-def perform_pairwise_tests(
-    before_metrics: dict, after_metrics: dict
-) -> PairwiseTestResults:
-    common_files = sorted(set(before_metrics) & set(after_metrics))
-    all_keys = sorted(
-        {
-            metric_keys
-            for file_metrics in before_metrics.values()
-            for metric_keys in file_metrics.keys()
-        },
-        key=metric_sort_key,
-    )
-
-    updated = []
-    equivalent = []
-
-    for key in all_keys:
-        before_vals = []
-        after_vals = []
-
-        for fname in common_files:
-            if key in before_metrics[fname] and key in after_metrics[fname]:
-                before_vals.append(before_metrics[fname][key])
-                after_vals.append(after_metrics[fname][key])
-
-        if len(before_vals) == 0:
-            continue
-
-        before_arr = np.array(before_vals)
-        after_arr = np.array(after_vals)
-
-        diff = after_arr - before_arr
-
-        # If there's no difference, add it all to the equivalent output.
-        if np.allclose(diff, 0):
-            equivalent.append(Equivalent(metric=key, value=before_vals[0]))
-        else:
-            pct_change = 100 * diff / before_arr
-
-            result = Comparison(
-                metric=key,
-                mean_before=np.mean(before_arr),
-                mean_after=np.mean(after_arr),
-                mean_diff=np.mean(diff),
-                mean_pct_change=np.mean(pct_change),
-            )
-
-            # If there are enough values to perform a t-test, do so.
-            if len(before_vals) > 1:
-                t_stat, p_val = ttest_rel(after_arr, before_arr)
-                result = ComparisonWithPValue(
-                    **asdict(result), p_value=p_val, t_stat=t_stat
-                )
-
-            updated.append(result)
-
-    return PairwiseTestResults(
-        updated=pd.DataFrame(map(asdict, updated)),
-        equivalent=pd.DataFrame(map(asdict, equivalent)),
-    )
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Performance comparison of Nix evaluation statistics"
-    )
-    parser.add_argument(
-        "--explain", action="store_true", help="Explain the evaluation statistics"
-    )
-    parser.add_argument(
-        "before", help="File or directory containing baseline (data before)"
-    )
-    parser.add_argument(
-        "after", help="File or directory containing comparison (data after)"
-    )
-
-    options = parser.parse_args()
-
-    before_stats = Path(options.before)
-    after_stats = Path(options.after)
-
-    before_metrics = load_all_metrics(before_stats)
-    after_metrics = load_all_metrics(after_stats)
-    pairwise_test_results = perform_pairwise_tests(before_metrics, after_metrics)
-    markdown_table = pairwise_test_results.to_markdown(explain=options.explain)
-    print(markdown_table)
-
-
-if __name__ == "__main__":
-    main()

ci/eval/compare/default.nix

@@ -1,309 +0,0 @@
-{
-  callPackage,
-  lib,
-  jq,
-  runCommand,
-  writeText,
-  python3,
-  stdenvNoCC,
-  makeWrapper,
-  codeowners,
-}:
-let
-  python = python3.withPackages (ps: [
-    ps.numpy
-    ps.pandas
-    ps.scipy
-    ps.tabulate
-  ]);
-
-  cmp-stats = stdenvNoCC.mkDerivation {
-    pname = "cmp-stats";
-    version = lib.trivial.release;
-
-    dontUnpack = true;
-
-    nativeBuildInputs = [ makeWrapper ];
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/share/cmp-stats
-
-      cp ${./cmp-stats.py} "$out/share/cmp-stats/cmp-stats.py"
-
-      makeWrapper ${python.interpreter} "$out/bin/cmp-stats" \
-          --add-flags "$out/share/cmp-stats/cmp-stats.py"
-
-      runHook postInstall
-    '';
-
-    meta = {
-      description = "Performance comparison of Nix evaluation statistics";
-      license = lib.licenses.mit;
-      mainProgram = "cmp-stats";
-      maintainers = with lib.maintainers; [ philiptaron ];
-    };
-  };
-in
-{
-  combinedDir,
-  touchedFilesJson,
-  ownersFile ? ../../OWNERS,
-}:
-let
-  # Usually we expect a derivation, but when evaluating in multiple separate steps, we pass
-  # nix store paths around. These need to be turned into (fake) derivations again to track
-  # dependencies properly.
-  # We use two steps for evaluation, because we compare results from two different checkouts.
-  # CI additionalls spreads evaluation across multiple workers.
-  combined = if lib.isDerivation combinedDir then combinedDir else lib.toDerivation combinedDir;
-
-  /*
-    Derivation that computes which packages are affected (added, changed or removed) between two revisions of nixpkgs.
-    Note: "platforms" are "x86_64-linux", "aarch64-darwin", ...
-
-    ---
-    Inputs:
-    - beforeDir, afterDir: The evaluation result from before and after the change.
-      They can be obtained by running `nix-build -A ci.eval.full` on both revisions.
-
-    ---
-    Outputs:
-      - changed-paths.json: Various information about the changes:
-        {
-          attrdiff: {
-            added: ["package1"],
-            changed: ["package2", "package3", "package4"],
-            removed: ["package4"],
-          },
-          attrdiffByKernel: {
-            darwin: {
-              added: [],
-              changed: ["package2", "package4"],
-              removed: ["package4"],
-            },
-            linux: {
-              added: ["package1"],
-              changed: ["package3", "package4"],
-              removed: [],
-            },
-          },
-          attrdiffByPlatform: {
-            aarch64-darwin: {
-              added: [],
-              changed: ["package2"],
-              removed: ["package4"],
-            },
-            aarch64-linux: {
-              added: ["package1"],
-              changed: ["package3"],
-              removed: [],
-            },
-            x86_64-linux: {
-              added: [],
-              changed: ["package4"],
-              removed: [],
-            },
-          },
-          labels: {
-            "10.rebuild-darwin: 1-10": true,
-            "10.rebuild-linux: 1-10": true
-          },
-          rebuildsByKernel: {
-            darwin: ["package1", "package2"],
-            linux: ["package1", "package2", "package3"]
-          },
-          rebuildCountByKernel: {
-            darwin: 2,
-            linux: 3,
-          },
-          rebuildsByPlatform: {
-            aarch64-darwin: ["package1", "package2"],
-            aarch64-linux: ["package1", "package2"],
-            x86_64-linux: ["package1", "package2", "package3"],
-            x86_64-darwin: ["package1"],
-          },
-        }
-      - step-summary.md: A markdown render of the changes
-
-    ---
-    Implementation details:
-
-    Helper functions can be found in ./utils.nix.
-    Two main "types" are important:
-
-    - `packagePlatformPath`: A string of the form "<PACKAGE_PATH>.<PLATFORM>"
-      Example: "python312Packages.numpy.x86_64-linux"
-
-    - `packagePlatformAttr`: An attrs representation of a packagePlatformPath:
-      Example: { name = "python312Packages.numpy"; platform = "x86_64-linux"; }
-  */
-  inherit (import ./utils.nix { inherit lib; })
-    groupByKernel
-    convertToPackagePlatformAttrs
-    groupAttrdiffByKernel
-    groupAttrdiffByPlatform
-    groupByPlatform
-    extractPackageNames
-    getLabels
-    ;
-
-  # Attrs
-  # - keys: "added", "changed", "removed" and "rebuilds"
-  # - values: lists of `packagePlatformPath`s
-  diffAttrs = builtins.fromJSON (builtins.readFile "${combined}/combined-diff.json");
-
-  rebuildsPackagePlatformAttrs = convertToPackagePlatformAttrs diffAttrs.rebuilds;
-
-  changed-paths =
-    let
-      attrdiff = lib.mapAttrs (_: extractPackageNames) {
-        inherit (diffAttrs) added changed removed;
-      };
-      attrdiffByPlatform = groupAttrdiffByPlatform {
-        inherit (diffAttrs) added changed removed;
-      };
-      attrdiffByKernel = groupAttrdiffByKernel {
-        inherit (diffAttrs) added changed removed;
-      };
-      rebuildsByPlatform = groupByPlatform rebuildsPackagePlatformAttrs;
-      rebuildsByKernel = groupByKernel rebuildsPackagePlatformAttrs;
-      rebuildCountByKernel = lib.mapAttrs (
-        kernel: kernelRebuilds: lib.length kernelRebuilds
-      ) rebuildsByKernel;
-      rebuildNames = extractPackageNames diffAttrs.rebuilds;
-    in
-    writeText "changed-paths.json" (
-      builtins.toJSON {
-        inherit attrdiff attrdiffByKernel attrdiffByPlatform;
-        inherit
-          rebuildsByPlatform
-          rebuildsByKernel
-          rebuildCountByKernel
-          ;
-        labels =
-          getLabels rebuildCountByKernel
-          # Sets "10.rebuild-*-stdenv" label to whether the "stdenv" attribute was changed.
-          // lib.mapAttrs' (
-            kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
-          ) rebuildsByKernel
-          // {
-            "10.rebuild-nixos-tests" =
-              lib.elem "nixosTests.simple-container" rebuildNames || lib.elem "nixosTests.simple-vm" rebuildNames;
-          };
-      }
-    );
-
-  getMaintainers = callPackage ./maintainers.nix { };
-
-  inherit
-    (getMaintainers {
-      affectedAttrPaths = map (a: a.packagePath) (
-        convertToPackagePlatformAttrs (diffAttrs.changed ++ diffAttrs.removed)
-      );
-      changedFiles = lib.importJSON touchedFilesJson;
-    })
-    users
-    teams
-    packages
-    ;
-in
-runCommand "compare"
-  {
-    # Don't depend on -dev outputs to reduce closure size for CI.
-    nativeBuildInputs = map lib.getBin [
-      jq
-      cmp-stats
-      codeowners
-    ];
-    users = builtins.toJSON users;
-    teams = builtins.toJSON teams;
-    packages = builtins.toJSON (lib.map (lib.concatStringsSep ".") packages);
-    passAsFile = [
-      "users"
-      "teams"
-      "packages"
-    ];
-  }
-  ''
-    mkdir $out
-
-    cp ${changed-paths} $out/changed-paths.json
-
-    {
-      echo
-      echo "# Packages"
-      echo
-      jq -r -f ${./generate-step-summary.jq} < ${changed-paths}
-    } >> $out/step-summary.md
-
-    if jq -e '(.attrdiff.added | length == 0) and (.attrdiff.removed | length == 0)' "${changed-paths}" > /dev/null; then
-      # Chunks have changed between revisions
-      # We cannot generate a performance comparison
-      {
-        echo
-        echo "# Performance comparison"
-        echo
-        echo "This compares the performance of this branch against its pull request base branch (e.g., 'master')"
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-        echo
-      } >> $out/step-summary.md
-
-      cmp-stats --explain ${combined}/before/stats ${combined}/after/stats >> $out/step-summary.md
-
-    else
-      # Package chunks are the same in both revisions
-      # We can use the to generate a performance comparison
-      {
-        echo
-        echo "# Performance Comparison"
-        echo
-        echo "Performance stats were skipped because the package sets differ between the two revisions."
-        echo
-        echo "For further help please refer to: [ci/README.md](https://github.com/NixOS/nixpkgs/blob/master/ci/README.md)"
-      } >> $out/step-summary.md
-    fi
-
-    jq -r '.[]' "${touchedFilesJson}" > ./touched-files
-    readarray -t touchedFiles < ./touched-files
-    echo "This PR touches ''${#touchedFiles[@]} files"
-
-    # TODO: Move ci/OWNERS to Nix and produce owners.json instead of owners.txt.
-    touch "$out/owners.txt"
-    for file in "''${touchedFiles[@]}"; do
-        result=$(codeowners --file "${ownersFile}" "$file")
-
-        # Remove the file prefix and trim the surrounding spaces
-        read -r owners <<< "''${result#"$file"}"
-        if [[ "$owners" == "(unowned)" ]]; then
-            echo "File $file is unowned"
-            continue
-        fi
-        echo "File $file is owned by $owners"
-
-        # Split up multiple owners, separated by arbitrary amounts of spaces
-        IFS=" " read -r -a entries <<< "$owners"
-
-        for entry in "''${entries[@]}"; do
-            # GitHub technically also supports Emails as code owners,
-            # but we can't easily support that, so let's not
-            if [[ ! "$entry" =~ @(.*) ]]; then
-                echo -e "\e[33mCodeowner \"$entry\" for file $file is not valid: Must start with \"@\"\e[0m"
-                # Don't fail, because the PR for which this script runs can't fix it,
-                # it has to be fixed in the base branch
-                continue
-            fi
-            # The first regex match is everything after the @
-            entry=''${BASH_REMATCH[1]}
-
-            echo "$entry" >> "$out/owners.txt"
-        done
-
-    done
-
-    cp "$usersPath" "$out/maintainers.json"
-    cp "$teamsPath" "$out/teams.json"
-    cp "$packagesPath" "$out/packages.json"
-  ''

ci/eval/compare/generate-step-summary.jq

@@ -1,30 +0,0 @@
-def truncate(xs; n):
-  if xs | length > n then xs[:n] + ["..."]
-  else xs
-  end;
-
-def itemize_packages(xs):
-  truncate(xs; 2000) |
-    map("- [\(.)](https://search.nixos.org/packages?channel=unstable&show=\(.)&from=0&size=50&sort=relevance&type=packages&query=\(.))")  |
-    join("\n");
-
-def get_title(s; xs):
-  s + " (" + (xs | length | tostring) + ")";
-
-def section(title; xs):
-  "<details> <summary>" + get_title(title; xs) + "</summary>\n\n" + itemize_packages(xs) + "</details>";
-
-def fallback_document(content; n):
-  if content | utf8bytelength > n then
-    get_title("Added packages"; .attrdiff.added) + "\n\n" +
-    get_title("Removed packages"; .attrdiff.removed) + "\n\n" +
-    get_title("Changed packages"; .attrdiff.changed)
-  else content
-  end;
-
-# we truncate the list to stay below the GitHub limit of 1MB per step summary.
-fallback_document(
-  section("Added packages"; .attrdiff.added) + "\n\n" +
-  section("Removed packages"; .attrdiff.removed) + "\n\n" +
-  section("Changed packages"; .attrdiff.changed); 1000 * 1000
-)

ci/eval/compare/maintainers.nix

@@ -1,159 +0,0 @@
-# Figure out which maintainers (users/teams) are relevant for a PR:
-# - All maintainers that can be linked directly to changedFiles
-# - Maintainers of affectedAttrPaths if a file directly related to the attribute is in changedFiles
-#
-# Files and attributes are linked in various ways:
-# - pkgs/by-name/<attr>/* is linked to pkgs.<attr>
-# - The file position of various attributes of pkgs.<attr>
-# - Explicitly specified file positions in derivations
-#
-# Test with
-#   nix-instantiate --eval --strict --json test.nix -A result | jq
-#
-# Empty list as an output means success
-
-# Dependencies coming from the CI-pinned Nixpkgs
-{
-  lib,
-}:
-# Function arguments
-{
-  # Files that were changed
-  # Type: ListOf (Nixpkgs-root-relative path)
-  changedFiles,
-  # Attributes whose value was affected by the change
-  # Type: ListOf (ListOf String)
-  affectedAttrPaths,
-  # Nixpkgs used to check maintainers. Customisable for testing
-  pkgs ? import ../../.. {
-    system = "x86_64-linux";
-    # We should never try to ping maintainers through package aliases, this can only lead to errors.
-    # One example case is, where an attribute is a throw alias, but then re-introduced in a PR.
-    # This would trigger the throw. By disabling aliases, we can fallback gracefully below.
-    config.allowAliases = false;
-    overlays = [ ];
-  },
-}:
-let
-  nixpkgsRoot = toString ../../.. + "/";
-  stripNixpkgsRootFromKeys = lib.mapAttrs' (
-    file: value: lib.nameValuePair (lib.removePrefix nixpkgsRoot file) value
-  );
-
-  moduleMeta = (pkgs.nixos { }).config.meta;
-
-  # Currently just nixos module maintainers, but in the future we can use this for code owners too
-  fileUsers = stripNixpkgsRootFromKeys moduleMeta.maintainers;
-  fileTeams = stripNixpkgsRootFromKeys moduleMeta.teams;
-
-  anyMatchingFile = filename: lib.any (lib.hasPrefix filename) changedFiles;
-
-  anyMatchingFiles = files: lib.any anyMatchingFile files;
-
-  relevantFilenames =
-    drv:
-    (lib.unique (
-      map (pos: lib.removePrefix nixpkgsRoot pos.file) (
-        lib.filter (x: x != null) [
-          (drv.meta.maintainersPosition or null)
-          (drv.meta.teamsPosition or null)
-          (lib.unsafeGetAttrPos "src" drv)
-          (lib.unsafeGetAttrPos "pname" drv)
-          (lib.unsafeGetAttrPos "version" drv)
-        ]
-        ++ lib.optionals (drv ? meta.position) [
-          # Use ".meta.position" for cases when most of the package is
-          # defined in a "common" section and the only place where
-          # reference to the file with a derivation the "pos"
-          # attribute.
-          #
-          # ".meta.position" has the following form:
-          #   "pkgs/tools/package-management/nix/default.nix:155"
-          # We transform it to the following:
-          #   { file = "pkgs/tools/package-management/nix/default.nix"; }
-          { file = lib.head (lib.splitString ":" drv.meta.position); }
-        ]
-      )
-    ));
-
-  relevantAffectedAttrPaths = lib.filter (
-    attrPath:
-    # Some packages might be reported as changed on a different platform, but
-    # not even have an attribute on the platform the maintainers are requested on.
-    # Fallback to `null` for these to filter them out
-    let
-      package = lib.attrByPath attrPath null pkgs;
-    in
-    package != null && anyMatchingFiles (relevantFilenames package)
-  ) affectedAttrPaths;
-
-  # Extract attributes that changed from by-name paths.
-  # This allows pinging reviewers for pure refactors.
-  changedByNameAttrPaths = lib.pipe changedFiles [
-    (lib.filter (changed: lib.hasPrefix "pkgs/by-name/" changed))
-    (map (lib.splitString "/"))
-    # Filters out e.g. pkgs/by-name/README.md
-    (lib.filter (path: lib.length path > 3))
-    (map (path: lib.elemAt path 3))
-    (map lib.singleton)
-    # Filter out new packages
-    (lib.filter (attrPath: lib.hasAttrByPath attrPath pkgs))
-  ];
-
-  # An attribute can appear in affected *and* touched
-  attrPathsToGetMaintainersFor = lib.unique (relevantAffectedAttrPaths ++ changedByNameAttrPaths);
-
-  attrPathEntities = lib.concatMap (
-    attrPath:
-    let
-      package = lib.getAttrFromPath attrPath pkgs;
-    in
-    # meta.maintainers also contains all individual team members.
-    # We only want to ping individuals if they're added individually as maintainers, not via teams.
-    userPings { inherit attrPath; } (package.meta.nonTeamMaintainers or [ ])
-    ++ lib.concatMap (teamPings { inherit attrPath; }) (package.meta.teams or [ ])
-  ) attrPathsToGetMaintainersFor;
-
-  changedFileEntities = lib.concatMap (
-    file:
-    userPings { inherit file; } (fileUsers.${file} or [ ])
-    ++ lib.concatMap (teamPings { inherit file; }) (fileTeams.${file} or [ ])
-  ) changedFiles;
-
-  userPings =
-    context:
-    map (maintainer: {
-      type = "user";
-      userId = maintainer.githubId;
-      inherit context;
-    });
-
-  teamPings =
-    context: team:
-    if team ? githubId then
-      [
-        {
-          type = "team";
-          teamId = team.githubId;
-          inherit context;
-        }
-      ]
-    else
-      userPings context team.members;
-
-  byType = lib.groupBy (ping: ping.type) (attrPathEntities ++ changedFileEntities);
-
-  byUser = lib.pipe (byType.user or [ ]) [
-    (lib.groupBy (ping: toString ping.userId))
-    (lib.mapAttrs (_user: lib.map (pkg: pkg.context)))
-  ];
-  byTeam = lib.pipe (byType.team or [ ]) [
-    (lib.groupBy (ping: toString ping.teamId))
-    (lib.mapAttrs (_team: lib.map (pkg: pkg.context)))
-  ];
-in
-{
-  users = byUser;
-  teams = byTeam;
-  packages = attrPathsToGetMaintainersFor;
-}

ci/eval/compare/test.nix

@@ -1,311 +0,0 @@
-{
-  pkgs ? import ../../.. {
-    config = { };
-    overlays = [ ];
-  },
-  lib ? pkgs.lib,
-}:
-let
-  fun = import ./maintainers.nix { inherit lib; };
-  utils = import ./utils.nix { inherit lib; };
-
-  mockPkgs =
-    {
-      packages ? [ ],
-      modules ? [ ],
-      githubTeams ? true,
-    }:
-    lib.updateManyAttrsByPath
-      (lib.imap0 (i: p: {
-        path = p;
-        update = _: {
-          meta.maintainersPosition.file = lib.concatStringsSep "/" p;
-          meta.nonTeamMaintainers = [ { githubId = i; } ];
-          meta.teams =
-            if githubTeams then [ { githubId = i + 100; } ] else [ { members = [ { githubId = i + 100; } ]; } ];
-        };
-      }) packages)
-      {
-        nixos =
-          { }:
-          {
-            config.meta.maintainers = lib.listToAttrs (
-              lib.imap0 (i: m: lib.nameValuePair m [ { githubId = i; } ]) modules
-            );
-            config.meta.teams = lib.listToAttrs (
-              lib.imap0 (
-                i: m:
-                lib.nameValuePair m (
-                  if githubTeams then [ { githubId = i + 100; } ] else [ { members = [ { githubId = i + 100; } ]; } ]
-                )
-              ) modules
-            );
-          };
-      };
-
-  tests = {
-    testEmpty = {
-      expr = fun {
-        pkgs = mockPkgs { };
-        changedFiles = [ ];
-        affectedAttrPaths = [ ];
-      };
-      expected = {
-        packages = [ ];
-        teams = { };
-        users = { };
-      };
-    };
-    testNonExistentAffected = {
-      expr = fun {
-        pkgs = mockPkgs { };
-        changedFiles = [ "a" ];
-        affectedAttrPaths = [ [ "b" ] ];
-      };
-      expected = {
-        packages = [ ];
-        teams = { };
-        users = { };
-      };
-    };
-    testIrrelevantAffected = {
-      expr = fun {
-        pkgs = mockPkgs {
-          packages = [ [ "b" ] ];
-        };
-        changedFiles = [ "a" ];
-        affectedAttrPaths = [ [ "b" ] ];
-      };
-      expected = {
-        packages = [ ];
-        teams = { };
-        users = { };
-      };
-    };
-    testRelevantAffected = {
-      expr = fun {
-        pkgs = mockPkgs {
-          packages = [ [ "b" ] ];
-        };
-        # Also tests that subpaths work
-        changedFiles = [ "b/c" ];
-        affectedAttrPaths = [ [ "b" ] ];
-      };
-      expected = {
-        packages = [ [ "b" ] ];
-        teams."100" = [
-          { attrPath = [ "b" ]; }
-        ];
-        users."0" = [
-          { attrPath = [ "b" ]; }
-        ];
-      };
-    };
-    testRelevantAffectedNonGitHub = {
-      expr = fun {
-        pkgs = mockPkgs {
-          packages = [ [ "b" ] ];
-          githubTeams = false;
-        };
-        changedFiles = [ "b/c" ];
-        affectedAttrPaths = [ [ "b" ] ];
-      };
-      expected = {
-        packages = [ [ "b" ] ];
-        teams = { };
-        users."0" = [
-          { attrPath = [ "b" ]; }
-        ];
-        users."100" = [
-          { attrPath = [ "b" ]; }
-        ];
-      };
-    };
-    testByNameChanged = {
-      expr = fun {
-        pkgs = mockPkgs {
-          packages = [ [ "hello" ] ];
-        };
-        changedFiles = [ "pkgs/by-name/he/hello/sources.json" ];
-        affectedAttrPaths = [ ];
-      };
-      expected = {
-        packages = [ [ "hello" ] ];
-        teams."100" = [
-          { attrPath = [ "hello" ]; }
-        ];
-        users."0" = [
-          { attrPath = [ "hello" ]; }
-        ];
-      };
-    };
-    testByNameNonExistentChanged = {
-      expr = fun {
-        pkgs = mockPkgs {
-          packages = [ ];
-        };
-        # Happens when a new package was added to pkgs/by-name
-        changedFiles = [ "pkgs/by-name/he/hello/sources.json" ];
-        affectedAttrPaths = [ ];
-      };
-      expected = {
-        packages = [ ];
-        teams = { };
-        users = { };
-      };
-    };
-    testByNameReadmeChanged = {
-      expr = fun {
-        pkgs = mockPkgs {
-          packages = [ [ "hello" ] ];
-        };
-        changedFiles = [ "pkgs/by-name/README.md" ];
-        affectedAttrPaths = [ ];
-      };
-      expected = {
-        packages = [ ];
-        teams = { };
-        users = { };
-      };
-    };
-    testNoDuplicates = {
-      expr = fun {
-        pkgs = mockPkgs {
-          packages = [ [ "hello" ] ];
-        };
-        changedFiles = [
-          "hello"
-          "pkgs/by-name/he/hello/sources.json"
-        ];
-        affectedAttrPaths = [ [ "hello" ] ];
-      };
-      expected = {
-        packages = [ [ "hello" ] ];
-        teams."100" = [
-          { attrPath = [ "hello" ]; }
-        ];
-        users."0" = [
-          { attrPath = [ "hello" ]; }
-        ];
-      };
-    };
-    testModuleMaintainers = {
-      expr = fun {
-        pkgs = mockPkgs {
-          modules = [ "a" ];
-        };
-        changedFiles = [ "a" ];
-        affectedAttrPaths = [ ];
-      };
-      expected = {
-        packages = [ ];
-        teams."100" = [
-          { file = "a"; }
-        ];
-        users."0" = [
-          { file = "a"; }
-        ];
-      };
-    };
-    testModuleMaintainersNonGithub = {
-      expr = fun {
-        pkgs = mockPkgs {
-          modules = [ "a" ];
-          githubTeams = false;
-        };
-        changedFiles = [ "a" ];
-        affectedAttrPaths = [ ];
-      };
-      expected = {
-        packages = [ ];
-        teams = { };
-        users."100" = [
-          { file = "a"; }
-        ];
-        users."0" = [
-          { file = "a"; }
-        ];
-      };
-    };
-    testGroupAttrdiffByPlatform = {
-      expr = utils.groupAttrdiffByPlatform {
-        added = [
-          "new-tool.aarch64-linux"
-          "new-tool.x86_64-darwin"
-        ];
-        changed = [
-          "updated-tool.x86_64-darwin"
-          "shared-tool.x86_64-darwin"
-        ];
-        removed = [
-          "removed-tool.aarch64-darwin"
-          "shared-tool.aarch64-darwin"
-        ];
-      };
-      expected = {
-        aarch64-darwin = {
-          added = [ ];
-          changed = [ ];
-          removed = [
-            "removed-tool"
-            "shared-tool"
-          ];
-        };
-        aarch64-linux = {
-          added = [ "new-tool" ];
-          changed = [ ];
-          removed = [ ];
-        };
-        x86_64-darwin = {
-          added = [ "new-tool" ];
-          changed = [
-            "shared-tool"
-            "updated-tool"
-          ];
-          removed = [ ];
-        };
-      };
-    };
-    testGroupAttrdiffByKernel = {
-      expr =
-        let
-          grouped = utils.groupAttrdiffByKernel {
-            added = [
-              "new-tool.aarch64-linux"
-              "new-tool.x86_64-darwin"
-            ];
-            changed = [
-              "updated-tool.x86_64-darwin"
-              "shared-tool.x86_64-darwin"
-            ];
-            removed = [
-              "removed-tool.aarch64-darwin"
-              "shared-tool.aarch64-darwin"
-            ];
-          };
-        in
-        lib.mapAttrs (_: diff: lib.mapAttrs (_: lib.sort lib.lessThan) diff) grouped;
-      expected = {
-        darwin = {
-          added = [ "new-tool" ];
-          changed = [
-            "shared-tool"
-            "updated-tool"
-          ];
-          removed = [
-            "removed-tool"
-            "shared-tool"
-          ];
-        };
-        linux = {
-          added = [ "new-tool" ];
-          changed = [ ];
-          removed = [ ];
-        };
-      };
-    };
-  };
-in
-{
-  result = lib.runTests tests;
-}

ci/eval/compare/utils.nix

@@ -1,239 +0,0 @@
-{ lib, ... }:
-rec {
-  # Borrowed from https://github.com/NixOS/nixpkgs/pull/355616
-  uniqueStrings = list: builtins.attrNames (builtins.groupBy lib.id list);
-
-  /*
-    Converts a `packagePlatformPath` into a `packagePlatformAttr`
-
-    Turns
-      "hello.aarch64-linux"
-    into
-      {
-        name = "hello";
-        packagePath = [ "hello" ];
-        platform = "aarch64-linux";
-      }
-  */
-  convertToPackagePlatformAttr =
-    packagePlatformPath:
-    let
-      # python312Packages.numpy.aarch64-linux -> ["python312Packages" "numpy" "aarch64-linux"]
-      splittedPath = lib.splitString "." packagePlatformPath;
-
-      # ["python312Packages" "numpy" "aarch64-linux"] -> ["python312Packages" "numpy"]
-      packagePath = lib.init splittedPath;
-
-      # "python312Packages.numpy"
-      name = lib.concatStringsSep "." packagePath;
-    in
-    if name == "" then
-      null
-    else
-      {
-        # [ "python312Packages" "numpy" ]
-        inherit packagePath;
-
-        # python312Packages.numpy
-        inherit name;
-
-        # "aarch64-linux"
-        platform = lib.last splittedPath;
-      };
-
-  /*
-    Converts a list of `packagePlatformPath`s into a list of `packagePlatformAttr`s
-
-    Turns
-      [
-        "hello.aarch64-linux"
-        "hello.x86_64-linux"
-        "hello.aarch64-darwin"
-        "hello.x86_64-darwin"
-        "bye.x86_64-darwin"
-        "bye.aarch64-darwin"
-        "release-checks"  <- Will be dropped
-      ]
-    into
-      [
-        { name = "hello"; platform = "aarch64-linux"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "x86_64-linux"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "aarch64-darwin"; packagePath = [ "hello" ]; }
-        { name = "hello"; platform = "x86_64-darwin"; packagePath = [ "hello" ]; }
-        { name = "bye"; platform = "aarch64-darwin"; packagePath = [ "hello" ]; }
-        { name = "bye"; platform = "x86_64-darwin"; packagePath = [ "hello" ]; }
-      ]
-  */
-  convertToPackagePlatformAttrs =
-    packagePlatformPaths:
-    builtins.filter (x: x != null) (map convertToPackagePlatformAttr packagePlatformPaths);
-
-  /*
-    Converts a list of `packagePlatformPath`s directly to a list of (unique) package names
-
-    Turns
-      [
-        "hello.aarch64-linux"
-        "hello.x86_64-linux"
-        "hello.aarch64-darwin"
-        "hello.x86_64-darwin"
-        "bye.x86_64-darwin"
-        "bye.aarch64-darwin"
-      ]
-    into
-      [
-        "hello"
-        "bye"
-      ]
-  */
-  extractPackageNames =
-    packagePlatformPaths:
-    let
-      packagePlatformAttrs = convertToPackagePlatformAttrs (uniqueStrings packagePlatformPaths);
-    in
-    uniqueStrings (map (p: p.name) packagePlatformAttrs);
-
-  /*
-    Group a list of `packagePlatformAttr`s by platforms
-
-    Turns
-      [
-        { name = "hello"; platform = "aarch64-linux"; ... }
-        { name = "hello"; platform = "x86_64-linux"; ... }
-        { name = "hello"; platform = "aarch64-darwin"; ... }
-        { name = "hello"; platform = "x86_64-darwin"; ... }
-        { name = "bye"; platform = "aarch64-darwin"; ... }
-        { name = "bye"; platform = "x86_64-darwin"; ... }
-      ]
-    into
-      {
-        aarch64-linux = [ "hello" ];
-        x86_64-linux = [ "hello" ];
-        aarch64-darwin = [ "hello" "bye" ];
-        x86_64-darwin = [ "hello" "bye" ];
-      }
-  */
-  groupByPlatform =
-    packagePlatformAttrs:
-    let
-      packagePlatformAttrsByPlatform = builtins.groupBy (p: p.platform) packagePlatformAttrs;
-      extractPackageNames = map (p: p.name);
-    in
-    lib.mapAttrs (_: extractPackageNames) packagePlatformAttrsByPlatform;
-
-  # Turns
-  # [
-  #   { name = "hello"; platform = "aarch64-linux"; ... }
-  #   { name = "hello"; platform = "x86_64-linux"; ... }
-  #   { name = "hello"; platform = "aarch64-darwin"; ... }
-  #   { name = "hello"; platform = "x86_64-darwin"; ... }
-  #   { name = "bye"; platform = "aarch64-darwin"; ... }
-  #   { name = "bye"; platform = "x86_64-darwin"; ... }
-  # ]
-  #
-  # into
-  #
-  # {
-  #   linux = [ "hello" ];
-  #   darwin = [ "hello" "bye" ];
-  # }
-  groupByKernel =
-    packagePlatformAttrs:
-    let
-      filterKernel =
-        kernel:
-        builtins.attrNames (
-          builtins.groupBy (p: p.name) (
-            builtins.filter (p: lib.hasSuffix kernel p.platform) packagePlatformAttrs
-          )
-        );
-    in
-    lib.genAttrs [ "linux" "darwin" ] filterKernel;
-
-  /*
-    Group an attrdiff-style mapping by a derived key such as platform or kernel.
-
-    Turns
-      {
-        added = [ "new-tool.aarch64-linux" "new-tool.x86_64-darwin" ];
-        changed = [ "updated-tool.x86_64-darwin" "shared-tool.x86_64-darwin" ];
-        removed = [ "removed-tool.aarch64-darwin" "shared-tool.aarch64-darwin" ];
-      }
-    into
-      {
-        aarch64-darwin = {
-          added = [ ];
-          changed = [ ];
-          removed = [ "removed-tool" "shared-tool" ];
-        };
-        aarch64-linux = {
-          added = [ "new-tool" ];
-          changed = [ ];
-          removed = [ ];
-        };
-        x86_64-darwin = {
-          added = [ "new-tool" ];
-          changed = [ "shared-tool" "updated-tool" ];
-          removed = [ ];
-        };
-      }
-    when used with `groupByPlatform`.
-  */
-  groupAttrdiffBy =
-    grouper: attrdiff:
-    let
-      groupedByKind = lib.mapAttrs (
-        _: packagePlatformPaths:
-        grouper (convertToPackagePlatformAttrs (uniqueStrings packagePlatformPaths))
-      ) attrdiff;
-      groups = uniqueStrings (lib.flatten (map builtins.attrNames (lib.attrValues groupedByKind)));
-    in
-    lib.genAttrs groups (group: lib.mapAttrs (_: byGroup: byGroup.${group} or [ ]) groupedByKind);
-
-  groupAttrdiffByPlatform = groupAttrdiffBy groupByPlatform;
-
-  groupAttrdiffByKernel = groupAttrdiffBy groupByKernel;
-
-  /*
-    Maps an attrs of `kernel - rebuild counts` mappings to an attrs of labels
-
-    Turns
-      {
-        linux = 56;
-        darwin = 1;
-      }
-    into
-      {
-        "10.rebuild-darwin: 1" = true;
-        "10.rebuild-darwin: 1-10" = true;
-        "10.rebuild-darwin: 11-100" = false;
-        # [...]
-        "10.rebuild-darwin: 1" = false;
-        "10.rebuild-darwin: 1-10" = false;
-        "10.rebuild-linux: 11-100" = true;
-        # [...]
-      }
-  */
-  getLabels =
-    rebuildCountByKernel:
-    lib.mergeAttrsList (
-      lib.mapAttrsToList (
-        kernel: rebuildCount:
-        let
-          range = from: to: from <= rebuildCount && (to == null || rebuildCount <= to);
-        in
-        lib.mapAttrs' (number: lib.nameValuePair "10.rebuild-${kernel}: ${number}") {
-          "0" = range 0 0;
-          "1" = range 1 1;
-          "1-10" = range 1 10;
-          "11-100" = range 11 100;
-          "101-500" = range 101 500;
-          "501-1000" = range 501 1000;
-          "501+" = range 501 null;
-          "1001-2500" = range 1001 2500;
-          "2501-5000" = range 2501 5000;
-          "5001+" = range 5001 null;
-        }
-      ) rebuildCountByKernel
-    );
-}

ci/eval/default.nix

@@ -1,326 +0,0 @@
-# Evaluates all the accessible paths in nixpkgs.
-# *This only builds on Linux* since it requires the Linux sandbox isolation to
-# be able to write in various places while evaluating inside the sandbox.
-#
-# This file is used by nixpkgs CI (see .github/workflows/eval.yml) as well as
-# being used directly as an entry point in Lix's CI (in `flake.nix` in the Lix
-# repo).
-#
-# If you know you are doing a breaking API change, please ping the nixpkgs CI
-# maintainers and the Lix maintainers (`nix eval -f . lib.teams.lix`).
-{
-  callPackage,
-  lib,
-  runCommand,
-  writeShellScript,
-  symlinkJoin,
-  busybox,
-  jq,
-  nix,
-}:
-
-{
-  # The number of attributes per chunk, see ./README.md for more info.
-  chunkSize ? 5000,
-  # Whether to just evaluate a single chunk for quick testing
-  quickTest ? false,
-  # Don't try to eval packages marked as broken.
-  includeBroken ? false,
-  # Customize the config used to evaluate nixpkgs
-  extraNixpkgsConfig ? { },
-}:
-
-let
-  nixpkgs =
-    with lib.fileset;
-    toSource {
-      root = ../..;
-      fileset = unions (
-        map (lib.path.append ../..) [
-          ".version"
-          "ci/eval/attrpaths.nix"
-          "ci/eval/chunk.nix"
-          "ci/eval/outpaths.nix"
-          "default.nix"
-          "doc"
-          "lib"
-          "maintainers"
-          "modules"
-          "nixos"
-          "pkgs"
-        ]
-      );
-    };
-
-  supportedSystems = builtins.fromJSON (
-    builtins.readFile ../../pkgs/top-level/release-supported-systems.json
-  );
-
-  attrpathsSuperset =
-    {
-      evalSystem,
-    }:
-    runCommand "attrpaths-superset.json"
-      {
-        src = nixpkgs;
-        # Don't depend on -dev outputs to reduce closure size for CI.
-        nativeBuildInputs = map lib.getBin [
-          busybox
-          nix
-        ];
-      }
-      ''
-        export NIX_STATE_DIR=$(mktemp -d)
-        mkdir $out
-        export GC_INITIAL_HEAP_SIZE=4g
-        command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
-          nix-instantiate --eval --strict --json --show-trace \
-            "$src/ci/eval/attrpaths.nix" \
-            -A paths \
-            -I "$src" \
-            --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
-            --option restrict-eval true \
-            --option allow-import-from-derivation false \
-            --option eval-system "${evalSystem}" > $out/paths.json
-      '';
-
-  singleSystem =
-    {
-      # The system to evaluate.
-      # Note that this is intentionally not called `system`,
-      # because `--argstr system` would only be passed to the ci/default.nix file!
-      evalSystem ? builtins.currentSystem,
-      # The path to the `paths.json` file from `attrpathsSuperset`
-      attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
-    }:
-    let
-      singleChunk = writeShellScript "single-chunk" ''
-        set -euo pipefail
-        chunkSize=$1
-        myChunk=$2
-        system=$3
-        outputDir=$4
-
-        # Default is 5, higher values effectively disable the warning.
-        # This randomly breaks Eval.
-        export GC_LARGE_ALLOC_WARN_INTERVAL=1000
-
-        export NIX_SHOW_STATS=1
-        export NIX_SHOW_STATS_PATH="$outputDir/stats/$myChunk"
-        echo "Chunk $myChunk on $system start"
-        set +e
-        command time -o "$outputDir/timestats/$myChunk" \
-          -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
-          nix-env -f "${nixpkgs}/ci/eval/chunk.nix" \
-          --eval-system "$system" \
-          --option restrict-eval true \
-          --option allow-import-from-derivation false \
-          --query --available \
-          --out-path --json \
-          --meta \
-          --show-trace \
-          --arg chunkSize "$chunkSize" \
-          --arg myChunk "$myChunk" \
-          --arg attrpathFile "${attrpathFile}" \
-          --arg systems "[ \"$system\" ]" \
-          --arg includeBroken ${lib.boolToString includeBroken} \
-          --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
-          -I ${nixpkgs} \
-          -I ${attrpathFile} \
-          > "$outputDir/result/$myChunk" \
-          2> "$outputDir/stderr/$myChunk"
-        exitCode=$?
-        set -e
-        cat "$outputDir/stderr/$myChunk"
-        cat "$outputDir/timestats/$myChunk"
-        if (( exitCode != 0 )); then
-          echo "Evaluation failed with exit code $exitCode"
-          # This immediately halts all xargs processes
-          kill $PPID
-        elif [[ -s "$outputDir/stderr/$myChunk" ]]; then
-          echo "Nixpkgs on $system evaluated with warnings, aborting"
-          kill $PPID
-        fi
-      '';
-    in
-    runCommand "nixpkgs-eval-${evalSystem}"
-      {
-        # Don't depend on -dev outputs to reduce closure size for CI.
-        nativeBuildInputs = map lib.getBin [
-          busybox
-          jq
-          nix
-        ];
-        env = {
-          inherit evalSystem chunkSize;
-        };
-        __structuredAttrs = true;
-        unsafeDiscardReferences.out = true;
-      }
-      ''
-        export NIX_STATE_DIR=$(mktemp -d)
-        nix-store --init
-
-        echo "System: $evalSystem"
-        cores=$NIX_BUILD_CORES
-        echo "Cores: $cores"
-        attrCount=$(jq length "${attrpathFile}")
-        echo "Attribute count: $attrCount"
-        echo "Chunk size: $chunkSize"
-        # Same as `attrCount / chunkSize` but rounded up
-        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-        echo "Chunk count: $chunkCount"
-
-        mkdir -p $out/${evalSystem}
-
-        # Record and print stats on free memory and swap in the background
-        (
-          while true; do
-            availMemory=$(free -m | grep Mem | awk '{print $7}')
-            freeSwap=$(free -m | grep Swap | awk '{print $4}')
-            echo "Available memory: $(( availMemory )) MiB, free swap: $(( freeSwap )) MiB"
-
-            if [[ ! -f "$out/${evalSystem}/min-avail-memory" ]] || (( availMemory < $(<$out/${evalSystem}/min-avail-memory) )); then
-              echo "$availMemory" > $out/${evalSystem}/min-avail-memory
-            fi
-            if [[ ! -f $out/${evalSystem}/min-free-swap ]] || (( freeSwap < $(<$out/${evalSystem}/min-free-swap) )); then
-              echo "$freeSwap" > $out/${evalSystem}/min-free-swap
-            fi
-            sleep 4
-          done
-        ) &
-
-        seq_end=$(( chunkCount - 1 ))
-
-        ${lib.optionalString quickTest ''
-          seq_end=0
-        ''}
-
-        chunkOutputDir=$(mktemp -d)
-        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
-
-        seq -w 0 "$seq_end" |
-          command time -f "%e" -o "$out/${evalSystem}/total-time" \
-          xargs -I{} -P"$cores" \
-          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
-
-        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk
-
-        if (( chunkSize * chunkCount != attrCount )); then
-          # A final incomplete chunk would mess up the stats, don't include it
-          rm "$chunkOutputDir"/stats/"$seq_end"
-        fi
-
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
-      '';
-
-  diff = callPackage ./diff.nix { };
-
-  combine =
-    {
-      diffDir,
-    }:
-    runCommand "combined-eval"
-      {
-        # Don't depend on -dev outputs to reduce closure size for CI.
-        nativeBuildInputs = map lib.getBin [
-          jq
-        ];
-      }
-      ''
-        mkdir -p $out
-
-        # Combine output paths from all systems
-        cat ${diffDir}/*/diff.json | jq -s '
-          reduce .[] as $item ({}; {
-            added: (.added + $item.added),
-            changed: (.changed + $item.changed),
-            removed: (.removed + $item.removed),
-            rebuilds: (.rebuilds + $item.rebuilds)
-          })
-        ' > $out/combined-diff.json
-
-        # Combine maintainers from all systems
-        cat ${diffDir}/*/maintainers.json | jq -s '
-          add | group_by(.package) | map({
-            key: .[0].package,
-            value: map(.maintainers) | flatten | unique
-          }) | from_entries
-        ' > $out/maintainers.json
-
-        mkdir -p $out/before/stats
-        for d in ${diffDir}/before/*; do
-          cp -r "$d"/stats-by-chunk $out/before/stats/$(basename "$d")
-        done
-
-        mkdir -p $out/after/stats
-        for d in ${diffDir}/after/*; do
-          cp -r "$d"/stats-by-chunk $out/after/stats/$(basename "$d")
-        done
-      '';
-
-  compare = callPackage ./compare { };
-
-  baseline =
-    {
-      # Whether to evaluate on a specific set of systems, by default all are evaluated
-      evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
-    }:
-    symlinkJoin {
-      name = "nixpkgs-eval-baseline";
-      paths = map (
-        evalSystem:
-        singleSystem {
-          inherit evalSystem;
-        }
-      ) evalSystems;
-    };
-
-  full =
-    {
-      # Whether to evaluate on a specific set of systems, by default all are evaluated
-      evalSystems ? if quickTest then [ "x86_64-linux" ] else supportedSystems,
-      baseline,
-      # What files have been touched? Defaults to none; use the expression below to calculate it.
-      # ```
-      # git diff --name-only --merge-base master HEAD \
-      #   | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
-      # ```
-      touchedFilesJson ? builtins.toFile "touched-files.json" "[ ]",
-    }:
-    let
-      diffs = symlinkJoin {
-        name = "nixpkgs-eval-diffs";
-        paths = map (
-          evalSystem:
-          diff {
-            inherit evalSystem;
-            beforeDir = baseline;
-            afterDir = singleSystem {
-              inherit evalSystem;
-            };
-          }
-        ) evalSystems;
-      };
-      comparisonReport = compare {
-        combinedDir = combine { diffDir = diffs; };
-        inherit touchedFilesJson;
-      };
-    in
-    comparisonReport;
-
-in
-{
-  inherit
-    attrpathsSuperset
-    singleSystem
-    diff
-    combine
-    compare
-    # The above three are used by separate VMs in a GitHub workflow,
-    # while the below are intended for testing on a single local machine
-    baseline
-    full
-    ;
-}

ci/eval/diff.nix

@@ -1,111 +0,0 @@
-{
-  lib,
-  runCommand,
-  writeText,
-}:
-
-{
-  beforeDir,
-  afterDir,
-  evalSystem,
-}:
-
-let
-  # Usually we expect a derivation, but when evaluating in multiple separate steps, we pass
-  # nix store paths around. These need to be turned into (fake) derivations again to track
-  # dependencies properly.
-  # We use two steps for evaluation, because we compare results from two different checkouts.
-  # CI additionalls spreads evaluation across multiple workers.
-  before = if lib.isDerivation beforeDir then beforeDir else lib.toDerivation beforeDir;
-  after = if lib.isDerivation afterDir then afterDir else lib.toDerivation afterDir;
-
-  /*
-    Computes the key difference between two attrs
-
-    {
-      added: [ <keys only in the second object> ],
-      removed: [ <keys only in the first object> ],
-      changed: [ <keys with different values between the two objects> ],
-      rebuilds: [ <keys in the second object with values not present at all in first object> ],
-    }
-  */
-  diff =
-    old: new:
-    let
-      filterKeys = cond: attrs: lib.attrNames (lib.filterAttrs cond attrs);
-      oldOutputs = lib.pipe old [
-        (lib.mapAttrsToList (_: lib.attrValues))
-        lib.concatLists
-        (lib.flip lib.genAttrs (_: true))
-      ];
-    in
-    {
-      added = filterKeys (n: _: !(old ? ${n})) new;
-      removed = filterKeys (n: _: !(new ? ${n})) old;
-      changed = filterKeys (
-        n: v:
-        # Filter out attributes that don't exist anymore
-        (new ? ${n})
-
-        # Filter out attributes that are the same as the new value
-        && (v != (new.${n}))
-      ) old;
-      # A "rebuild" is every attrpath ...
-      rebuilds = filterKeys (
-        _: pkg:
-        # ... that has at least one output ...
-        lib.any (
-          output:
-          # ... which has not been built in "old" already.
-          !(oldOutputs ? ${output})
-        ) (lib.attrValues pkg)
-      ) new;
-    };
-
-  getAttrs =
-    dir:
-    let
-      raw = builtins.readFile "${dir}/${evalSystem}/paths.json";
-      # The file contains Nix paths; we need to ignore them for evaluation purposes,
-      # else there will be a "is not allowed to refer to a store path" error.
-      data = builtins.unsafeDiscardStringContext raw;
-    in
-    builtins.fromJSON data;
-
-  beforeAttrs = getAttrs before;
-  afterAttrs = getAttrs after;
-  diffAttrs = diff beforeAttrs afterAttrs;
-  diffJson = writeText "diff.json" (builtins.toJSON diffAttrs);
-
-  # The maintainer list is not diffed, but just taken as is, to provide a map
-  # of maintainers on the target branch. A list of GitHub IDs is sufficient for
-  # all our purposes and reduces size massively.
-  meta = lib.importJSON "${after}/${evalSystem}/meta.json";
-  maintainers = lib.pipe meta [
-    (lib.mapAttrsToList (
-      k: v: {
-        # splits off the platform suffix
-        package = lib.pipe k [
-          (lib.splitString ".")
-          lib.init
-          (lib.concatStringsSep ".")
-        ];
-        maintainers = map (m: m.githubId) v.maintainers or [ ];
-      }
-    ))
-    # Some paths don't have a platform suffix, those will appear with an empty package here.
-    (lib.filter ({ package, maintainers }: package != "" && maintainers != [ ]))
-  ];
-  maintainersJson = writeText "maintainers.json" (builtins.toJSON maintainers);
-in
-runCommand "diff" { } ''
-  mkdir -p $out/${evalSystem}
-
-  cp -r --no-preserve=mode ${before} $out/before
-  cp -r --no-preserve=mode ${after} $out/after
-  # JSON files will be processed above explicitly, so avoid copying over
-  # the source files to keep the artifacts smaller.
-  find $out/before $out/after -iname '*.json' -delete
-  cp ${diffJson} $out/${evalSystem}/diff.json
-  cp ${maintainersJson} $out/${evalSystem}/maintainers.json
-''

ci/eval/outpaths.nix

@@ -1,115 +0,0 @@
-#!/usr/bin/env nix-shell
-# When using as a callable script, passing `--argstr path some/path` overrides $PWD.
-#!nix-shell -p nix -i "nix-env -qaP --no-name --out-path -f ci/eval/outpaths.nix"
-
-{
-  includeBroken ? true, # set this to false to exclude meta.broken packages from the output
-  path ? ./../..,
-
-  # used by ./attrpaths.nix
-  attrNamesOnly ? false,
-
-  # Set this to `null` to build for builtins.currentSystem only
-  systems ? builtins.fromJSON (
-    builtins.readFile (path + "/pkgs/top-level/release-supported-systems.json")
-  ),
-
-  # Customize the config used to evaluate nixpkgs
-  extraNixpkgsConfig ? { },
-}:
-let
-  lib = import (path + "/lib");
-
-  nixpkgsJobs =
-    import (path + "/pkgs/top-level/release.nix")
-      # Compromise: accuracy vs. resources needed for evaluation.
-      {
-        inherit attrNamesOnly;
-        supportedSystems = if systems == null then [ builtins.currentSystem ] else systems;
-        nixpkgsArgs = {
-          config = {
-            allowAliases = false;
-            allowBroken = includeBroken;
-            allowUnfree = true;
-            allowInsecurePredicate = x: true;
-            allowVariants = !attrNamesOnly;
-            checkMeta = true;
-
-            # Silence the `x86_64-darwin` deprecation warning.
-            allowDeprecatedx86_64Darwin = true;
-
-            handleEvalIssue =
-              reason: errormsg:
-              let
-                fatalErrors = [
-                  "unknown-meta"
-                  "broken-outputs"
-                ];
-              in
-              if builtins.elem reason fatalErrors then
-                abort errormsg
-              # hydra does not build unfree packages, so tons of them are broken yet not marked meta.broken.
-              else if
-                !includeBroken
-                && builtins.elem reason [
-                  "broken"
-                  "unfree"
-                ]
-              then
-                throw "broken"
-              else if builtins.elem reason [ "unsupported" ] then
-                throw "unsupported"
-              else
-                true;
-
-            inHydra = true;
-          }
-          // extraNixpkgsConfig;
-
-          __allowFileset = false;
-        };
-      };
-
-  nixosJobs = import (path + "/nixos/release.nix") {
-    inherit attrNamesOnly;
-    supportedSystems = lib.filter (lib.hasSuffix "-linux") (
-      if systems == null then [ builtins.currentSystem ] else systems
-    );
-  };
-
-  recurseIntoAttrs = attrs: attrs // { recurseForDerivations = true; };
-
-  # release-lib leaves recurseForDerivations as empty attrmaps;
-  # that would break nix-env and we also need to recurse everywhere.
-  tweak = lib.mapAttrs (
-    name: val:
-    if name == "recurseForDerivations" then
-      true
-    else if lib.isAttrs val && val.type or null != "derivation" then
-      recurseIntoAttrs (tweak val)
-    else
-      val
-  );
-
-  # Some of these contain explicit references to platform(s) we want to avoid;
-  # some even (transitively) depend on ~/.nixpkgs/config.nix (!)
-  blacklist = [
-    "tarball"
-    "metrics"
-    "manual"
-    "darwin-tested"
-    "unstable"
-    "stdenvBootstrapTools"
-    "moduleSystem"
-    "lib-tests" # these just confuse the output
-  ];
-
-in
-tweak (
-  (removeAttrs nixpkgsJobs blacklist)
-  // {
-    nixosTests = lib.filterAttrs (
-      name: _: name == "simple-container" || name == "simple-vm"
-    ) nixosJobs.tests;
-  }
-)

ci/github-script/.editorconfig

@@ -1,3 +0,0 @@
-[run]
-indent_style = space
-indent_size = 2

ci/github-script/.gitignore

@@ -1,2 +0,0 @@
-node_modules
-step-summary.md

ci/github-script/.npmrc

@@ -1,2 +0,0 @@
-package-lock-only = true
-save-exact = true

ci/github-script/README.md

@@ -1,17 +0,0 @@
-# GitHub specific CI scripts
-
-This folder contains [`actions/github-script`](https://github.com/actions/github-script)-based JavaScript code.
-It provides a `nix-shell` environment to run and test these actions locally.
-
-To run any of the scripts locally:
-
-- Enter `nix-shell` in `./ci/github-script`.
-- Ensure `gh` is authenticated.
-
-## Check commits
-
-Run `./run commits OWNER REPO PR`, where OWNER is your username or "NixOS", REPO is the name of your fork or "nixpkgs" and PR is the number of the pull request to check.
-
-## Labeler
-
-Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".

ci/github-script/bot.js

@@ -1,825 +0,0 @@
-module.exports = async ({ github, context, core, dry }) => {
-  const path = require('node:path')
-  const { DefaultArtifactClient } = await import('@actions/artifact')
-  const { readFile, writeFile } = require('node:fs/promises')
-  const withRateLimit = require('./withRateLimit.js')
-  const { classify } = require('../supportedBranches.js')
-  const { handleMerge } = require('./merge.js')
-  const { handleReviewers } = require('./reviewers.js')
-
-  const artifactClient = new DefaultArtifactClient()
-
-  // Detect if running in a fork (not NixOS/nixpkgs)
-  const isFork = context.repo.owner !== 'NixOS'
-
-  const orgId = (
-    await github.rest.orgs.get({
-      org: context.repo.owner,
-    })
-  ).data.id
-
-  async function downloadMaintainerMap(branch) {
-    let run
-
-    const commits = (
-      await github.rest.repos.listCommits({
-        ...context.repo,
-        sha: branch,
-        // We look at 10 commits to find a maintainer map, but this is an arbitrary number. The
-        // head commit might not have a map, if the queue was bypassed to merge it. This happens
-        // frequently on staging-esque branches. The branch with the highest chance of getting
-        // 10 consecutive bypassing commits is the stable staging-next branch. Luckily, this
-        // also means that the number of PRs open towards that branch is very low, so falling
-        // back to slightly imprecise maintainer data from master only has a marginal effect.
-        per_page: 10,
-      })
-    ).data
-
-    for (const commit of commits) {
-      const run = (
-        await github.rest.actions.listWorkflowRuns({
-          ...context.repo,
-          workflow_id: 'merge-group.yml',
-          status: 'success',
-          exclude_pull_requests: true,
-          per_page: 1,
-          head_sha: commit.sha,
-        })
-      ).data.workflow_runs[0]
-      if (!run) continue
-
-      const artifact = (
-        await github.rest.actions.listWorkflowRunArtifacts({
-          ...context.repo,
-          run_id: run.id,
-          name: 'maintainers',
-        })
-      ).data.artifacts[0]
-      if (!artifact || artifact.expired) continue
-
-      await artifactClient.downloadArtifact(artifact.id, {
-        findBy: {
-          repositoryName: context.repo.repo,
-          repositoryOwner: context.repo.owner,
-          token: core.getInput('github-token'),
-        },
-        path: path.resolve(path.join('branches', branch)),
-        expectedHash: artifact.digest,
-      })
-
-      return JSON.parse(
-        await readFile(
-          path.resolve(path.join('branches', branch, 'maintainers.json')),
-          'utf-8',
-        ),
-      )
-    }
-
-    // We get here when none of the 10 commits we looked at contained a maintainer map.
-    // For the master branch, we don't have any fallback options, so we error out.
-    // In forks without merge-group history, return empty map to allow testing.
-    if (branch === 'master') {
-      if (isFork) {
-        core.warning(
-          'No maintainer map found. Using empty map (expected in forks without merge-group history).',
-        )
-        return {}
-      }
-      throw new Error('No maintainer map found.')
-    }
-
-    // For other branches, we select a suitable fallback below.
-    const { stable, version } = classify(branch)
-
-    const release = `release-${version}`
-    if (stable && branch !== release) {
-      // Only fallback to the release branch from *other* stable branches.
-      // Explicitly avoids infinite recursion.
-      return await getMaintainerMap(release)
-    } else {
-      // Falling back to master as last resort.
-      // This can either be the case for unstable staging-esque or wip branches,
-      // or for the primary stable branch (release-XX.YY).
-      return await getMaintainerMap('master')
-    }
-  }
-
-  // Simple cache for maintainer maps to avoid downloading the same artifacts
-  // over and over again. Ultimately returns a promise, so the result must be
-  // awaited for.
-  const maintainerMaps = {}
-  function getMaintainerMap(branch) {
-    if (!maintainerMaps[branch]) {
-      maintainerMaps[branch] = downloadMaintainerMap(branch)
-    }
-    return maintainerMaps[branch]
-  }
-
-  // Caching the list of team members saves API requests when running the bot on the schedule and
-  // processing many PRs at once.
-  const members = {}
-  function getTeamMembers(team_slug) {
-    if (context.eventName === 'pull_request') {
-      // We have no chance of getting a token in the pull_request context with the right
-      // permissions to access the members endpoint below. Thus, we're pretending to have
-      // no members. This is OK; because this is only for the Test workflow, not for
-      // real use.
-      return []
-    }
-
-    // Forks don't have NixOS teams, return empty list
-    if (isFork) {
-      return []
-    }
-
-    if (!members[team_slug]) {
-      members[team_slug] = github.paginate(github.rest.teams.listMembersInOrg, {
-        org: context.repo.owner,
-        team_slug,
-        per_page: 100,
-      })
-    }
-
-    return members[team_slug]
-  }
-
-  // Caching users saves API requests when running the bot on the schedule and processing
-  // many PRs at once. It also helps to encapsulate the special logic we need, because
-  // actions/github doesn't support that endpoint fully, yet.
-  const users = {}
-  function getUser(id) {
-    if (!users[id]) {
-      users[id] = github
-        .request({
-          method: 'GET',
-          url: '/user/{id}',
-          id,
-        })
-        .then((resp) => resp.data)
-        .catch((e) => {
-          // User may have deleted their account
-          if (e.status === 404) return null
-          throw e
-        })
-    }
-
-    return users[id]
-  }
-
-  // Same for teams
-  const teams = {}
-  function getTeam(id) {
-    if (!teams[id]) {
-      teams[id] = github
-        .request({
-          method: 'GET',
-          url: '/organizations/{orgId}/team/{id}',
-          orgId,
-          id,
-        })
-        .then((resp) => resp.data)
-        .catch((e) => {
-          // Team may have been deleted
-          if (e.status === 404) return null
-          throw e
-        })
-    }
-
-    return teams[id]
-  }
-
-  async function handlePullRequest({ item, stats, events }) {
-    const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
-
-    const pull_number = item.number
-
-    // This API request is important for the merge-conflict label, because it triggers the
-    // creation of a new test merge commit. This is needed to actually determine the state of a PR.
-    const pull_request = (
-      await github.rest.pulls.get({
-        ...context.repo,
-        pull_number,
-      })
-    ).data
-
-    log('author', pull_request.user?.login)
-
-    const maintainers = await getMaintainerMap(pull_request.base.ref)
-
-    const merge_bot_eligible = await handleMerge({
-      github,
-      context,
-      core,
-      log,
-      dry,
-      pull_request,
-      events,
-      maintainers,
-      getTeamMembers,
-      getUser,
-    })
-
-    // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
-    const reviews = (
-      await github.graphql(
-        `query($owner: String!, $repo: String!, $pr: Int!) {
-        repository(owner: $owner, name: $repo) {
-          pullRequest(number: $pr) {
-            # Unlikely that there's ever more than 100 reviews, so let's not bother,
-            # but once https://github.com/actions/github-script/issues/309 is resolved,
-            # it would be easy to enable pagination.
-            reviews(first: 100) {
-              nodes {
-                state
-                user: author {
-                  # Only get users, no bots
-                  ... on User {
-                    login
-                    # Set the id field in the resulting JSON to GraphQL's databaseId
-                    # databaseId in GraphQL-land is the same as id in REST-land
-                    id: databaseId
-                  }
-                }
-                onBehalfOf(first: 100) {
-                  nodes {
-                    slug
-                  }
-                }
-              }
-            }
-          }
-        }
-      }`,
-        {
-          owner: context.repo.owner,
-          repo: context.repo.repo,
-          pr: pull_number,
-        },
-      )
-    ).repository.pullRequest.reviews.nodes.filter(
-      (r) =>
-        // The `... on User` makes it such that .login only exists for users,
-        // but we still need to filter the others out.
-        // Accounts could be deleted as well, so don't count them.
-        r.user?.login &&
-        // Also exclude author reviews, can't request their review in any case
-        r.user.id !== pull_request.user?.id,
-    )
-
-    const approvals = new Set(
-      reviews
-        .filter((review) => review.state === 'APPROVED')
-        .map((review) => review.user?.id),
-    )
-
-    // After creation of a Pull Request, `merge_commit_sha` will be null initially:
-    // The very first merge commit will only be calculated after a little while.
-    // To avoid labeling the PR as conflicted before that, we wait a few minutes.
-    // This is intentionally less than the time that Eval takes, so that the label job
-    // running after Eval can indeed label the PR as conflicted if that is the case.
-    const merge_commit_sha_valid =
-      Date.now() - new Date(pull_request.created_at) > 3 * 60 * 1000
-
-    const prLabels = {
-      // We intentionally don't use the mergeable or mergeable_state attributes.
-      // Those have an intermediate state while the test merge commit is created.
-      // This doesn't work well for us, because we might have just triggered another
-      // test merge commit creation by request the pull request via API at the start
-      // of this function.
-      // The attribute merge_commit_sha keeps the old value of null or the hash *until*
-      // the new test merge commit has either successfully been created or failed so.
-      // This essentially means we are updating the merge conflict label in two steps:
-      // On the first pass of the day, we just fetch the pull request, which triggers
-      // the creation. At this stage, the label is likely not updated, yet.
-      // The second pass will then read the result from the first pass and set the label.
-      '2.status: merge conflict':
-        merge_commit_sha_valid && !pull_request.merge_commit_sha,
-      '2.status: merge-bot eligible': merge_bot_eligible,
-      '12.approvals: 1': approvals.size === 1,
-      '12.approvals: 2': approvals.size === 2,
-      '12.approvals: 3+': approvals.size >= 3,
-      '12.first-time contribution': [
-        'NONE',
-        'FIRST_TIMER',
-        'FIRST_TIME_CONTRIBUTOR',
-      ].includes(pull_request.author_association),
-    }
-
-    const { id: run_id, conclusion } =
-      (
-        await github.rest.actions.listWorkflowRuns({
-          ...context.repo,
-          workflow_id: 'pull-request-target.yml',
-          event: 'pull_request_target',
-          exclude_pull_requests: true,
-          head_sha: pull_request.head.sha,
-        })
-      ).data.workflow_runs[0] ??
-      // TODO: Remove this after 2026-02-01, at which point all pr.yml artifacts will have expired.
-      (
-        await github.rest.actions.listWorkflowRuns({
-          ...context.repo,
-          // In older PRs, we need pr.yml instead of pull-request-target.yml.
-          workflow_id: 'pr.yml',
-          event: 'pull_request_target',
-          exclude_pull_requests: true,
-          head_sha: pull_request.head.sha,
-        })
-      ).data.workflow_runs[0] ??
-      {}
-
-    // Newer PRs might not have run Eval to completion, yet.
-    // Older PRs might not have an eval.yml workflow, yet.
-    // In either case we continue without fetching an artifact on a best-effort basis.
-    log('Last eval run', run_id ?? '<n/a>')
-
-    if (conclusion === 'success') {
-      Object.assign(prLabels, {
-        // We only set this label if the latest eval run was successful, because if it was not, it
-        // *could* have requested reviewers. We will let the PR author fix CI first, before "escalating"
-        // this PR to "needs: reviewer".
-        // Since the first Eval run on a PR always sets rebuild labels, the same PR will be "recently
-        // updated" for the next scheduled run. Thus, this label will still be set within a few minutes
-        // after a PR is created, if required.
-        // Note that a "requested reviewer" disappears once they have given a review, so we check
-        // existing reviews, too.
-        '9.needs: reviewer':
-          !pull_request.draft &&
-          pull_request.requested_reviewers.length === 0 &&
-          reviews.length === 0,
-      })
-    }
-
-    const artifact =
-      run_id &&
-      (
-        await github.rest.actions.listWorkflowRunArtifacts({
-          ...context.repo,
-          run_id,
-          name: 'comparison',
-        })
-      ).data.artifacts[0]
-
-    // Instead of checking the boolean artifact.expired, we will give us a minute to
-    // actually download the artifact in the next step and avoid that race condition.
-    // Older PRs, where the workflow run was already eval.yml, but the artifact was not
-    // called "comparison", yet, will skip the download.
-    const expired =
-      !artifact ||
-      new Date(artifact?.expires_at ?? 0) < new Date(Date.now() + 60 * 1000)
-    log('Artifact expires at', artifact?.expires_at ?? '<n/a>')
-    if (!expired) {
-      stats.artifacts++
-
-      await artifactClient.downloadArtifact(artifact.id, {
-        findBy: {
-          repositoryName: context.repo.repo,
-          repositoryOwner: context.repo.owner,
-          token: core.getInput('github-token'),
-        },
-        path: path.resolve(pull_number.toString()),
-        expectedHash: artifact.digest,
-      })
-
-      const changedPaths = JSON.parse(
-        await readFile(`${pull_number}/changed-paths.json`, 'utf-8'),
-      )
-      const evalLabels = changedPaths.labels
-
-      // Fetch all PR commits to check their messages for package patterns
-      const prCommits = await github.paginate(github.rest.pulls.listCommits, {
-        ...context.repo,
-        pull_number,
-        per_page: 100,
-      })
-      const commitSubjects = prCommits.map(
-        (c) => c.commit.message.split('\n')[0],
-      )
-
-      // Label new package PRs: "packagename: init at X.Y.Z"
-      // Exclude NixOS module commits like "nixos/timekpr: init at 0.5.8"
-      const newPackagePattern = /^(?<!nixos\/)\S+: init at\b/
-      const hasNewPackages = changedPaths.attrdiff?.added?.length > 0
-      const commitsIndicateNewPackage = commitSubjects.some((msg) =>
-        newPackagePattern.test(msg),
-      )
-      evalLabels['8.has: package (new)'] =
-        hasNewPackages && commitsIndicateNewPackage
-
-      // Label package update PRs: "packagename: X.Y.Z -> A.B.C"
-      // Matches versions like: 1.2.3, 0-unstable-2024-01-15, 1.3rc1, alpha, unstable
-      // Exclude NixOS module commits like "nixos/ncps: types.str -> types.path"
-      const updatePackagePattern =
-        /^(?<!nixos\/)\S+: [\w.-]*\d[\w.-]* (->|→) [\w.-]*\d[\w.-]*$/
-      const commitsIndicateUpdate = commitSubjects.some((msg) =>
-        updatePackagePattern.test(msg),
-      )
-      evalLabels['8.has: package (update)'] = commitsIndicateUpdate
-
-      // TODO: Get "changed packages" information from list of changed by-name files
-      // in addition to just the Eval results, to make this work for these packages
-      // when Eval results have expired as well.
-      let packages
-      try {
-        packages = JSON.parse(
-          await readFile(`${pull_number}/packages.json`, 'utf-8'),
-        )
-      } catch (e) {
-        if (e.code !== 'ENOENT') throw e
-        // TODO: Remove this fallback code once all old artifacts without packages.json
-        // have expired. This should be the case in ~ February 2026.
-        packages = Array.from(
-          new Set(
-            Object.values(
-              JSON.parse(
-                await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
-              ),
-            ).flat(1),
-          ),
-        )
-      }
-
-      Object.assign(prLabels, evalLabels, {
-        '11.by: package-maintainer':
-          Boolean(packages.length) &&
-          packages.every((pkg) =>
-            maintainers[pkg]?.includes(pull_request.user.id),
-          ),
-        '12.approved-by: package-maintainer': packages.some((pkg) =>
-          maintainers[pkg]?.some((m) => approvals.has(m)),
-        ),
-      })
-
-      if (!pull_request.draft) {
-        let owners = []
-        try {
-          // TODO: Create owner map similar to maintainer map.
-          owners = (await readFile(`${pull_number}/owners.txt`, 'utf-8')).split(
-            '\n',
-          )
-        } catch (e) {
-          // Older artifacts don't have the owners.txt, yet.
-          if (e.code !== 'ENOENT') throw e
-        }
-
-        let team_maintainers = []
-        try {
-          team_maintainers = Object.keys(
-            JSON.parse(await readFile(`${pull_number}/teams.json`, 'utf-8')),
-          ).map((id) => parseInt(id))
-        } catch (e) {
-          // Older artifacts don't have the teams.json, yet.
-          if (e.code !== 'ENOENT') throw e
-        }
-
-        // We set this label earlier already, but the current PR state can be very different
-        // after handleReviewers has requested reviews, so update it in this case to prevent
-        // this label from flip-flopping.
-        prLabels['9.needs: reviewer'] = await handleReviewers({
-          github,
-          context,
-          core,
-          log,
-          dry,
-          pull_request,
-          reviews,
-          // TODO: Use maintainer map instead of the artifact.
-          user_maintainers: Object.keys(
-            JSON.parse(
-              await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
-            ),
-          ).map((id) => parseInt(id)),
-          team_maintainers,
-          owners,
-          getUser,
-          getTeam,
-        })
-      }
-    }
-
-    return prLabels
-  }
-
-  // Returns true if the issue was closed. In this case, the labeling does not need to
-  // continue for this issue. Returns false if no action was taken.
-  async function handleAutoClose(item) {
-    const issue_number = item.number
-
-    if (item.labels.some(({ name }) => name === '0.kind: packaging request')) {
-      const body = [
-        'Thank you for your interest in packaging new software in Nixpkgs. Unfortunately, to mitigate the unsustainable growth of unmaintained packages, **Nixpkgs is no longer accepting package requests** via Issues.',
-        '',
-        'As a [volunteer community][community], we are always open to new contributors. If you wish to see this package in Nixpkgs, **we encourage you to [contribute] it yourself**, via a Pull Request. Anyone can [become a package maintainer][maintainers]! You can find language-specific packaging information in the [Nixpkgs Manual][nixpkgs]. Should you need any help, please reach out to the community on [Matrix] or [Discourse].',
-        '',
-        '[community]: https://nixos.org/community',
-        '[contribute]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#quick-start-to-adding-a-package',
-        '[maintainers]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md',
-        '[nixpkgs]: https://nixos.org/manual/nixpkgs/unstable/',
-        '[Matrix]: https://matrix.to/#/#dev:nixos.org',
-        '[Discourse]: https://discourse.nixos.org/c/dev/14',
-      ].join('\n')
-
-      core.info(`Issue #${item.number}: auto-closed`)
-
-      if (!dry) {
-        await github.rest.issues.createComment({
-          ...context.repo,
-          issue_number,
-          body,
-        })
-
-        await github.rest.issues.update({
-          ...context.repo,
-          issue_number,
-          state: 'closed',
-          state_reason: 'not_planned',
-        })
-      }
-
-      return true
-    }
-    return false
-  }
-
-  async function handle({ item, stats }) {
-    try {
-      const log = (k, v, skip) => {
-        core.info(`#${item.number} - ${k}: ${v}${skip ? ' (skipped)' : ''}`)
-        return skip
-      }
-
-      log('Last updated at', item.updated_at)
-      log('URL', item.html_url)
-
-      const issue_number = item.number
-
-      const itemLabels = {}
-
-      const events = await github.paginate(
-        github.rest.issues.listEventsForTimeline,
-        {
-          ...context.repo,
-          issue_number,
-          per_page: 100,
-        },
-      )
-
-      const latest_event_at = new Date(
-        events
-          .filter(({ event }) =>
-            [
-              // These events are hand-picked from:
-              //   https://docs.github.com/en/rest/using-the-rest-api/issue-event-types?apiVersion=2022-11-28
-              // Each of those causes a PR/issue to *not* be considered as stale anymore.
-              // Most of these use created_at.
-              'assigned',
-              'commented', // uses updated_at, because that could be > created_at
-              'committed', // uses committer.date
-              ...(item.labels.some(({ name }) => name === '5.scope: tracking')
-                ? ['cross-referenced']
-                : []),
-              'head_ref_force_pushed',
-              'milestoned',
-              'pinned',
-              'ready_for_review',
-              'renamed',
-              'reopened',
-              'review_dismissed',
-              'review_requested',
-              'reviewed', // uses submitted_at
-              'unlocked',
-              'unmarked_as_duplicate',
-            ].includes(event),
-          )
-          .map(
-            ({ created_at, updated_at, committer, submitted_at }) =>
-              new Date(
-                updated_at ?? created_at ?? submitted_at ?? committer.date,
-              ),
-          )
-          // Reverse sort by date value. The default sort() sorts by string representation, which is bad for dates.
-          .sort((a, b) => b - a)
-          .at(0) ?? item.created_at,
-      )
-      log('latest_event_at', latest_event_at.toISOString())
-
-      const stale_at = new Date(new Date().setDate(new Date().getDate() - 180))
-      const is_stale = latest_event_at < stale_at
-
-      if (item.pull_request || context.payload.pull_request) {
-        // No need to compute merge commits for stale PRs over and over again.
-        // This increases the repo size on GitHub's side unnecessarily and wastes
-        // a lot of API requests, too. Any relevant change will result in the
-        // stale status to change and thus pick up the PR again for labeling.
-        if (!is_stale) {
-          stats.prs++
-          Object.assign(
-            itemLabels,
-            await handlePullRequest({ item, stats, events }),
-          )
-        }
-      } else {
-        stats.issues++
-        if (item.labels.some(({ name }) => name === '4.workflow: auto-close')) {
-          // If this returns true, the issue was closed. In this case we return, to not
-          // label the issue anymore. Most importantly this avoids unlabeling stale issues
-          // which are closed via auto-close.
-          if (await handleAutoClose(item)) return
-        }
-      }
-
-      // Create a map (Label -> Boolean) of all currently set labels.
-      // Each label is set to True and can be disabled later.
-      const before = Object.fromEntries(
-        (
-          await github.paginate(github.rest.issues.listLabelsOnIssue, {
-            ...context.repo,
-            issue_number,
-          })
-        ).map(({ name }) => [name, true]),
-      )
-
-      Object.assign(itemLabels, {
-        '2.status: stale': !before['1.severity: security'] && is_stale,
-      })
-
-      const after = Object.assign({}, before, itemLabels)
-
-      // No need for an API request, if all labels are the same.
-      const hasChanges = Object.keys(after).some(
-        (name) => (before[name] ?? false) !== after[name],
-      )
-      if (log('Has label changes', hasChanges, !hasChanges)) return
-
-      // Skipping labeling on a pull_request event, because we have no privileges.
-      const labels = Object.entries(after)
-        .filter(([, value]) => value)
-        .map(([name]) => name)
-      if (log('Set labels', labels, dry)) return
-
-      await github.rest.issues.setLabels({
-        ...context.repo,
-        issue_number,
-        labels,
-      })
-    } catch (cause) {
-      throw new Error(`Labeling #${item.number} failed.`, { cause })
-    }
-  }
-
-  // Controls level of parallelism. Applies to both the number of concurrent requests
-  // as well as the number of concurrent workers going through the list of PRs.
-  // We'll only boost concurrency when we're running many PRs in parallel on a schedule,
-  // but not for single PRs. This avoids things going wild, when we accidentally make
-  // too many API requests on treewides.
-  const maxConcurrent = context.payload.pull_request ? 1 : 20
-
-  await withRateLimit({ github, core, maxConcurrent }, async (stats) => {
-    if (context.payload.pull_request) {
-      await handle({ item: context.payload.pull_request, stats })
-    } else {
-      const lastRun = (
-        await github.rest.actions.listWorkflowRuns({
-          ...context.repo,
-          workflow_id: 'bot.yml',
-          event: 'schedule',
-          status: 'success',
-          exclude_pull_requests: true,
-          per_page: 1,
-        })
-      ).data.workflow_runs[0]
-
-      const cutoff = new Date(
-        Math.max(
-          // Go back as far as the last successful run of this workflow to make sure
-          // we are not leaving anyone behind on GHA failures.
-          // Defaults to go back 1 hour on the first run.
-          new Date(
-            lastRun?.created_at ?? Date.now() - 1 * 60 * 60 * 1000,
-          ).getTime(),
-          // Go back max. 1 day to prevent hitting all API rate limits immediately,
-          // when GH API returns a wrong workflow by accident.
-          Date.now() - 24 * 60 * 60 * 1000,
-        ),
-      )
-      core.info(`cutoff timestamp: ${cutoff.toISOString()}`)
-
-      const updatedItems = await github.paginate(
-        github.rest.search.issuesAndPullRequests,
-        {
-          q: [
-            `repo:"${context.repo.owner}/${context.repo.repo}"`,
-            'is:open',
-            `updated:>=${cutoff.toISOString()}`,
-          ].join(' AND '),
-          per_page: 100,
-          // TODO: Remove after 2025-11-04, when it becomes the default.
-          advanced_search: true,
-        },
-      )
-
-      let cursor
-
-      // No workflow run available the first time.
-      if (lastRun) {
-        // The cursor to iterate through the full list of issues and pull requests
-        // is passed between jobs as an artifact.
-        const artifact = (
-          await github.rest.actions.listWorkflowRunArtifacts({
-            ...context.repo,
-            run_id: lastRun.id,
-            name: 'pagination-cursor',
-          })
-        ).data.artifacts[0]
-
-        // If the artifact is not available, the next iteration starts at the beginning.
-        if (artifact && !artifact.expired) {
-          stats.artifacts++
-
-          const { downloadPath } = await artifactClient.downloadArtifact(
-            artifact.id,
-            {
-              findBy: {
-                repositoryName: context.repo.repo,
-                repositoryOwner: context.repo.owner,
-                token: core.getInput('github-token'),
-              },
-              expectedHash: artifact.digest,
-            },
-          )
-
-          cursor = await readFile(path.resolve(downloadPath, 'cursor'), 'utf-8')
-        }
-      }
-
-      // From GitHub's API docs:
-      //   GitHub's REST API considers every pull request an issue, but not every issue is a pull request.
-      //   For this reason, "Issues" endpoints may return both issues and pull requests in the response.
-      //   You can identify pull requests by the pull_request key.
-      const allItems = await github.rest.issues.listForRepo({
-        ...context.repo,
-        state: 'open',
-        sort: 'created',
-        direction: 'asc',
-        per_page: 100,
-        after: cursor,
-      })
-
-      // Regex taken and comment adjusted from:
-      // https://github.com/octokit/plugin-paginate-rest.js/blob/8e5da25f975d2f31dda6b8b588d71f2c768a8df2/src/iterator.ts#L36-L41
-      // `allItems.headers.link` format:
-      //   <https://api.github.com/repositories/4542716/issues?page=3&per_page=100&after=Y3Vyc29yOnYyOpLPAAABl8qNnYDOvnSJxA%3D%3D>; rel="next",
-      //   <https://api.github.com/repositories/4542716/issues?page=1&per_page=100&before=Y3Vyc29yOnYyOpLPAAABl8xFV9DOvoouJg%3D%3D>; rel="prev"
-      // Sets `next` to undefined if "next" URL is not present or `link` header is not set.
-      const next = ((allItems.headers.link ?? '').match(
-        /<([^<>]+)>;\s*rel="next"/,
-      ) ?? [])[1]
-      if (next) {
-        cursor = new URL(next).searchParams.get('after')
-        const uploadPath = path.resolve('cursor')
-        await writeFile(uploadPath, cursor, 'utf-8')
-        if (dry) {
-          core.info(`pagination-cursor: ${cursor} (upload skipped)`)
-        } else {
-          // No stats.artifacts++, because this does not allow passing a custom token.
-          // Thus, the upload will not happen with the app token, but the default github.token.
-          await artifactClient.uploadArtifact(
-            'pagination-cursor',
-            [uploadPath],
-            path.resolve('.'),
-            {
-              retentionDays: 1,
-            },
-          )
-        }
-      }
-
-      // Some items might be in both search results, so filtering out duplicates as well.
-      const items = []
-        .concat(updatedItems, allItems.data)
-        .filter(
-          (thisItem, idx, arr) =>
-            idx ===
-            arr.findIndex((firstItem) => firstItem.number === thisItem.number),
-        )
-
-      // Instead of handling all items in parallel we set up some workers to handle the queue
-      // with more controlled parallelism. This avoids problems with `pull_request` fetched at
-      // the beginning getting out of date towards the end, because it took the whole job 20
-      // minutes or more to go through 100's of PRs.
-      await Promise.all(
-        Array.from({ length: maxConcurrent }, async () => {
-          while (true) {
-            const item = items.pop()
-            if (!item) break
-            try {
-              await handle({ item, stats })
-            } catch (e) {
-              core.setFailed(`${e.message}\n${e.cause.stack}`)
-            }
-          }
-        }),
-      )
-    }
-  })
-}

ci/github-script/check-target-branch.js

@@ -1,221 +0,0 @@
-/// @ts-check
-
-// TODO: should this be combined with the branch checks in prepare.js?
-// They do seem quite similar, but this needs to run after eval,
-// and prepare.js obviously doesn't.
-
-const { classify, split } = require('../supportedBranches.js')
-const { readFile } = require('node:fs/promises')
-const { postReview, dismissReviews } = require('./reviews.js')
-
-const reviewKey = 'check-target-branch'
-/**
- * @param {{
- *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
- *  context: import('@actions/github/lib/context').Context
- *  core: import('@actions/core')
- *  dry: boolean
- * }} CheckTargetBranchProps
- */
-async function checkTargetBranch({ github, context, core, dry }) {
-  /**
-   * @type {{
-   *  attrdiff: {
-   *   added: string[],
-   *   changed: string[],
-   *   removed: string[],
-   *  },
-   *  attrdiffByKernel: Record<string, {
-   *   added: string[],
-   *   changed: string[],
-   *   removed: string[],
-   *  }>,
-   *  attrdiffByPlatform: Record<string, {
-   *   added: string[],
-   *   changed: string[],
-   *   removed: string[],
-   *  }>,
-   *  labels: Record<string, boolean>,
-   *  rebuildCountByKernel: Record<string, number>,
-   *  rebuildsByKernel: Record<string, string[]>,
-   *  rebuildsByPlatform: Record<string, string[]>,
-   * }}
-   */
-  const changed = JSON.parse(
-    await readFile('comparison/changed-paths.json', 'utf-8'),
-  )
-  const pull_number = context.payload.pull_request?.number
-  if (!pull_number) {
-    core.warning(
-      'Skipping checkTargetBranch: no pull_request number (is this being run as part of a merge group?)',
-    )
-    return
-  }
-  const prInfo = (
-    await github.rest.pulls.get({
-      ...context.repo,
-      pull_number,
-    })
-  ).data
-  const base = prInfo.base.ref
-  const head = prInfo.head.ref
-  const baseClassification = classify(base)
-  const headClassification = classify(head)
-
-  // Don't run on, e.g., staging-nixos to master merges.
-  if (headClassification.type.includes('development')) {
-    core.info(
-      `Skipping checkTargetBranch: PR is from a development branch (${head})`,
-    )
-
-    await dismissReviews({
-      github,
-      context,
-      core,
-      dry,
-      reviewKey,
-    })
-
-    return
-  }
-  // Don't run on PRs against staging branches, wip branches, haskell-updates, etc.
-  if (!baseClassification.type.includes('primary')) {
-    core.info(
-      `Skipping checkTargetBranch: PR is against a non-primary base branch (${base})`,
-    )
-
-    await dismissReviews({
-      github,
-      context,
-      core,
-      dry,
-      reviewKey,
-    })
-
-    return
-  }
-
-  const maxRebuildCount = Math.max(
-    ...Object.values(changed.rebuildCountByKernel),
-  )
-  const rebuildsAllTests =
-    changed.attrdiff.changed.includes('nixosTests.simple-container') ||
-    changed.attrdiff.changed.includes('nixosTests.simple-vm')
-
-  // https://github.com/NixOS/nixpkgs/pull/521157
-  // These should go to master and release-xx.xx when backported
-  let isExemptKernelUpdate = false
-  if (prInfo.changed_files === 1) {
-    const changedFiles = (
-      await github.rest.pulls.listFiles({
-        ...context.repo,
-        pull_number,
-      })
-    ).data
-    isExemptKernelUpdate =
-      changedFiles.length === 1 &&
-      changedFiles[0].filename ===
-        'pkgs/os-specific/linux/kernel/xanmod-kernels.nix'
-  }
-
-  // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
-  const isExemptHomeAssistantUpdate =
-    maxRebuildCount <= 1500 && head === 'wip-home-assistant'
-
-  core.info(
-    [
-      `checkTargetBranch: this PR:`,
-      `  * causes ${maxRebuildCount} rebuilds`,
-      `  * ${rebuildsAllTests ? 'rebuilds' : 'does not rebuild'} all NixOS tests`,
-      `  * ${isExemptKernelUpdate ? 'is' : 'is not'} an exempt kernel update`,
-      `  * ${isExemptHomeAssistantUpdate ? 'is' : 'is not'} an exempt home-assistant update`,
-    ].join('\n'),
-  )
-
-  if (
-    maxRebuildCount >= 1000 &&
-    !isExemptHomeAssistantUpdate &&
-    !isExemptKernelUpdate
-  ) {
-    const desiredBranch =
-      base === 'master' ? 'staging' : `staging-${split(base).version}`
-    const body = [
-      `The PR's base branch is set to \`${base}\`, but this PR causes ${maxRebuildCount} rebuilds.`,
-      'It is therefore considered a mass rebuild.',
-      `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${desiredBranch}\`).`,
-    ].join('\n')
-
-    await postReview({
-      github,
-      context,
-      core,
-      dry,
-      body,
-      event: 'REQUEST_CHANGES',
-      reviewKey,
-    })
-  } else if (rebuildsAllTests && !isExemptKernelUpdate) {
-    let branchText
-    if (base === 'master' && maxRebuildCount >= 500) {
-      branchText = '(probably either `staging-nixos` or `staging`)'
-    } else if (base === 'master') {
-      branchText = '(probably `staging-nixos`)'
-    } else if (maxRebuildCount >= 500) {
-      branchText = `(probably either \`staging-nixos-${split(base).version}\` or \`staging-${split(base).version}\`)`
-    } else {
-      branchText = `(probably \`staging-nixos-${split(base).version}\`)`
-    }
-    const body = [
-      `The PR's base branch is set to \`${base}\`, but this PR rebuilds all NixOS tests.`,
-      base === 'master' && maxRebuildCount >= 500
-        ? `Since this PR also causes ${maxRebuildCount} rebuilds, it may also be considered a mass rebuild.`
-        : '',
-      `Please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) ${branchText}.`,
-    ].join('\n')
-
-    await postReview({
-      github,
-      context,
-      core,
-      dry,
-      body,
-      event: 'REQUEST_CHANGES',
-      reviewKey,
-    })
-  } else if (
-    maxRebuildCount >= 500 &&
-    !isExemptKernelUpdate &&
-    !isExemptHomeAssistantUpdate
-  ) {
-    const stagingBranch =
-      base === 'master' ? 'staging' : `staging-${split(base).version}`
-    const body = [
-      `The PR's base branch is set to \`${base}\`, and this PR causes ${maxRebuildCount} rebuilds.`,
-      `Please consider whether this PR causes a mass rebuild according to [our conventions](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions).`,
-      `If it does cause a mass rebuild, please [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request) to [the right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions) (probably \`${stagingBranch}\`).`,
-      `If it does not cause a mass rebuild, this message can be ignored.`,
-    ].join('\n')
-
-    await postReview({
-      github,
-      context,
-      core,
-      dry,
-      body,
-      event: 'REQUEST_CHANGES',
-      reviewKey,
-    })
-  } else {
-    core.info('checkTargetBranch: this PR is against an appropriate branch.')
-
-    await dismissReviews({
-      github,
-      context,
-      core,
-      dry,
-      reviewKey,
-    })
-  }
-}
-
-module.exports = checkTargetBranch

ci/github-script/commits.js

@@ -1,322 +0,0 @@
-module.exports = async ({ github, context, core, dry, cherryPicks }) => {
-  const { execFileSync } = require('node:child_process')
-  const { classify } = require('../supportedBranches.js')
-  const withRateLimit = require('./withRateLimit.js')
-  const { dismissReviews, postReview } = require('./reviews.js')
-  const reviewKey = 'check-commits'
-
-  await withRateLimit({ github, core }, async (stats) => {
-    stats.prs = 1
-
-    const pull_number = context.payload.pull_request.number
-
-    const job_url =
-      context.runId &&
-      (
-        await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
-          ...context.repo,
-          run_id: context.runId,
-          per_page: 100,
-        })
-      ).find(({ name }) => name.endsWith('Check / commits')).html_url +
-        '?pr=' +
-        pull_number
-
-    async function extract({ sha, commit }) {
-      const noCherryPick = Array.from(
-        commit.message.matchAll(/^Not-cherry-picked-because: (.*)$/gm),
-      ).at(0)
-
-      if (noCherryPick)
-        return {
-          sha,
-          commit,
-          severity: 'important',
-          message: `${sha} is not a cherry-pick, because: ${noCherryPick[1]}. Please review this commit manually.`,
-          type: 'no-cherry-pick',
-        }
-
-      // Using the last line with "cherry" + hash, because a chained backport
-      // can result in multiple of those lines. Only the last one counts.
-      const cherry = Array.from(
-        commit.message.matchAll(/cherry.*([0-9a-f]{40})/g),
-      ).at(-1)
-
-      if (!cherry)
-        return {
-          sha,
-          commit,
-          severity: 'warning',
-          message: `Couldn't locate the cherry-picked commit's hash in the commit message of ${sha}.`,
-          type: 'no-commit-hash',
-        }
-
-      const original_sha = cherry[1]
-
-      let branches
-      try {
-        branches = (
-          await github.request({
-            // This is an undocumented endpoint to fetch the branches a commit is part of.
-            // There is no equivalent in neither the REST nor the GraphQL API.
-            // The endpoint itself is unlikely to go away, because GitHub uses it to display
-            // the list of branches on the detail page of a commit.
-            url: `https://github.com/${context.repo.owner}/${context.repo.repo}/branch_commits/${original_sha}`,
-            headers: {
-              accept: 'application/json',
-            },
-          })
-        ).data.branches
-          .map(({ branch }) => branch)
-          .filter((branch) => classify(branch).type.includes('development'))
-      } catch (e) {
-        // For some unknown reason a 404 error comes back as 500 without any more details in a GitHub Actions runner.
-        // Ignore these to return a regular error message below.
-        if (![404, 500].includes(e.status)) throw e
-      }
-      if (!branches?.length)
-        return {
-          sha,
-          commit,
-          severity: 'error',
-          message: `${original_sha} given in ${sha} not found in any pickable branch.`,
-        }
-
-      return {
-        sha,
-        commit,
-        original_sha,
-      }
-    }
-
-    function diff({ sha, commit, original_sha }) {
-      const diff = execFileSync('git', [
-        '-C',
-        __dirname,
-        'range-diff',
-        '--no-color',
-        '--ignore-all-space',
-        '--no-notes',
-        // 100 means "any change will be reported"; 0 means "no change will be reported"
-        '--creation-factor=100',
-        `${original_sha}~..${original_sha}`,
-        `${sha}~..${sha}`,
-      ])
-        .toString()
-        .split('\n')
-        // First line contains commit SHAs, which we'll print separately.
-        .slice(1)
-        // # The output of `git range-diff` is indented with 4 spaces, but we'll control indentation manually.
-        .map((line) => line.replace(/^ {4}/, ''))
-
-      if (!diff.some((line) => line.match(/^[+-]{2}/)))
-        return {
-          sha,
-          commit,
-          severity: 'info',
-          message: `✔ ${original_sha} is highly similar to ${sha}.`,
-        }
-
-      const colored_diff = execFileSync('git', [
-        '-C',
-        __dirname,
-        'range-diff',
-        '--color',
-        '--no-notes',
-        '--creation-factor=100',
-        `${original_sha}~..${original_sha}`,
-        `${sha}~..${sha}`,
-      ]).toString()
-
-      return {
-        sha,
-        commit,
-        diff,
-        colored_diff,
-        severity: 'warning',
-        message: `Difference between ${sha} and original ${original_sha} may warrant inspection.`,
-        type: 'diff',
-      }
-    }
-
-    // For now we short-circuit the list of commits when cherryPicks should not be checked.
-    // This will not run any checks, but still trigger the "dismiss reviews" part below.
-    const commits = !cherryPicks
-      ? []
-      : await github.paginate(github.rest.pulls.listCommits, {
-          ...context.repo,
-          pull_number,
-        })
-
-    const extracted = await Promise.all(commits.map(extract))
-
-    const fetch = extracted
-      .filter(({ severity }) => !severity)
-      .flatMap(({ sha, original_sha }) => [sha, original_sha])
-
-    if (fetch.length > 0) {
-      // Fetching all commits we need for diff at once is much faster than any other method.
-      execFileSync('git', [
-        '-C',
-        __dirname,
-        'fetch',
-        '--depth=2',
-        'origin',
-        ...fetch,
-      ])
-    }
-
-    const results = extracted.map((result) =>
-      result.severity ? result : diff(result),
-    )
-
-    // Log all results without truncation, with better highlighting and all whitespace changes to the job log.
-    results.forEach(({ sha, commit, severity, message, colored_diff }) => {
-      core.startGroup(`Commit ${sha}`)
-      core.info(`Author: ${commit.author.name} ${commit.author.email}`)
-      core.info(`Date: ${new Date(commit.author.date)}`)
-      switch (severity) {
-        case 'error':
-          core.error(message)
-          break
-        case 'warning':
-          core.warning(message)
-          break
-        default:
-          core.info(message)
-      }
-      core.endGroup()
-      if (colored_diff) core.info(colored_diff)
-    })
-
-    // Only create step summary below in case of warnings or errors.
-    // Also clean up older reviews, when all checks are good now.
-    // An empty results array will always trigger this condition, which is helpful
-    // to clean up reviews created by the prepare step when on the wrong branch.
-    if (results.every(({ severity }) => severity === 'info')) {
-      await dismissReviews({ github, context, dry, reviewKey })
-      return
-    }
-
-    // In the case of "error" severity, we also fail the job.
-    // Those should be considered blocking and not be dismissable via review.
-    if (results.some(({ severity }) => severity === 'error'))
-      process.exitCode = 1
-
-    core.summary.addRaw(
-      'This report is automatically generated by the `PR / Check / cherry-pick` CI workflow.',
-      true,
-    )
-    core.summary.addEOL()
-    core.summary.addRaw(
-      "Some of the commits in this PR require the author's and reviewer's attention.",
-      true,
-    )
-    core.summary.addEOL()
-
-    if (results.some(({ type }) => type === 'no-commit-hash')) {
-      core.summary.addRaw(
-        'Please follow the [backporting guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#how-to-backport-pull-requests) and cherry-pick with the `-x` flag.',
-        true,
-      )
-      core.summary.addRaw(
-        'This requires changes to the unstable `master` and `staging` branches first, before backporting them.',
-        true,
-      )
-      core.summary.addEOL()
-      core.summary.addRaw(
-        'Occasionally, commits are not cherry-picked at all, for example when updating minor versions of packages which have already advanced to the next major on unstable.',
-        true,
-      )
-      core.summary.addRaw(
-        'These commits can optionally be marked with a `Not-cherry-picked-because: <reason>` footer.',
-        true,
-      )
-      core.summary.addEOL()
-    }
-
-    if (results.some(({ type }) => type === 'diff')) {
-      core.summary.addRaw(
-        'Sometimes it is not possible to cherry-pick exactly the same patch.',
-        true,
-      )
-      core.summary.addRaw(
-        'This most frequently happens when resolving merge conflicts.',
-        true,
-      )
-      core.summary.addRaw(
-        'The range-diff will help to review the resolution of conflicts.',
-        true,
-      )
-      core.summary.addEOL()
-    }
-
-    core.summary.addRaw(
-      'If you need to merge this PR despite the warnings, please [dismiss](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review) this review shortly before merging.',
-      true,
-    )
-
-    results.forEach(({ severity, message, diff }) => {
-      if (severity === 'info') return
-
-      // The docs for markdown alerts only show examples with markdown blockquote syntax, like this:
-      //   > [!WARNING]
-      //   > message
-      // However, our testing shows that this also works with a `<blockquote>` html tag, as long as there
-      // is an empty line:
-      //   <blockquote>
-      //
-      //   [!WARNING]
-      //   message
-      //   </blockquote>
-      // Whether this is intended or just an implementation detail is unclear.
-      core.summary.addRaw('<blockquote>')
-      core.summary.addRaw(
-        `\n\n[!${{ important: 'IMPORTANT', warning: 'WARNING', error: 'CAUTION' }[severity]}]`,
-        true,
-      )
-      core.summary.addRaw(`${message}`, true)
-
-      if (diff) {
-        // Limit the output to 10k bytes and remove the last, potentially incomplete line, because GitHub
-        // comments are limited in length. The value of 10k is arbitrary with the assumption, that after
-        // the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff in
-        // GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
-        // Note: if multiple commits are close to the limit, this approach could still lead to a comment
-        // that's too long. We think this is unlikely to happen, and so don't deal with it explicitly.
-        const truncated = []
-        let total_length = 0
-        for (line of diff) {
-          total_length += line.length
-          if (total_length > 10000) {
-            truncated.push('', '[...truncated...]')
-            break
-          } else {
-            truncated.push(line)
-          }
-        }
-
-        core.summary.addRaw('<details><summary>Show diff</summary>')
-        core.summary.addRaw('\n\n``````````diff', true)
-        core.summary.addRaw(truncated.join('\n'), true)
-        core.summary.addRaw('``````````', true)
-        core.summary.addRaw('</details>')
-      }
-
-      core.summary.addRaw('</blockquote>')
-    })
-
-    if (job_url)
-      core.summary.addRaw(
-        `\n\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`,
-      )
-
-    const body = core.summary.stringify()
-    core.summary.write()
-
-    // Posting a review could fail for very long comments. This can only happen with
-    // multiple commits all hitting the truncation limit for the diff. If you ever hit
-    // this case, consider just splitting up those commits into multiple PRs.
-    await postReview({ github, context, core, dry, body, reviewKey })
-  })
-}

ci/github-script/get-pr-commit-details.js

@@ -1,117 +0,0 @@
-// @ts-check
-const { promisify } = require('node:util')
-const execFile = promisify(require('node:child_process').execFile)
-
-/**
- * @typedef {{
- *  subject: string,
- *  sha: string,
- *  author: { name: string, email: string },
- *  committer: { name: string, email: string}
- *  changedPaths: string[],
- *  changedPathSegments: Set<string>,
- * }} Commit
- */
-
-/**
- * @param {{
- *  args: string[]
- *  core: import('@actions/core'),
- *  quiet?: boolean,
- *  repoPath?: string,
- * }} RunGitProps
- */
-async function runGit({ args, repoPath, core, quiet }) {
-  if (repoPath) {
-    args = ['-C', repoPath, ...args]
-  }
-
-  if (!quiet) {
-    core.info(`About to run \`git ${args.map((s) => `'${s}'`).join(' ')}\``)
-  }
-
-  return await execFile('git', args)
-}
-
-/**
- * Gets the SHA, subject and changed files for each commit in the given PR.
- *
- * Don't use GitHub API at all: the "list commits on PR" endpoint has a limit
- * of 250 commits and doesn't return the changed files.
- *
- * @param {{
- *  core: import('@actions/core'),
- *  pr: Awaited<ReturnType<InstanceType<import('@actions/github/lib/utils').GitHub>["rest"]["pulls"]["get"]>>["data"]
- *  repoPath?: string,
- * }} GetCommitMessagesForPRProps
- *
- * @returns {Promise<Commit[]>}
- */
-async function getCommitDetailsForPR({ core, pr, repoPath }) {
-  await runGit({
-    args: ['fetch', `--depth=1`, 'origin', pr.base.sha],
-    repoPath,
-    core,
-  })
-  await runGit({
-    args: ['fetch', `--depth=${pr.commits + 1}`, 'origin', pr.head.sha],
-    repoPath,
-    core,
-  })
-
-  const shas = (
-    await runGit({
-      args: [
-        'rev-list',
-        `--max-count=${pr.commits}`,
-        `${pr.base.sha}..${pr.head.sha}`,
-      ],
-      repoPath,
-      core,
-    })
-  ).stdout
-    .split('\n')
-    .map((s) => s.trim())
-    .filter(Boolean)
-
-  return Promise.all(
-    shas.map(async (sha) => {
-      // Subject, author name, author email, committer name, committer email (all tab-seperated)
-      // then a blank line, then filenames.
-      const result = (
-        await runGit({
-          args: [
-            'log',
-            '--format=%s\t%aN\t%aE\t%cN\t%cE',
-            '--name-only',
-            '-1',
-            sha,
-          ],
-          repoPath,
-          core,
-          quiet: true,
-        })
-      ).stdout.split('\n')
-
-      const [subject, authorName, authorEmail, committerName, committerEmail] =
-        result[0].split('\t')
-
-      const changedPaths = result.slice(2, -1)
-
-      const changedPathSegments = new Set(
-        changedPaths.flatMap((path) => path.split('/')),
-      )
-
-      return {
-        sha,
-        subject,
-        author: { name: authorName, email: authorEmail },
-        committer: { name: committerName, email: committerEmail },
-        changedPaths,
-        changedPathSegments,
-      }
-    }),
-  )
-}
-
-module.exports = { getCommitDetailsForPR }

ci/github-script/get-teams.js

@@ -1,85 +0,0 @@
-const excludeTeams = [
-  /^voters.*$/,
-  /^nixpkgs-maintainers$/,
-  /^nixpkgs-committers$/,
-]
-
-module.exports = async ({ github, context, core, outFile }) => {
-  const withRateLimit = require('./withRateLimit.js')
-  const { writeFileSync } = require('node:fs')
-
-  const org = context.repo.owner
-
-  const result = {}
-
-  await withRateLimit({ github, core }, async () => {
-    // Turn an Array of users into an Object, mapping user.login -> user.id
-    function makeUserSet(users) {
-      // Sort in-place and build result by mutation
-      users.sort((a, b) => (a.login > b.login ? 1 : -1))
-
-      return users.reduce((acc, user) => {
-        acc[user.login] = user.id
-        return acc
-      }, {})
-    }
-
-    // Process a list of teams and append to the result variable
-    async function processTeams(teams) {
-      for (const team of teams) {
-        core.notice(`Processing team ${team.slug}`)
-        if (!excludeTeams.some((regex) => team.slug.match(regex))) {
-          const members = makeUserSet(
-            await github.paginate(github.rest.teams.listMembersInOrg, {
-              org,
-              team_slug: team.slug,
-              role: 'member',
-            }),
-          )
-          const maintainers = makeUserSet(
-            await github.paginate(github.rest.teams.listMembersInOrg, {
-              org,
-              team_slug: team.slug,
-              role: 'maintainer',
-            }),
-          )
-          result[team.slug] = {
-            description: team.description,
-            id: team.id,
-            maintainers,
-            members,
-            name: team.name,
-          }
-        }
-        await processTeams(
-          await github.paginate(github.rest.teams.listChildInOrg, {
-            org,
-            team_slug: team.slug,
-          }),
-        )
-      }
-    }
-
-    const teams = await github.paginate(github.rest.repos.listTeams, {
-      ...context.repo,
-    })
-
-    await processTeams(teams)
-  })
-
-  // Sort the teams by team name
-  const sorted = Object.keys(result)
-    .sort()
-    .reduce((acc, key) => {
-      acc[key] = result[key]
-      return acc
-    }, {})
-
-  const json = `${JSON.stringify(sorted, null, 2)}\n`
-
-  if (outFile) {
-    writeFileSync(outFile, json)
-  } else {
-    console.log(json)
-  }
-}

ci/github-script/lint-commits.js

@@ -1,223 +0,0 @@
-// @ts-check
-const { classify } = require('../supportedBranches.js')
-const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
-
-/** @typedef {import('./get-pr-commit-details.js').Commit} Commit */
-
-/**
- * @param {{
- *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
- *  context: typeof import('@actions/github').context,
- *  core: import('@actions/core'),
- *  repoPath?: string,
- * }} LintCommitsProps
- */
-async function lintCommits({ github, context, core, repoPath }) {
-  // This check should only be run when we have the pull_request context.
-  const pull_number = context.payload.pull_request?.number
-  if (!pull_number) {
-    core.info('This is not a pull request. Skipping checks.')
-    return
-  }
-
-  const pr = (
-    await github.rest.pulls.get({
-      ...context.repo,
-      pull_number,
-    })
-  ).data
-
-  const baseBranchType = classify(
-    pr.base.ref.replace(/^refs\/heads\//, ''),
-  ).type
-  const headBranchType = classify(
-    pr.head.ref.replace(/^refs\/heads\//, ''),
-  ).type
-
-  if (
-    baseBranchType.includes('development') &&
-    headBranchType.includes('development') &&
-    pr.base.repo.id === pr.head.repo?.id
-  ) {
-    // This matches, for example, PRs from NixOS:staging-next to NixOS:master, or vice versa.
-    // Ignore them: we should only care about PRs introducing *new* commits.
-    // We still want to run on PRs from, e.g., Someone:master to NixOS:master, though.
-    core.info(
-      'This PR is from one development branch to another. Skipping checks.',
-    )
-    return
-  }
-
-  const commits = await getCommitDetailsForPR({ core, pr, repoPath })
-
-  await checkCommitMessages({ commits, core })
-  await checkCommitMetadata({ commits, core })
-}
-
-/**
- * @param {{
- *  commits: Commit[],
- *  core: import('@actions/core'),
- * }} CheckCommitMessagesProps
- */
-async function checkCommitMessages({ commits, core }) {
-  const failures = new Set()
-
-  const conventionalCommitTypes = [
-    'build',
-    'chore',
-    'ci',
-    'doc',
-    'docs',
-    'feat',
-    'feature',
-    'fix',
-    'perf',
-    'refactor',
-    'style',
-    'test',
-  ]
-
-  /**
-   * @param {string[]} types e.g. ["fix", "feat"]
-   * @param {string?} sha commit hash
-   */
-  function makeConventionalCommitRegex(types, sha = null) {
-    core.info(
-      `${
-        sha
-          ? `Conventional commit types for ${sha?.slice(0, 16)}`
-          : 'Default conventional commit types'
-      }: ${JSON.stringify(types)}`,
-    )
-
-    return new RegExp(`^(${types.join('|')})!?(\\(.*\\))?!?:`)
-  }
-
-  // Optimize for the common case that we don't have path segments with the
-  // same name as a conventional commit type.
-  const fullConventionalCommitRegex = makeConventionalCommitRegex(
-    conventionalCommitTypes,
-  )
-
-  for (const commit of commits) {
-    const logMsgStart = `Commit ${commit.sha}'s message's subject ("${commit.subject}")`
-
-    // If we have a commit `perf: ...`, and we touch a file containing the path
-    // segment "perf", we don't want to flag this.
-    const filteredTypes = conventionalCommitTypes.filter(
-      (type) => !commit.changedPathSegments.has(type),
-    )
-    const conventionalCommitRegex =
-      filteredTypes.length === conventionalCommitTypes.length
-        ? fullConventionalCommitRegex
-        : makeConventionalCommitRegex(filteredTypes, commit.sha)
-
-    if (!commit.subject.includes(': ')) {
-      core.error(
-        `${logMsgStart} was detected as not meeting our guidelines because ` +
-          'it does not contain a colon followed by a whitespace. ' +
-          'There are likely other issues as well.',
-      )
-      failures.add(commit.sha)
-    }
-
-    if (commit.subject.endsWith('.')) {
-      core.error(
-        `${logMsgStart} was detected as not meeting our guidelines because ` +
-          'it ends in a period. There may be other issues as well.',
-      )
-      failures.add(commit.sha)
-    }
-
-    const fixups = ['amend!', 'fixup!', 'squash!']
-    if (fixups.some((s) => commit.subject.startsWith(s))) {
-      core.error(
-        `${logMsgStart} was detected as not meeting our guidelines because ` +
-          `it begins with "${fixups.find((s) => commit.subject.startsWith(s))}". ` +
-          'Did you forget to run `git rebase -i --autosquash`?',
-      )
-      failures.add(commit.sha)
-    }
-
-    if (conventionalCommitRegex.test(commit.subject)) {
-      core.error(
-        `${logMsgStart} was detected as not meeting our guidelines because ` +
-          'it seems to use conventional commit (conventionalcommits.org) ' +
-          'formatting. Nixpkgs has its own, different, commit message ' +
-          'formatting standards.',
-      )
-      failures.add(commit.sha)
-    }
-
-    if (!failures.has(commit.sha)) {
-      core.info(`${logMsgStart} passed our automated checks!`)
-    }
-  }
-
-  if (failures.size !== 0) {
-    core.error(
-      'Please review the guidelines at ' +
-        '<https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#commit-conventions>, ' +
-        'as well as the applicable area-specific guidelines linked there.',
-    )
-    core.setFailed('Committers: merging is discouraged.')
-  }
-}
-
-/**
- * @param {{
- *  commits: Commit[],
- *  core: import('@actions/core'),
- * }} CheckGitFieldsProps
- */
-async function checkCommitMetadata({ commits, core }) {
-  const failures = new Set()
-
-  /** @type {(s: string) => boolean} */
-  const isEmail = (s) => /^.+@.*$/.test(s)
-
-  for (const commit of commits) {
-    if (!commit.author.name) {
-      core.error(`Commit ${commit.sha} author's name field is missing`)
-      failures.add(commit.sha)
-    }
-
-    if (!commit.author.email || !isEmail(commit.author.email)) {
-      core.error(
-        `Commit ${commit.sha} author's email field is missing or invalid`,
-      )
-      failures.add(commit.sha)
-    }
-
-    if (!commit.committer.name) {
-      core.error(`Commit ${commit.sha} committer's name field is missing`)
-      failures.add(commit.sha)
-    }
-
-    if (!commit.committer.email || !isEmail(commit.committer.email)) {
-      core.error(
-        `Commit ${commit.sha} committer's email field is missing or invalid`,
-      )
-      failures.add(commit.sha)
-    }
-
-    if (!failures.has(commit.sha)) {
-      core.info(
-        `Commit ${commit.sha}'s git fields passed our automated checks!`,
-      )
-    }
-  }
-
-  if (failures.size !== 0) {
-    core.error(
-      'Please add the missing commit fields. ' +
-        'You can use the noreply email address generated for you by GitHub ' +
-        '(https://docs.github.com/en/account-and-profile/reference/email-addresses-reference#your-noreply-email-address) ' +
-        "if you'd like.",
-    )
-    core.setFailed('Committers: merging is discouraged.')
-  }
-}
-
-module.exports = lintCommits

ci/github-script/manual-file-edits.js

@@ -1,95 +0,0 @@
-// @ts-check
-const { classify } = require('../supportedBranches.js')
-const { getCommitDetailsForPR } = require('./get-pr-commit-details')
-
-/**
- * @param {{
- *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
- *  context: import('@actions/github/lib/context').Context,
- *  core: import('@actions/core'),
- *  repoPath?: string,
- *  dry: boolean,
- * }} CheckManualFileEditsProps
- */
-async function checkManualFileEdits({ github, context, core, repoPath, dry }) {
-  const { dismissReviews, postReview } = require('./reviews.js')
-  const reviewKey = 'manual-file-edits'
-
-  const pull_number = context.payload.pull_request?.number
-  if (!pull_number) {
-    core.info('This is not a pull request. Skipping checks.')
-    return
-  }
-
-  const pr = (
-    await github.rest.pulls.get({
-      ...context.repo,
-      pull_number,
-    })
-  ).data
-
-  if (pr.user.login.endsWith('[bot]')) {
-    core.info('This is a bot, so these checks do not apply.')
-    return
-  }
-
-  const baseBranchType = classify(
-    pr.base.ref.replace(/^refs\/heads\//, ''),
-  ).type
-  const headBranchType = classify(
-    pr.head.ref.replace(/^refs\/heads\//, ''),
-  ).type
-
-  if (
-    baseBranchType.includes('development') &&
-    headBranchType.includes('development') &&
-    pr.base.repo.id === pr.head.repo?.id
-  ) {
-    // This matches, for example, PRs from NixOS:staging-next to NixOS:master, or vice versa.
-    // Ignore them: we should only care about PRs introducing *new* commits.
-    // We still want to run on PRs from, e.g., Someone:master to NixOS:master, though.
-    core.info(
-      'This PR is from one development branch to another. Skipping checks.',
-    )
-    return
-  }
-
-  const details = await getCommitDetailsForPR({ core, pr, repoPath })
-
-  if (
-    details.some(({ changedPaths }) =>
-      changedPaths.includes('maintainers/github-teams.json'),
-    )
-  ) {
-    postReview({
-      github,
-      context,
-      core,
-      dry,
-      event: 'REQUEST_CHANGES',
-      body: [
-        'maintainers/github-teams.json is supposed to accurately reflect the state of the teams in GitHub.\n',
-        'Therefore, it should not be edited manually.\n',
-        'All changes to teams listed in maintainers/github-teams.json should be performed in GitHub by a team maintainer.\n',
-        "Team maintainers are listed in the github-teams.json file and in GitHub's UI.\n",
-        'If there is no team maintainer available, an org owner can make the needed change, please contact one by',
-        'following the instructions at https://github.com/NixOS/org/blob/main/doc/github-org-owners.md#how-to-contact-the-team.\n',
-        'Thank you!',
-      ].reduce(
-        (prev, curr) => prev + (!prev || prev.endsWith('\n') ? '' : ' ') + curr,
-        '',
-      ),
-      reviewKey,
-    })
-  } else {
-    dismissReviews({
-      github,
-      context,
-      core,
-      dry,
-      reviewKey,
-    })
-  }
-}
-
-module.exports = checkManualFileEdits

ci/github-script/merge.js

@@ -1,354 +0,0 @@
-const { classify } = require('../supportedBranches.js')
-
-function runChecklist({
-  committers,
-  events,
-  files,
-  pull_request,
-  log,
-  maintainers,
-  user,
-  userIsMaintainer,
-}) {
-  const allByName = files.every(
-    ({ filename }) =>
-      filename.startsWith('pkgs/by-name/') && filename.split('/').length > 4,
-  )
-
-  const packages = files
-    .filter(({ filename }) => filename.startsWith('pkgs/by-name/'))
-    .map(({ filename }) => filename.split('/')[3])
-    .filter(Boolean)
-
-  const eligible = !packages.length
-    ? new Set()
-    : packages
-        .map((pkg) => new Set(maintainers[pkg]))
-        .reduce((acc, cur) => acc?.intersection(cur) ?? cur)
-
-  const approvals = new Set(
-    events
-      .filter(
-        ({ event, state, commit_id }) =>
-          event === 'reviewed' &&
-          state === 'approved' &&
-          // Only approvals for the current head SHA count, otherwise authors could push
-          // bad code between the approval and the merge.
-          commit_id === pull_request.head.sha,
-      )
-      .map(({ user }) => user?.id)
-      // Some users have been deleted, so filter these out.
-      .filter(Boolean),
-  )
-
-  const checklist = {
-    'PR targets a [development branch](https://github.com/NixOS/nixpkgs/blob/-/ci/README.md#branch-classification).':
-      classify(pull_request.base.ref).type.includes('development'),
-    'PR touches only files of packages in `pkgs/by-name/`.': allByName,
-    'PR is at least one of:': {
-      'Approved by a [committer](https://github.com/orgs/NixOS/teams/nixpkgs-committers).':
-        committers.intersection(approvals).size > 0,
-      'Backported via label.':
-        pull_request.user.login === 'nixpkgs-ci[bot]' &&
-        pull_request.head.ref.startsWith('backport-'),
-      'Opened by a [committer](https://github.com/orgs/NixOS/teams/nixpkgs-committers).':
-        committers.has(pull_request.user.id),
-      'Opened by [@r-ryantm](https://nix-community.github.io/nixpkgs-update/r-ryantm/).':
-        pull_request.user.login === 'r-ryantm',
-    },
-    'PR is not a draft': !pull_request.draft,
-  }
-
-  if (user) {
-    checklist[
-      `${user.login} is a member of [@NixOS/nixpkgs-maintainers](https://github.com/orgs/NixOS/teams/nixpkgs-maintainers).`
-    ] = userIsMaintainer
-    if (allByName) {
-      // We can only determine the below, if all packages are in by-name, since
-      // we can't reliably relate changed files to packages outside by-name.
-      checklist[
-        `${user.login} is a maintainer of all touched packages on the ${pull_request.base.ref} branch.`
-      ] = eligible.has(user.id)
-    }
-  } else {
-    // This is only used when no user is passed, i.e. for labeling.
-    checklist['PR has maintainers eligible to merge.'] = eligible.size > 0
-  }
-
-  const result = Object.values(checklist).every((v) =>
-    typeof v === 'boolean' ? v : Object.values(v).some(Boolean),
-  )
-
-  log('checklist', JSON.stringify(checklist))
-  log('eligible', JSON.stringify(Array.from(eligible)))
-  log('result', result)
-
-  return {
-    checklist,
-    eligible,
-    result,
-  }
-}
-
-// The merge command must be on a separate line and not within codeblocks or html comments.
-// Codeblocks can have any number of ` larger than 3 to open/close. We only look at code
-// blocks that are not indented, because the later regex wouldn't match those anyway.
-function hasMergeCommand(body) {
-  return (body ?? '')
-    .replace(/<!--.*?-->/gms, '')
-    .replace(/(^`{3,})[^`].*?\1/gms, '')
-    .match(/^@NixOS\/nixpkgs-merge-bot merge\s*$/m)
-}
-
-async function handleMergeComment({ github, body, node_id, reaction }) {
-  if (!hasMergeCommand(body)) return
-
-  await github.graphql(
-    `mutation($node_id: ID!, $reaction: ReactionContent!) {
-      addReaction(input: {
-        content: $reaction,
-        subjectId: $node_id
-      })
-      { clientMutationId }
-    }`,
-    { node_id, reaction },
-  )
-}
-
-async function handleMerge({
-  github,
-  context,
-  core,
-  log,
-  dry,
-  pull_request,
-  events,
-  maintainers,
-  getTeamMembers,
-  getUser,
-}) {
-  const pull_number = pull_request.number
-
-  const committers = new Set(
-    (await getTeamMembers('nixpkgs-committers')).map(({ id }) => id),
-  )
-
-  const files = (
-    await github.rest.pulls.listFiles({
-      ...context.repo,
-      pull_number,
-      per_page: 100,
-    })
-  ).data
-
-  // Early exit to prevent treewides from using up a lot of API requests (and time!) to list
-  // all the files in the pull request. For now, the merge-bot will not work when 100 or more
-  // files are touched in a PR - which should be more than fine.
-  // TODO: Find a more efficient way of downloading all the *names* of the touched files,
-  // including an early exit when the first non-by-name file is found.
-  if (files.length >= 100) return false
-
-  // Only look through comments *after* the latest (force) push.
-  const lastPush = events.findLastIndex(
-    ({ event, sha, commit_id }) =>
-      ['committed', 'head_ref_force_pushed'].includes(event) &&
-      (sha ?? commit_id) === pull_request.head.sha,
-  )
-
-  const comments = events.slice(lastPush + 1).filter(
-    ({ event, body, user, node_id }) =>
-      ['commented', 'reviewed'].includes(event) &&
-      hasMergeCommand(body) &&
-      // Ignore comments where the user has been deleted already.
-      user &&
-      // Ignore comments which had already been responded to by the bot.
-      (dry ||
-        !events.some(
-          ({ event, body }) =>
-            ['commented'].includes(event) &&
-            // We're only testing this hidden reference, but not the author of the comment.
-            // We'll just assume that nobody creates comments with this marker on purpose.
-            // Additionally checking the author is quite annoying for local debugging.
-            body.match(new RegExp(`^<!-- comment: ${node_id} -->$`, 'm')),
-        )),
-  )
-
-  async function merge() {
-    if (dry) {
-      core.info(`Merging #${pull_number}... (dry)`)
-      return ['Merge completed (dry)']
-    }
-
-    // Using GraphQL mutations instead of the REST /merge endpoint, because the latter
-    // doesn't work with Merge Queues. We now have merge queues enabled on all development
-    // branches, so we don't need a fallback for regular merges.
-    try {
-      const resp = await github.graphql(
-        `mutation($node_id: ID!, $sha: GitObjectID) {
-          enqueuePullRequest(input: {
-            expectedHeadOid: $sha,
-            pullRequestId: $node_id
-          })
-          {
-            clientMutationId,
-            mergeQueueEntry { mergeQueue { url } }
-          }
-        }`,
-        { node_id: pull_request.node_id, sha: pull_request.head.sha },
-      )
-      log('merge', 'Queued for merge')
-      return [
-        `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
-      ]
-    } catch (e) {
-      log('Enqueuing failed', e.response.errors[0].message)
-    }
-
-    // If required status checks are not satisfied, yet, the above will fail. In this case
-    // we can enable auto-merge. We could also only use auto-merge, but this often gets
-    // stuck for no apparent reason.
-    try {
-      await github.graphql(
-        `mutation($node_id: ID!, $sha: GitObjectID) {
-          enablePullRequestAutoMerge(input: {
-            expectedHeadOid: $sha,
-            pullRequestId: $node_id
-          })
-          { clientMutationId }
-        }`,
-        { node_id: pull_request.node_id, sha: pull_request.head.sha },
-      )
-      log('merge', 'Auto-merge enabled')
-      return [
-        `:heavy_check_mark: Enabled Auto Merge (#306934)`,
-        '',
-        '> [!TIP]',
-        '> Sometimes GitHub gets stuck after enabling Auto Merge. In this case, leaving another approval should trigger the merge.',
-      ]
-    } catch (e) {
-      log('Auto Merge failed', e.response.errors[0].message)
-      throw new Error(e.response.errors[0].message)
-    }
-  }
-
-  for (const comment of comments) {
-    log('comment', comment.node_id)
-
-    async function react(reaction) {
-      if (dry) {
-        core.info(`Reaction ${reaction} on ${comment.node_id} (dry)`)
-        return
-      }
-
-      await handleMergeComment({
-        github,
-        body: comment.body,
-        node_id: comment.node_id,
-        reaction,
-      })
-    }
-
-    async function isMaintainer(username) {
-      try {
-        return (
-          (
-            await github.rest.teams.getMembershipForUserInOrg({
-              org: context.repo.owner,
-              team_slug: 'nixpkgs-maintainers',
-              username,
-            })
-          ).data.state === 'active'
-        )
-      } catch (e) {
-        if (e.status === 404) return false
-        else throw e
-      }
-    }
-
-    const { result, eligible, checklist } = runChecklist({
-      committers,
-      events,
-      files,
-      pull_request,
-      log,
-      maintainers,
-      user: comment.user,
-      userIsMaintainer: await isMaintainer(comment.user.login),
-    })
-
-    const body = [
-      `<!-- comment: ${comment.node_id} -->`,
-      `@${comment.user.login} wants to merge this PR.`,
-      '',
-      'Requirements to merge this PR with `@NixOS/nixpkgs-merge-bot merge`:',
-      ...Object.entries(checklist).flatMap(([msg, res]) =>
-        typeof res === 'boolean'
-          ? `- :${res ? 'white_check_mark' : 'x'}: ${msg}`
-          : [
-              `- :${Object.values(res).some(Boolean) ? 'white_check_mark' : 'x'}: ${msg}`,
-              ...Object.entries(res).map(
-                ([msg, res]) =>
-                  `  - ${res ? ':white_check_mark:' : ':white_large_square:'} ${msg}`,
-              ),
-            ],
-      ),
-      '',
-    ]
-
-    if (eligible.size > 0 && !eligible.has(comment.user.id)) {
-      const users = await Promise.all(
-        Array.from(eligible, async (id) => (await getUser(id)).login),
-      )
-      body.push(
-        '> [!TIP]',
-        '> Maintainers eligible to merge are:',
-        ...users.map((login) => `> - ${login}`),
-        '',
-      )
-    }
-
-    if (result) {
-      await react('ROCKET')
-      try {
-        body.push(...(await merge()))
-      } catch (e) {
-        // Remove the HTML comment with node_id reference to allow retrying this merge on the next run.
-        body.shift()
-        body.push(`:x: Merge failed with: ${e} (#371492)`)
-      }
-    } else {
-      await react('THUMBS_DOWN')
-      body.push(':x: Pull Request could not be merged (#305350)')
-    }
-
-    if (dry) {
-      core.info(body.join('\n'))
-    } else {
-      await github.rest.issues.createComment({
-        ...context.repo,
-        issue_number: pull_number,
-        body: body.join('\n'),
-      })
-    }
-
-    if (result) break
-  }
-
-  const { result } = runChecklist({
-    committers,
-    events,
-    files,
-    pull_request,
-    log,
-    maintainers,
-  })
-
-  // Returns a boolean, which indicates whether the PR is merge-bot eligible in principle.
-  // This is used to set the respective label in bot.js.
-  return result
-}
-
-module.exports = {
-  handleMerge,
-  handleMergeComment,
-}

ci/github-script/package.json

@@ -1,16 +0,0 @@
-{
-  "private": true,
-  "//": [
-    "Keep `@actions/core` and `@actions/github` in sync with",
-    "https://github.com/actions/github-script/blob/main/package.json.",
-    "Keep `@actions/artifact` and `bottleneck` in sync with",
-    "`.github/workflows/bot.yml`."
-  ],
-  "dependencies": {
-    "@actions/artifact": "6.2.1",
-    "@actions/core": "1.10.1",
-    "@actions/github": "9.1.0",
-    "bottleneck": "2.19.5",
-    "commander": "14.0.3"
-  }
-}

ci/github-script/prepare.js

@@ -1,239 +0,0 @@
-const { classify } = require('../supportedBranches.js')
-const { postReview, dismissReviews } = require('./reviews.js')
-const reviewKey = 'prepare'
-const supportedSystems = require('./supportedSystems.js')
-
-module.exports = async ({ github, context, core, dry }) => {
-  const pull_number = context.payload.pull_request.number
-
-  for (const retryInterval of [5, 10, 20, 40, 80]) {
-    core.info('Checking whether the pull request can be merged...')
-    const prInfo = (
-      await github.rest.pulls.get({
-        ...context.repo,
-        pull_number,
-      })
-    ).data
-
-    if (prInfo.state !== 'open') throw new Error('PR is not open anymore.')
-
-    if (prInfo.mergeable == null) {
-      core.info(
-        `GitHub is still computing whether this PR can be merged, waiting ${retryInterval} seconds before trying again...`,
-      )
-      await new Promise((resolve) => setTimeout(resolve, retryInterval * 1000))
-      continue
-    }
-
-    const { base, head } = prInfo
-
-    const baseClassification = classify(base.ref)
-    core.setOutput('base', baseClassification)
-    console.log('base classification:', baseClassification)
-
-    const headClassification =
-      base.repo.full_name === head.repo.full_name
-        ? classify(head.ref)
-        : // PRs from forks are always considered WIP.
-          { type: ['wip'] }
-    core.setOutput('head', headClassification)
-    console.log('head classification:', headClassification)
-
-    if (baseClassification.type.includes('channel')) {
-      const { stable, version } = baseClassification
-      const correctBranch = stable ? `release-${version}` : 'master'
-      const body = [
-        'The `nixos-*` and `nixpkgs-*` branches are pushed to by the channel release script and should not be merged into directly.',
-        '',
-        `Please target \`${correctBranch}\` instead.`,
-      ].join('\n')
-
-      await postReview({ github, context, core, dry, body, reviewKey })
-
-      throw new Error('The PR targets a channel branch.')
-    }
-
-    if (headClassification.type.includes('wip')) {
-      // In the following, we look at the git history to determine the base branch that
-      // this Pull Request branched off of. This is *supposed* to be the branch that it
-      // merges into, but humans make mistakes. Once that happens we want to error out as
-      // early as possible.
-
-      // To determine the "real base", we are looking at the merge-base of primary development
-      // branches and the head of the PR. The merge-base which results in the least number of
-      // commits between that base and head is the real base. We can query for this via GitHub's
-      // REST API. There can be multiple candidates for the real base with the same number of
-      // commits. In this case we pick the "best" candidate by a fixed ordering of branches,
-      // as defined in ci/supportedBranches.js.
-      //
-      // These requests take a while, when comparing against the wrong release - they need
-      // to look at way more than 10k commits in that case. Thus, we try to minimize the
-      // number of requests across releases:
-      // - First, we look at the primary development branches only: master and release-xx.yy.
-      //   The branch with the fewest commits gives us the release this PR belongs to.
-      // - We then compare this number against the relevant staging branches for this release
-      //   to find the exact branch that this belongs to.
-
-      // All potential development branches
-      const branches = (
-        await github.paginate(github.rest.repos.listBranches, {
-          ...context.repo,
-          per_page: 100,
-        })
-      ).map(({ name }) => classify(name))
-
-      // All stable primary development branches from latest to oldest.
-      const releases = branches
-        .filter(({ stable, type }) => type.includes('primary') && stable)
-        .sort((a, b) => b.version.localeCompare(a.version))
-
-      async function mergeBase({ branch, order, version }) {
-        const { data } = await github.rest.repos.compareCommitsWithBasehead({
-          ...context.repo,
-          basehead: `${branch}...${head.sha}`,
-          // Pagination for this endpoint is about the commits listed, which we don't care about.
-          per_page: 1,
-          // Taking the second page skips the list of files of this changeset.
-          page: 2,
-        })
-        return {
-          branch,
-          order,
-          version,
-          commits: data.total_commits,
-          sha: data.merge_base_commit.sha,
-        }
-      }
-
-      // Multiple branches can be OK at the same time, if the PR was created of a merge-base,
-      // thus storing as array.
-      let candidates = [await mergeBase(classify('master'))]
-      for (const release of releases) {
-        const nextCandidate = await mergeBase(release)
-        if (candidates[0].commits === nextCandidate.commits)
-          candidates.push(nextCandidate)
-        if (candidates[0].commits > nextCandidate.commits)
-          candidates = [nextCandidate]
-        // The number 10000 is principally arbitrary, but the GitHub API returns this value
-        // when the number of commits exceeds it in reality. The difference between two stable releases
-        // is certainly more than 10k commits, thus this works for us as well: If we're targeting
-        // a wrong release, the number *will* be 10000.
-        if (candidates[0].commits < 10000) break
-      }
-
-      core.info(`This PR is for NixOS ${candidates[0].version}.`)
-
-      // Secondary development branches for the selected version only.
-      const secondary = branches.filter(
-        ({ branch, type, version }) =>
-          type.includes('secondary') && version === candidates[0].version,
-      )
-
-      // Make sure that we always check the current target as well, even if its a WIP branch.
-      secondary.push(classify(base.ref))
-
-      for (const branch of secondary) {
-        const nextCandidate = await mergeBase(branch)
-        if (candidates[0].commits === nextCandidate.commits)
-          candidates.push(nextCandidate)
-        if (candidates[0].commits > nextCandidate.commits)
-          candidates = [nextCandidate]
-      }
-
-      // If the current branch is among the candidates, this is always better than any other,
-      // thus sorting at -1.
-      candidates = candidates
-        .map((candidate) =>
-          candidate.branch === base.ref
-            ? { ...candidate, order: -1 }
-            : candidate,
-        )
-        .sort((a, b) => a.order - b.order)
-
-      const best = candidates.at(0)
-
-      core.info('The base branches for this PR are:')
-      core.info(`github: ${base.ref}`)
-      core.info(
-        `candidates: ${candidates.map(({ branch }) => branch).join(',')}`,
-      )
-      core.info(`best candidate: ${best.branch}`)
-
-      if (best.branch !== base.ref) {
-        const current = await mergeBase(classify(base.ref))
-        const body = [
-          `The PR's base branch is set to \`${current.branch}\`, but ${current.commits === 10000 ? 'at least 10000' : current.commits - best.commits} commits from the \`${best.branch}\` branch are included. Make sure you know the [right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions), then:`,
-          `- If the changes should go to the \`${best.branch}\` branch, [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request).`,
-          `- If the changes should go to the \`${current.branch}\` branch, rebase your PR onto the correct merge-base:`,
-          '  ```bash',
-          `  # git rebase --onto $(git merge-base upstream/${current.branch} HEAD) $(git merge-base upstream/${best.branch} HEAD)`,
-          `  git rebase --onto ${current.sha} ${best.sha}`,
-          `  git push --force-with-lease`,
-          '  ```',
-        ].join('\n')
-
-        await postReview({
-          github,
-          context,
-          core,
-          dry,
-          body,
-          event: 'REQUEST_CHANGES',
-          reviewKey,
-        })
-      } else {
-        await dismissReviews({ github, context, core, dry, reviewKey })
-      }
-    }
-
-    let mergedSha, targetSha
-
-    if (prInfo.mergeable) {
-      core.info('The PR can be merged.')
-
-      mergedSha = prInfo.merge_commit_sha
-      targetSha = (
-        await github.rest.repos.getCommit({
-          ...context.repo,
-          ref: prInfo.merge_commit_sha,
-        })
-      ).data.parents[0].sha
-    } else {
-      core.warning('The PR has a merge conflict.')
-
-      mergedSha = head.sha
-      targetSha = (
-        await github.rest.repos.compareCommitsWithBasehead({
-          ...context.repo,
-          basehead: `${base.sha}...${head.sha}`,
-        })
-      ).data.merge_base_commit.sha
-    }
-
-    core.info(
-      `Checking the commits:\nmerged: ${mergedSha}\ntarget: ${targetSha}`,
-    )
-    core.setOutput('mergedSha', mergedSha)
-    core.setOutput('targetSha', targetSha)
-
-    const systems = await supportedSystems({ github, context, targetSha })
-    core.setOutput('systems', systems)
-
-    const files = (
-      await github.paginate(github.rest.pulls.listFiles, {
-        ...context.repo,
-        pull_number: context.payload.pull_request.number,
-        per_page: 100,
-      })
-    ).map((file) => file.filename)
-
-    const touched = []
-    if (files.includes('ci/pinned.json')) touched.push('pinned')
-    core.setOutput('touched', touched)
-
-    return
-  }
-  throw new Error(
-    "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com.",
-  )
-}

ci/github-script/reviewers.js

@@ -1,188 +0,0 @@
-async function handleReviewers({
-  github,
-  context,
-  core,
-  log,
-  dry,
-  pull_request,
-  reviews,
-  user_maintainers,
-  team_maintainers,
-  owners,
-  getUser,
-  getTeam,
-}) {
-  const pull_number = pull_request.number
-
-  // Users that the PR has already reached, e.g. they've left a review or have been requested for one
-  const users_reached = new Set([
-    ...pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
-    ...reviews.map(({ user }) => user.login.toLowerCase()),
-  ])
-  log('reviewers - users_reached', Array.from(users_reached).join(', '))
-
-  // Same for teams
-  const teams_reached = new Set([
-    ...pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
-    ...reviews.flatMap(({ onBehalfOf }) =>
-      onBehalfOf.nodes.map(({ slug }) => slug.toLowerCase()),
-    ),
-  ])
-  log('reviewers - teams_reached', Array.from(teams_reached).join(', '))
-
-  // Early sanity check, before we start making any API requests. The list of maintainers
-  // does not have duplicates so the only user to filter out from this list would be the
-  // PR author. Therefore, we check for a limit of 15+1, where 15 is the limit we check
-  // further down again.
-  // This is to protect against huge treewides consuming all our API requests for no
-  // reason.
-  if (user_maintainers.length + team_maintainers.length > 16) {
-    core.warning('Too many potential reviewers, skipping review requests.')
-    // Return a boolean on whether the "needs: reviewers" label should be set.
-    return users_reached.size === 0 && teams_reached.size === 0
-  }
-
-  // Users that should be reached
-  var users_to_reach = new Set([
-    ...(
-      await Promise.all(
-        user_maintainers.map(async (id) => {
-          const user = await getUser(id)
-          // User may have deleted their account
-          return user?.login?.toLowerCase()
-        }),
-      )
-    ).filter(Boolean),
-    ...owners
-      .filter((handle) => handle && !handle.includes('/'))
-      .map((handle) => handle.toLowerCase()),
-  ])
-    // We can't request a review from the author.
-    .difference(new Set([pull_request.user?.login.toLowerCase()]))
-
-  // Filter users to repository collaborators. If they're not, they can't be requested
-  // for review. In that case, they probably missed their invite to the maintainers team.
-  users_to_reach = new Set(
-    (
-      await Promise.all(
-        Array.from(users_to_reach, async (username) => {
-          // TODO: Restructure this file to only do the collaborator check for those users
-          // who were not already part of a team. Being a member of a team makes them
-          // collaborators by definition.
-          try {
-            await github.rest.repos.checkCollaborator({
-              ...context.repo,
-              username,
-            })
-            return username
-          } catch (e) {
-            if (e.status !== 404) throw e
-            core.warning(
-              `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
-            )
-          }
-        }),
-      )
-    ).filter(Boolean),
-  )
-  log('reviewers - users_to_reach', Array.from(users_to_reach).join(', '))
-
-  // Similar for teams
-  var teams_to_reach = new Set([
-    ...(
-      await Promise.all(
-        team_maintainers.map(async (id) => {
-          const team = await getTeam(id)
-          // Team may have been deleted
-          return team?.slug?.toLowerCase()
-        }),
-      )
-    ).filter(Boolean),
-    ...owners
-      .map((handle) => handle.split('/'))
-      .filter(
-        ([org, slug]) =>
-          org.toLowerCase() === context.repo.owner.toLowerCase() && slug,
-      )
-      .map(([, slug]) => slug.toLowerCase()),
-  ])
-  teams_to_reach = new Set(
-    (
-      await Promise.all(
-        Array.from(teams_to_reach, async (slug) => {
-          try {
-            await github.rest.teams.checkPermissionsForRepoInOrg({
-              org: context.repo.owner,
-              team_slug: slug,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-            })
-            return slug
-          } catch (e) {
-            if (e.status !== 404) throw e
-            core.warning(
-              `PR #${pull_number}: Team ${slug} cannot be requested for review because it doesn't exist or has no repository permissions, ignoring. Probably wasn't added to the nixpkgs-maintainers team (see https://github.com/NixOS/nixpkgs/tree/master/maintainers#maintainer-teams)`,
-            )
-          }
-        }),
-      )
-    ).filter(Boolean),
-  )
-  log('reviewers - teams_to_reach', Array.from(teams_to_reach).join(', '))
-
-  if (users_to_reach.size + teams_to_reach.size > 15) {
-    core.warning(
-      `Too many reviewers (users: ${Array.from(users_to_reach).join(', ')}, teams: ${Array.from(teams_to_reach).join(', ')}), skipping review requests.`,
-    )
-    // Return a boolean on whether the "needs: reviewers" label should be set.
-    return users_reached.size === 0 && teams_reached.size === 0
-  }
-
-  // We don't want to rerequest reviews from people who already reviewed or were requested
-  const users_not_yet_reached = Array.from(
-    users_to_reach.difference(users_reached),
-  )
-  log('reviewers - users_not_yet_reached', users_not_yet_reached.join(', '))
-  // We don't want to rerequest reviews from teams who already reviewed or were requested
-  const teams_not_yet_reached = Array.from(
-    teams_to_reach.difference(teams_reached),
-  )
-  log('reviewers - teams_not_yet_reached', teams_not_yet_reached.join(', '))
-
-  if (
-    users_not_yet_reached.length === 0 &&
-    teams_not_yet_reached.length === 0
-  ) {
-    log('Has reviewer changes', 'false (skipped)')
-  } else if (dry) {
-    core.info(
-      `Requesting user reviewers for #${pull_number}: ${users_not_yet_reached.join(', ')} (dry)`,
-    )
-    core.info(
-      `Requesting team reviewers for #${pull_number}: ${teams_not_yet_reached.join(', ')} (dry)`,
-    )
-  } else {
-    // We had tried the "request all reviewers at once" thing in the past, but it didn't work out:
-    //   https://github.com/NixOS/nixpkgs/commit/034613f860fcd339bd2c20c8f6bc259a2f9dc034
-    // If we're hitting API errors here again, we'll need to investigate - and possibly reverse
-    // course.
-    await github.rest.pulls.requestReviewers({
-      ...context.repo,
-      pull_number,
-      reviewers: users_not_yet_reached,
-      team_reviewers: teams_not_yet_reached,
-    })
-  }
-
-  // Return a boolean on whether the "needs: reviewers" label should be set.
-  return (
-    users_not_yet_reached.length === 0 &&
-    teams_not_yet_reached.length === 0 &&
-    users_reached.size === 0 &&
-    teams_reached.size === 0
-  )
-}
-
-module.exports = {
-  handleReviewers,
-}

ci/github-script/reviews.js

@@ -1,271 +0,0 @@
-// @ts-check
-
-const eventToState = {
-  COMMENT: 'COMMENTED',
-  REQUEST_CHANGES: 'CHANGES_REQUESTED',
-}
-
-// Use substring checks in order to allow testing in forks
-// Usernames must also end in "[bot]"
-const reviewUsers = [
-  'github-actions',
-  'nixpkgs-ci',
-  'branch-check',
-  'commit-check',
-  'manual-edit',
-]
-
-/**
- * @typedef {InstanceType<import('@actions/github/lib/utils').GitHub>} GitHub
- * @typedef {typeof import('@actions/github').context} Context
- *
- * @typedef {Awaited<ReturnType<GitHub['rest']['pulls']['listReviews']>>['data'][number]} Review
- * @typedef {Review & { user: NonNullable<Review['user']> }} ReviewWithNonNullUser
- */
-
-/**
- * @param {{
- *  github: GitHub,
- *  context: Context,
- *  core: import('@actions/core'),
- *  dry: boolean,
- *  reviewKey?: string,
- * }} DismissReviewsProps
- */
-async function dismissReviews({ github, context, core, dry, reviewKey }) {
-  const pull_number = context.payload.pull_request?.number
-  if (!pull_number) {
-    core.warning('dismissReviews called outside of pull_request context')
-    return
-  }
-
-  if (dry) {
-    return
-  }
-
-  const allReviews = await github.paginate(github.rest.pulls.listReviews, {
-    ...context.repo,
-    pull_number,
-  })
-
-  const reviews = /** @type {ReviewWithNonNullUser[]} */ (
-    allReviews.filter(
-      (review) =>
-        review.user &&
-        review.state !== 'DISMISSED' &&
-        review.user.login.endsWith('[bot]') &&
-        reviewUsers.some((substr) => review.user?.login.includes(substr)),
-    )
-  )
-
-  const reviewsByUser = reviews.reduce(
-    (prev, curr) => {
-      if (!(curr.user.login in prev)) {
-        prev[curr.user.login] = []
-      }
-
-      prev[curr.user.login].push(curr)
-
-      return prev
-    },
-    /** @type {Record<string, ReviewWithNonNullUser[]> } */ ({}),
-  )
-
-  const commentRegex = new RegExp(
-    /<!-- nixpkgs review key: (.*)(?:; resolved: .*)? -->/,
-  )
-  const reviewKeyRegex = new RegExp(
-    `<!-- (nixpkgs review key: ${reviewKey})(?:; resolved: .*)? -->`,
-  )
-  const commentResolvedRegex = new RegExp(
-    /<!-- nixpkgs review key: .*; resolved: true -->/,
-  )
-
-  let reviewsToMinimize = reviews
-  const /** @type {ReviewWithNonNullUser[]} */ reviewsToDismiss = []
-  const /** @type {ReviewWithNonNullUser[]} */ reviewsToResolve = []
-
-  if (reviewKey && reviews.every((review) => commentRegex.test(review.body))) {
-    reviewsToMinimize = reviews.filter((review) =>
-      reviewKeyRegex.test(review.body),
-    )
-  }
-
-  for (const reviewsForUser of Object.values(reviewsByUser)) {
-    // Make sure that we don't dismiss all reviews by a user if they
-    // have any reviews we don't want to dismiss.
-    if (
-      reviewsForUser.every(
-        (review) =>
-          commentResolvedRegex.test(review.body) ||
-          (reviewKey && reviewKeyRegex.test(review.body)) ||
-          // If we are called by check-commits and the review body is clearly
-          // from `commits.js`, then we can safely dismiss the review.
-          // This helps with pre-existing reviews (before the comments were added).
-          (reviewKey &&
-            reviewKey === 'check-commits' &&
-            review.body.includes('PR / Check / cherry-pick')),
-      )
-    ) {
-      reviewsToDismiss.push(
-        ...reviewsForUser.filter(
-          (review) => review.state === 'CHANGES_REQUESTED',
-        ),
-      )
-    } else {
-      reviewsToResolve.push(
-        ...reviewsForUser.filter(
-          (review) =>
-            review.state === 'CHANGES_REQUESTED' &&
-            !commentResolvedRegex.test(review.body) &&
-            reviewsToMinimize.some(
-              (toMinimize) => toMinimize.node_id === review.node_id,
-            ),
-        ),
-      )
-    }
-  }
-
-  await Promise.all([
-    ...reviewsToMinimize.map(async (review) =>
-      github.graphql(
-        `mutation($node_id:ID!) {
-              minimizeComment(input: {
-                classifier: OUTDATED,
-                subjectId: $node_id
-              })
-              { clientMutationId }
-            }`,
-        { node_id: review.node_id },
-      ),
-    ),
-    ...reviewsToDismiss.map(async (review) =>
-      github.rest.pulls.dismissReview({
-        ...context.repo,
-        pull_number,
-        review_id: review.id,
-        message: 'Review dismissed automatically',
-      }),
-    ),
-    ...reviewsToResolve.map(async (review) =>
-      github.rest.pulls.updateReview({
-        ...context.repo,
-        pull_number,
-        review_id: review.id,
-        body: review.body.replace(
-          reviewKeyRegex,
-          `<!-- nixpkgs review key: ${reviewKey}; resolved: true -->`,
-        ),
-      }),
-    ),
-  ])
-}
-
-/**
- * @param {{
- *  github: GitHub,
- *  context: Context,
- *  core: import('@actions/core'),
- *  dry: boolean,
- *  body: string,
- *  event: keyof eventToState,
- *  reviewKey: string,
- * }} PostReviewProps
- */
-async function postReview({
-  github,
-  context,
-  core,
-  dry,
-  body,
-  event = 'REQUEST_CHANGES',
-  reviewKey,
-}) {
-  const pull_number = context.payload.pull_request?.number
-  if (!pull_number) {
-    core.warning('postReview called outside of pull_request context')
-    return
-  }
-
-  const reviewKeyRegex = new RegExp(
-    `<!-- (nixpkgs review key: ${reviewKey})(?:; resolved: .*)? -->`,
-  )
-  const reviewKeyComment = `<!-- nixpkgs review key: ${reviewKey}; resolved: false -->`
-  body = body + '\n\n' + reviewKeyComment
-
-  const reviews = (
-    await github.paginate(github.rest.pulls.listReviews, {
-      ...context.repo,
-      pull_number,
-    })
-  ).filter(
-    (review) =>
-      review.user &&
-      review.state !== 'DISMISSED' &&
-      review.user.login.endsWith('[bot]') &&
-      reviewUsers.some((substr) => review.user?.login.includes(substr)),
-  )
-
-  /** @type {null | Review} */
-  let pendingReview
-  const matchingReviews = reviews.filter((review) =>
-    reviewKeyRegex.test(review.body),
-  )
-
-  if (matchingReviews.length === 0) {
-    pendingReview = null
-  } else if (
-    matchingReviews.length === 1 &&
-    matchingReviews[0].state === eventToState[event]
-  ) {
-    pendingReview = matchingReviews[0]
-  } else {
-    await dismissReviews({
-      github,
-      context,
-      core,
-      dry,
-      reviewKey,
-    })
-    pendingReview = null
-  }
-
-  if (dry) {
-    if (pendingReview)
-      core.info(`pending review found: ${pendingReview.html_url}`)
-    else core.info('no pending review found')
-    core.info(body)
-  } else {
-    if (pendingReview) {
-      await Promise.all([
-        github.rest.pulls.updateReview({
-          ...context.repo,
-          pull_number,
-          review_id: pendingReview.id,
-          body,
-        }),
-        github.graphql(
-          `mutation($node_id:ID!) {
-              unminimizeComment(input: {
-                subjectId: $node_id
-              })
-              { clientMutationId }
-            }`,
-          { node_id: pendingReview.node_id },
-        ),
-      ])
-    } else {
-      await github.rest.pulls.createReview({
-        ...context.repo,
-        pull_number,
-        event,
-        body,
-      })
-    }
-  }
-}
-
-module.exports = {
-  dismissReviews,
-  postReview,
-}

ci/github-script/run

@@ -1,130 +0,0 @@
-#!/usr/bin/env -S node --import ./run
-import { execSync } from 'node:child_process'
-import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { join } from 'node:path'
-import { program } from 'commander'
-import * as core from '@actions/core'
-import { getOctokit } from '@actions/github'
-
-async function run(action, owner, repo, pull_number, options = {}) {
-  const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
-
-  const github = getOctokit(token)
-
-  const payload = !pull_number ? {} : {
-    pull_request: (await github.rest.pulls.get({
-      owner,
-      repo,
-      pull_number,
-    })).data
-  }
-
-  process.env['INPUT_GITHUB-TOKEN'] = token
-
-  closeSync(openSync('step-summary.md', 'w'))
-  process.env.GITHUB_STEP_SUMMARY = 'step-summary.md'
-
-  await action({
-    github,
-    context: {
-      payload,
-      repo: {
-        owner,
-        repo,
-      },
-    },
-    core,
-    dry: true,
-    ...options,
-  })
-}
-
-program
-  .command('prepare')
-  .description('Prepare relevant information of a pull request.')
-  .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')
-  .argument('<pr>', 'Number of the Pull Request to check')
-  .option('--no-dry', 'Make actual modifications')
-  .action(async (owner, repo, pr, options) => {
-    const prepare = (await import('./prepare.js')).default
-    await run(prepare, owner, repo, pr, options)
-  })
-
-program
-  .command('commits')
-  .description('Check commit structure of a pull request.')
-  .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')
-  .argument('<pr>', 'Number of the Pull Request to check')
-  .option('--no-cherry-picks', 'Do not expect cherry-picks.')
-  .action(async (owner, repo, pr, options) => {
-    const commits = (await import('./commits.js')).default
-    await run(commits, owner, repo, pr, options)
-  })
-
-program
-  .command('bot')
-  .description('Run automation on pull requests and issues.')
-  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
-  .argument('[pr]', 'Number of the Pull Request to label')
-  .option('--no-dry', 'Make actual modifications')
-  .action(async (owner, repo, pr, options) => {
-    const bot = (await import('./bot.js')).default
-    const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
-    try {
-      process.env.GITHUB_WORKSPACE = tmp
-      process.chdir(tmp)
-      await run(bot, owner, repo, pr, options)
-    } finally {
-      rmSync(tmp, { recursive: true })
-    }
-  })
-
-program
-  .command('get-teams')
-  .description('Fetch the list of teams with GitHub and output it to a file')
-  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
-  .argument('[outFile]', 'Path to the output file (Example: github-teams.json). If not set, prints to stdout')
-  .action(async (owner, repo, outFile, options) => {
-    const getTeams = (await import('./get-teams.js')).default
-    await run(getTeams, owner, repo, undefined, { ...options, outFile })
-  })
-
-program
-  .command('lint-commits')
-  .description('Lint for common errors in commit messages')
-  .argument('<owner>', 'Owner of the GitHub repository to run on (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
-  .argument('<pr>', 'Number of the Pull Request to run on')
-  .action(async (owner, repo, pr, options) => {
-    const checkCommitMessages = (await import('./lint-commits.js')).default
-    await run(checkCommitMessages, owner, repo, pr, options)
-  })
-
-program
-  .command('check-target-branch')
-  .description('Check that the PR is made against the correct branch')
-  .argument('<owner>', 'Owner of the GitHub repository to run on (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
-  .argument('<pr>', 'Number of the Pull Request to run on')
-  .action(async (owner, repo, pr, options) => {
-    const checkCommitMessages = (await import('./check-target-branch.js')).default
-    await run(checkCommitMessages, owner, repo, pr, options)
-  })
-
-program
-  .command('manual-file-edits')
-  .description("Error when files that shouldn't be edited manually are")
-  .argument('<owner>', 'Owner of the GitHub repository to run on (Example: NixOS)')
-  .argument('<repo>', 'Name of the GitHub repository to run on (Example: nixpkgs)')
-  .argument('<pr>', 'Number of the Pull Request to run on')
-  .action(async (owner, repo, pr, options) => {
-    const checkManualFileEdits = (await import('./manual-file-edits.js')).default
-    await run(checkManualFileEdits, owner, repo, pr, options)
-  })
-
-await program.parse()

ci/github-script/shell.nix

@@ -1,25 +0,0 @@
-{
-  system ? builtins.currentSystem,
-  pkgs ? (import ../. { inherit system; }).pkgs,
-}:
-
-pkgs.callPackage (
-  {
-    gh,
-    importNpmLock,
-    mkShell,
-    nodejs,
-  }:
-  mkShell {
-    packages = [
-      gh
-      importNpmLock.hooks.linkNodeModulesHook
-      nodejs
-    ];
-
-    npmDeps = importNpmLock.buildNodeModules {
-      npmRoot = ./.;
-      inherit nodejs;
-    };
-  }
-) { }