| Commit message (Expand) | Author | Age | Files | Lines |
|---|
| * | ci/nixf-diagnose: ignore prelude rules•••- avoid treewide cleanup due to these new rules
- invalid nix code was getting auto fixed
| Dyego Aurélio | 2026-01-22 | 1 | -0/+7 |
| * | ci/pinned: update•••This gives us nixfmt 1.2.0.
From the nixpkgs-unstable channel at revision bde09022887110deb780067364a0818e89258968.
Changes for nixfmt (1.1.0 → 1.2.0):
https://github.com/NixOS/nixfmt/compare/v1.1.0...v1.2.0
Changes for nixd (2.7.0 → 2.8.2):
https://github.com/nix-community/nixd/compare/2.7.0...2.8.2
Changes for treefmt-nix:
https://github.com/numtide/treefmt-nix/compare/5b4ee75aeefd1e2d5a1cc43cf6ba65eba75e83e4...e96d59dff5c0d7fddb9d113ba108f03c3ef99eca
Changes for zizmor (1.20.0 → 1.21.0):
https://github.com/zizmorcore/zizmor/compare/v1.20.0...v1.21.0
-------
ci/nixf-diagnose: update configuration
Update nixf-diagnose configuration as per numtide/treefmt-nix@0c445aa
The new config output should be semantically equivalent.
| Dyego Aurélio | 2026-01-22 | 1 | -11/+12 |
| * | ci: Don't run non-reproducible doc urls check•••Causes non-reproducible CI failures: https://github.com/NixOS/nixpkgs/actions/runs/21102527291/job/60688698991?pr=480436
| Silvan Mosberger | 2026-01-20 | 1 | -1/+0 |
| * | ci/treefmt: remove K3s test exclusion from yamlfmt•••Clean-up after 7a9fddc571050d80a9db9c909fe6a0193a2dc695.
| azey | 2025-12-11 | 1 | -2/+0 |
| * | ci/pinned: update•••This gives us:
- actionlint 1.7.9 to support ubuntu-slim runners
- editorconfig-checker 3.5.0
- Nix 2.32.4 to fix the performance regression for Eval from 2.32.2
From the nixpkgs-unstable channel:
https://hydra.nixos.org/build/314568999#tabs-buildinputs
Changes for treefmt-nix:
https://github.com/numtide/treefmt-nix/compare/4ef3dfdbb5ddfb9e39999a2f2b0c2637277859d4...5b4ee75aeefd1e2d5a1cc43cf6ba65eba75e83e4
| Wolfgang Walther | 2025-11-25 | 1 | -1/+6 |
| * | ci/github-script/bot: request reviewers•••This migrates the bash code to request reviewers to github-script. This
will allow multiple nice improvements later on, but at this stage it's
mostly a reduction in code and complexity.
| Wolfgang Walther | 2025-11-05 | 1 | -1/+0 |
| * | ci/treefmt: disable biome settings validation•••The treefmt-nix `biome.settings` validation uses inputs that are liable
to hash mismatch.
See https://github.com/numtide/treefmt-nix/pull/430
| Matt Sturgeon | 2025-11-05 | 1 | -0/+2 |
| * | Revert "ci/treefmt: disable biome for now"•••This reverts commit 66260cc8c48f38529c559ce9529d9398bc8d4837.
| Matt Sturgeon | 2025-11-05 | 1 | -6/+5 |
| * | ci/treefmt: disable biome for now•••Disable biome due to a hash mismatch with validation for the
`settings.formatter.biome.options` option.
See https://github.com/numtide/treefmt-nix/pull/430
| Matt Sturgeon | 2025-11-05 | 1 | -5/+6 |
| * | ci: add zizmor check and configuration•••`zizmor` is a tool that uses static analysis to find potential security
issues in GitHub Actions [0]. (Yes, it's a bit absurd that GitHub
made a CI system so complicated that tools like this were created, but
I digress.)
Given our increase in GHA usage recently, I think this is a good step
towards keeping our security posture in tip-top shape. (It also keeps
with the theme of automating as many things as possible!)
The rule related to the usages of dangerous-triggers have been disabled
to avoid false-positives. Explanations about the usage of
`pull_request_target` and expectations around its usage can be found in
`.github/workflows/README.md`.
[0]: https://woodruffw.github.io/zizmor/
Co-authored-by: Thomas Gerbet <thomas@gerbet.me>
| Winter | 2025-10-26 | 1 | -0/+2 |
| * | treewide: remove redundant parentheses•••Auto-fixed by nixf-diagnose.
| Wolfgang Walther | 2025-10-05 | 1 | -1/+0 |
| * | treewide: remove unused with•••Auto-fixed by nixf-diagnose.
| Wolfgang Walther | 2025-10-05 | 1 | -1/+4 |
| * | treewide: remove unused rec•••Auto-fix by nixf-diagnose.
| Wolfgang Walther | 2025-10-05 | 1 | -1/+0 |
| * | ci/treefmt: add nixf-diagnose•••This currently has plenty of failures, so we disable many checks. We can
now start working towards fixing these rules 1-by-1.
| Wolfgang Walther | 2025-10-05 | 1 | -0/+25 |
| * | nix_2_24: remove | Jörg Thalheim | 2025-08-27 | 1 | -1/+1 |
| * | ci: disable aliases in CI's pkgs instance•••This ensures we don't accidentally use aliases in the nixpkgs shell or
other places that depend on the CI-pinned pkgs instance.
Nixpkgs generally — and CI specifically — do not use aliases, because we
want to ensure they are not load-bearing and can be removed safely.
See: https://github.com/NixOS/nixpkgs/blob/ce9979ec1c/pkgs/top-level/release-outpaths.nix#L28
| Matt Sturgeon | 2025-08-21 | 1 | -1/+6 |
| * | ci: explicitly define `programs.nixfmt.package`•••Currently treefmt-nix is still defaulting `programs.nixfmt.package` to
the `nixfmt-rfc-style` alias. This makes sense, as they do not know for
certain which revision of nixpkgs is in use.
We do know, however, so we can explicitly use the non-alias name.
| Matt Sturgeon | 2025-08-21 | 1 | -1/+4 |
| * | ci: reformat comment•••Use one sentence per line.
| Matt Sturgeon | 2025-08-21 | 1 | -2/+1 |
| * | ci/nixpkgs-vet: use Nix 2.30+ inside sandbox•••This should fix the random symlink creation errors.
| Wolfgang Walther | 2025-08-21 | 1 | -1/+3 |
| * | ci/treefmt: enable biome for doc/ | Wolfgang Walther | 2025-08-20 | 1 | -1/+1 |
| * | ci/treefmt: add biome for .js files•••This excludes doc and pkgs folders, because there are way too many files
to fix at the moment.
| Wolfgang Walther | 2025-08-20 | 1 | -0/+16 |
| * | nix_2_3: drop•••This has been marked insecure a while ago, as some CVEs have not been
backported. Even if *some* CVEs are fixed, we'd need **all** of them to
be, to get it back into the cache.
Not having it in the cache means, we can not test it in CI. This means
we can't make sure to actually support this version to evaluate Nixpkgs.
| Wolfgang Walther | 2025-08-12 | 1 | -7/+1 |
| * | nixVersions.minimum: drop•••The concept of this alias becomes questionable once we move past 2.18,
where Lix was forked. We should probably move to a feature-detection
based approach for lib/minver.nix eventually, too.
| Wolfgang Walther | 2025-08-12 | 1 | -2/+1 |
| * | workflows/eval: test all available versions•••With this change, we start running Eval on all available Lix and Nix
versions. Because this requires a lot of resources, this complete test
is only run when `ci/pinned.json` is updated.
The resulting outpaths are checked for consistency with the target
branch. A difference will cause the `report` job to fail, thus blocking
the merge, ensuring Eval consistency for Nixpkgs across different
versions.
This implements a kind of "ratchet style" check: Since we originally
confirmed that the versions currently in Nixpkgs at the time of this
commit match Eval behavior of Nix 2.3, we can ensure consistency with
Nix 2.3 down the road, even without testing for it explicitly.
There had been one regression in Eval consistency for Nix between 2.18
and 2.24 - two tests in `tests.devShellTools` produce different results
between Lix 2.91+ (which was forked from Nix 2.18) and Nix 2.24+. I
assume it's unlikely that such a change would be "fixed" by now, thus I
added an exception for these.
As a bonus, we also present the total time in seconds it takes for Eval
to complete for every tested version in a summary table. This allows us
to easily see performance improvements for Eval due to version updates.
At this stage, this time only includes the "outpaths" step of Eval, but
not the generation of attrpaths beforehand.
| Wolfgang Walther | 2025-08-12 | 1 | -1/+2 |
| * | workflows: checkout pinned nixpkgs explicitly•••This is slightly faster than downloading and extracting a tarball and
additionally allows a sparse checkout. No need to download docs or nixos
for our purpose.
The data is quite noisy, but suggests improvements from anywhere between
5-15 seconds for each job using the pinned nixpkgs.
| Wolfgang Walther | 2025-08-11 | 1 | -2/+2 |
| * | ci/treefmt: add markdown-code-runner•••This was run as a test in `doc/tests/check-nix-code-blocks.nix` before,
but its DX can be improved: By including it in `treefmt` we get better
error reporting and auto-fixing, as well as running it on *all* markdown
files (including READMEs etc.) for free.
| Wolfgang Walther | 2025-08-05 | 1 | -0/+17 |
| * | ci/tarball: build with Nix 2.30•••We had to avoid 2.28 / 2.29 due to performance regressions, but this
should work well again with Nix 2.30.
| Wolfgang Walther | 2025-08-05 | 1 | -3/+1 |
| * | ci/parse: raise minimum test to Nix 2.24•••Nix 2.3 is marked as insecure and thus not cached anymore.
We'll either need to patch it and cache it again or drop it.
| Wolfgang Walther | 2025-07-24 | 1 | -1/+2 |
| * | workflows/build: build nixpkgs tarball•••This adds a build job for the tarball, which might help uncover eval
issues on attributes not normally touched by Eval, aka those added in
`pkgs/top-level/packages-config.nix`.
| Wolfgang Walther | 2025-07-24 | 1 | -1/+15 |
| * | treewide: nixfmt-rfc-style -> nixfmt•••Except:
- Instances in documentation, because people in older versions
can't switch to nixfmt yet due to it having pointed to nixfmt-classic
before
- In code that runs based on a CI Nixpkgs version, which is also a bit
older still
- In update script shebangs, because many of them don't pin Nixpkgs, and run
with whatever is in NIX_PATH (and it's not easy to fix this, see
https://github.com/NixOS/nixpkgs/issues/425551)
| Silvan Mosberger | 2025-07-15 | 1 | -1/+1 |
| * | nixVersions.nix_2_3: add knownVulnerabilities | Alyssa Ross | 2025-06-30 | 1 | -1/+3 |
| * | ci/treefmt: add yamlfmt•••Most workflow files are already well formatted, but to make it easier to
keep it that way, we can add yamlfmt.
I personally have a preference for non-indented arrays for YAML, but
wanted to avoid bigger diffs here - the status-quo clearly are indented
arrays.
Some changes are made manually to the get-merge-commit action and the
issue templates. Those would otherwise make yamlfmt misbehave on those.
| Wolfgang Walther | 2025-06-12 | 1 | -0/+15 |
| * | ci/eval: accept `nix` directly•••Previously we were taking nixVersions and this made external use from
the Lix repo's CI annoying.
We should probably also test other nix versions than stable (i.e. also
latest and Lix), but this involves writing GitHub Actions about it and
maybe not running it on every single PR. Future work.
| Jade Lovelace | 2025-06-10 | 1 | -1/+7 |
| * | ci/pinned: manage nixpkgs and treefmt-nix with npins•••Instead of rolling our own update script which only works for a single
pin, let's use npins. We can then use it for the treefmtNix pin as well,
which was mostly unmaintained, so far.
| Wolfgang Walther | 2025-06-02 | 1 | -6/+5 |
| * | workflows/manual-nixpkgs: build nixpkgs manual on staging and stable branches•••By using the pinned nixpkgs we have for CI, we can lift the restriction
of building the nixpkgs manual only in PRs targeting master.
At the same time, this uses the pinned nixpkgs for the doc/ folder's dev
shell. This allows entering that shell while working on a staging-based
branch and write documentation.
Why should staging be un(der)documented, after all?
Note: The package that is available in nixpkgs as pkgs.nixpkgs-manual
will still be built with the current nixpkgs checkout, not the pinned
version. This is the same that hydra builds.
| Wolfgang Walther | 2025-05-29 | 1 | -2/+2 |
| * | workflows/nixpkgs-vet: use nixpkgs-vet from pinned nixpkgs•••We have added nixpkgs-vet as a regular package to nixpkgs a while ago,
so we can now use it from pinned nixpkgs. This avoids pulling a
platform-specific binary version from upstream.
This change also allows to run the tool easily locally, the same way as
other tools:
nix-build ci -A nixpkgs-vet
This will do a full check of the repo with the exception of
nixpkgs-vet's "ratchet" checks: Those depend on having two branches to
compare, but the default is to only look at the head branch. Those
ratchet checks will still be run in CI, though.
| Wolfgang Walther | 2025-05-25 | 1 | -0/+1 |
| * | workflows/check-format: run on all files•••This was run on .nix files only, but we recently added keep-sorted,
editorconfig-checker and actionlint to treefmt, so CI needs to check all
files instead.
| Wolfgang Walther | 2025-05-13 | 1 | -4/+1 |
| * | workflows/check-format: add actionlint (#406114) | Jörg Thalheim | 2025-05-11 | 1 | -0/+2 |
| |\ |
|
| | * | workflows/check-format: add actionlint•••I added a lint-action.sh script in .github/workflows a while ago while
fixing some warnings. But I haven't run it myself ever since. This needs
to be part of CI to make any use of it.
| Wolfgang Walther | 2025-05-11 | 1 | -0/+2 |
| * | | ci: allow running jobs locally (#404466) | Jörg Thalheim | 2025-05-11 | 1 | -0/+12 |
| |\ \
| |/
|/| |
|
| | * | ci/parse: test for nix 2.3 and lix•••This adds the minimum nix version and the latest lix version to the
matrix of parse checks. Especially the minimum nix version is relevant,
because parsing routinely breaks because of introduction of newer
syntax.
Adding lix just completes the picture.
| Wolfgang Walther | 2025-05-11 | 1 | -0/+2 |
| | * | ci/parse: init•••The nix-parse workflow can now be run locally the same way as in CI.
To do this, the CI's workflow was slightly adjusted. Instead of testing
only the changed files, we're now testing all files in the repository.
This is possible in two ways:
1. By calling nix-instantiate once with all files as arguments. This
will be rather fast, but only the first error is shown before it errors
out.
2. By calling nix-instantiate once for each file. This will be much
slower, but has the advantage that we see all errors at once.
To avoid running the long variant every time, we first do a quick check
with the fast version. If that fails, we run the slower one to report
the errors. This gives us the best of both.
| Wolfgang Walther | 2025-05-11 | 1 | -0/+3 |
| | * | ci/shell: init•••The dev shell can now be built locally the same way as in CI with:
nix-build ci -A shell
| Wolfgang Walther | 2025-05-10 | 1 | -0/+1 |
| | * | ci/manual-nixpkgs: init•••The Nixpkgs manual can now be built locally the same way as in CI with:
nix-build ci -A manual-nixpkgs -A manual-nixpkgs-tests
| Wolfgang Walther | 2025-05-10 | 1 | -0/+2 |
| | * | ci/manual-nixos: init•••The NixOS manual can now be built locally the same way as in CI with:
nix-build ci -A manual-nixos
| Wolfgang Walther | 2025-05-10 | 1 | -0/+1 |
| | * | ci/lib-tests: init•••This allows running the lib-tests locally in exactly the same way that
they are run in CI:
nix-build ci -A lib-tests
| Wolfgang Walther | 2025-05-09 | 1 | -0/+3 |
| * | | workflows/keep-sorted: drop and move to treefmt•••Same reasoning as the commit before, but keep-sorted has even less
overhead than editorconfig-checker. Benchmark has it at 1 second per
run.
| Wolfgang Walther | 2025-05-09 | 1 | -0/+2 |
| * | | workflows/editorconfig: drop and move to treefmt•••We already have treefmt running for nixfmt, so it's easy to just add
another formatter to it. This gives a much better UX, because all
formatting errors are reported through the same channel.
It also saves us one CI job, which takes most of the time to just set up
the machine, clone the repo and download Nix - while doing a minimum of
actual work.
Total execution time for treefmt is ~10% slower:
- 38s only nixfmt
- 43s nixfmt + editorconfig-checker
| Wolfgang Walther | 2025-05-09 | 1 | -0/+7 |
| |/ |
|
| * | workflows/check-nix-format: Enforce formatting on all files•••Changes the Nix format checking workflow to now strictly enforce
formatting of all Nix files using the treefmt setup introduced
in the pre-previous commit.
This is in [accordance with the approved RFC 166](https://github.com/NixOS/rfcs/blob/master/rfcs/0166-nix-formatting.md#reformat-nixpkgs).
Note that the "skip treewide" thing is no longer necessary, already
before, because there's nothing that would fail for treewide changes.
Previously the problem was that the GitHub API would be bombarded.
| Silvan Mosberger | 2025-04-01 | 1 | -0/+9 |
| * | flake.nix: Set formatter•••This enables `nix fmt`, though it won't be practically usable without
also reformatting all files, which is done in a following commit.
| Silvan Mosberger | 2025-04-01 | 1 | -0/+1 |
