[staging] merge from staging-next (#370761)

.github/workflows/eval.yml

@@ -219,7 +219,7 @@ jobs:
   tag:
     name: Tag
     runs-on: ubuntu-latest
-    needs: process
+    needs: [ attrs, process ]
     if: needs.process.outputs.baseRunId
     permissions:
       pull-requests: write
@@ -239,6 +239,21 @@ jobs:
           name: comparison
           path: comparison
 
+      - name: Install Nix
+        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
+      # Important: This workflow job runs with extra permissions,
+      # so we need to make sure to not run untrusted code from PRs
+      - name: Check out Nixpkgs at the base commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.attrs.outputs.baseSha }}
+          path: base
+          sparse-checkout: ci
+
+      - name: Build the requestReviews derivation
+        run: nix-build base/ci -A requestReviews
+
       - name: Tagging pull request
         run: |
           # Get all currently set rebuild labels
@@ -271,20 +286,21 @@ jobs:
           # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
           # There appears to be no API to request reviews based on GitHub IDs
           jq -r 'keys[]' comparison/maintainers.json \
-            | while read -r id; do gh api /user/"$id"; done \
-            | jq -s '{ reviewers: map(.login) }' \
+            | while read -r id; do gh api /user/"$id" --jq .login; done \
+            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/process-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR" \
             > reviewers.json
 
           # Request reviewers from maintainers of changed output paths
           GH_TOKEN=${{ steps.app-token.outputs.token }} gh api \
             --method POST \
-            /repos/${{ github.repository }}/pulls/${{ github.event.number }}/requested_reviewers \
+            /repos/"$REPOSITORY"/pulls/"$NUMBER"/requested_reviewers \
             --input reviewers.json
 
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
           NUMBER: ${{ github.event.number }}
+          AUTHOR: ${{ github.event.pull_request.user.login }}
 
       - name: Add eval summary to commit statuses
         if: ${{ github.event_name == 'pull_request_target' }}

ci/request-reviews/default.nix

@@ -15,6 +15,7 @@ stdenvNoCC.mkDerivation {
     root = ./.;
     fileset = lib.fileset.unions [
       ./get-reviewers.sh
+      ./process-reviewers.sh
       ./request-reviews.sh
       ./verify-base-branch.sh
       ./dev-branches.txt

ci/request-reviews/get-reviewers.sh

@@ -1,27 +1,22 @@
 #!/usr/bin/env bash
 
-# Get the code owners of the files changed by a PR,
-# suitable to be consumed by the API endpoint to request reviews:
-# https://docs.github.com/en/rest/pulls/review-requests?apiVersion=2022-11-28#request-reviewers-for-a-pull-request
+# Get the code owners of the files changed by a PR, returning one username per line
 
 set -euo pipefail
 
 log() {
     echo "$@" >&2
 }
 
-if (( "$#" < 7 )); then
-    log "Usage: $0 GIT_REPO OWNERS_FILE BASE_REPO BASE_REF HEAD_REF PR_NUMBER PR_AUTHOR"
+if (( "$#" < 4 )); then
+    log "Usage: $0 GIT_REPO OWNERS_FILE BASE_REF HEAD_REF"
     exit 1
 fi
 
 gitRepo=$1
 ownersFile=$2
-baseRepo=$3
-baseRef=$4
-headRef=$5
-prNumber=$6
-prAuthor=$7
+baseRef=$3
+headRef=$4
 
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' exit
@@ -98,29 +93,4 @@ for file in "${touchedFiles[@]}"; do
 
 done
 
-# Cannot request a review from the author
-if [[ -v users[${prAuthor,,}] ]]; then
-    log "One or more files are owned by the PR author, ignoring"
-    unset 'users[${prAuthor,,}]'
-fi
-
-gh api \
-    -H "Accept: application/vnd.github+json" \
-    -H "X-GitHub-Api-Version: 2022-11-28" \
-    "/repos/$baseRepo/pulls/$prNumber/reviews" \
-    --jq '.[].user.login' > "$tmp/already-reviewed-by"
-
-# And we don't want to rerequest reviews from people who already reviewed
-while read -r user; do
-    if [[ -v users[${user,,}] ]]; then
-        log "User $user is a code owner but has already left a review, ignoring"
-        unset 'users[${user,,}]'
-    fi
-done < "$tmp/already-reviewed-by"
-
-# Turn it into a JSON for the GitHub API call to request PR reviewers
-jq -n \
-    --arg users "${!users[*]}" \
-    '{
-      reviewers: $users | split(" "),
-    }'
+printf "%s\n" "${!users[@]}"

ci/request-reviews/process-reviewers.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+# Process reviewers for a PR, reading line-separated usernames on stdin,
+# returning a JSON suitable to be consumed by the API endpoint to request reviews:
+# https://docs.github.com/en/rest/pulls/review-requests?apiVersion=2022-11-28#request-reviewers-for-a-pull-request
+
+set -euo pipefail
+
+log() {
+    echo "$@" >&2
+}
+
+if (( "$#" < 3 )); then
+    log "Usage: $0 BASE_REPO PR_NUMBER PR_AUTHOR"
+    exit 1
+fi
+
+baseRepo=$1
+prNumber=$2
+prAuthor=$3
+
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' exit
+
+declare -A users=()
+while read -r handle && [[ -n "$handle" ]]; do
+    users[$handle]=
+done
+
+# Cannot request a review from the author
+if [[ -v users[${prAuthor,,}] ]]; then
+    log "One or more files are owned by the PR author, ignoring"
+    unset 'users[${prAuthor,,}]'
+fi
+
+gh api \
+    -H "Accept: application/vnd.github+json" \
+    -H "X-GitHub-Api-Version: 2022-11-28" \
+    "/repos/$baseRepo/pulls/$prNumber/reviews" \
+    --jq '.[].user.login' > "$tmp/already-reviewed-by"
+
+# And we don't want to rerequest reviews from people who already reviewed
+while read -r user; do
+    if [[ -v users[${user,,}] ]]; then
+        log "User $user is a code owner but has already left a review, ignoring"
+        unset 'users[${user,,}]'
+    fi
+done < "$tmp/already-reviewed-by"
+
+for user in "${!users[@]}"; do
+    if ! gh api \
+        -H "Accept: application/vnd.github+json" \
+        -H "X-GitHub-Api-Version: 2022-11-28" \
+        "/repos/$baseRepo/collaborators/$user" >&2; then
+        log "User $user is not a repository collaborator, probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>), ignoring"
+        unset 'users[$user]'
+    fi
+done
+
+# Turn it into a JSON for the GitHub API call to request PR reviewers
+jq -n \
+    --arg users "${!users[*]}" \
+    '{
+      reviewers: $users | split(" "),
+    }'

ci/request-reviews/request-reviews.sh

@@ -78,7 +78,8 @@ if ! "$SCRIPT_DIR"/verify-base-branch.sh "$tmp/nixpkgs.git" "$headRef" "$baseRep
 fi
 
 log "Getting code owners to request reviews from"
-"$SCRIPT_DIR"/get-reviewers.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseRepo" "$baseBranch" "$headRef" "$prNumber" "$prAuthor" > "$tmp/reviewers.json"
+"$SCRIPT_DIR"/get-reviewers.sh "$tmp/nixpkgs.git" "$ownersFile" "$baseBranch" "$headRef" | \
+    "$SCRIPT_DIR"/process-reviewers.sh "$baseRepo" "$prNumber" "$prAuthor" > "$tmp/reviewers.json"
 
 log "Requesting reviews from: $(<"$tmp/reviewers.json")"
 

nixos/modules/profiles/minimal.nix

@@ -1,40 +1,46 @@
 # This module defines a small NixOS configuration.  It does not
 # contain any graphical stuff.
 
-{ config, lib, ... }:
-
-with lib;
-
 {
-  documentation.enable = mkDefault false;
-
-  documentation.doc.enable = mkDefault false;
-
-  documentation.info.enable = mkDefault false;
-
-  documentation.man.enable = mkDefault false;
-
-  documentation.nixos.enable = mkDefault false;
-
-  # Perl is a default package.
-  environment.defaultPackages = mkDefault [ ];
-
-  environment.stub-ld.enable = mkDefault false;
-
-  # The lessopen package pulls in Perl.
-  programs.less.lessopen = mkDefault null;
+  lib,
+  ...
+}:
+let
+  inherit (lib) mkDefault;
+in
+{
+  documentation = {
+    enable = mkDefault false;
+    doc.enable = mkDefault false;
+    info.enable = mkDefault false;
+    man.enable = mkDefault false;
+    nixos.enable = mkDefault false;
+  };
+
+  environment = {
+    # Perl is a default package.
+    defaultPackages = mkDefault [ ];
+    stub-ld.enable = mkDefault false;
+  };
+
+  programs = {
+    # The lessopen package pulls in Perl.
+    less.lessopen = mkDefault null;
+    command-not-found.enable = mkDefault false;
+  };
 
   # This pulls in nixos-containers which depends on Perl.
   boot.enableContainers = mkDefault false;
 
-  programs.command-not-found.enable = mkDefault false;
-
-  services.logrotate.enable = mkDefault false;
-
-  services.udisks2.enable = mkDefault false;
-
-  xdg.autostart.enable = mkDefault false;
-  xdg.icons.enable = mkDefault false;
-  xdg.mime.enable = mkDefault false;
-  xdg.sounds.enable = mkDefault false;
+  services = {
+    logrotate.enable = mkDefault false;
+    udisks2.enable = mkDefault false;
+  };
+
+  xdg = {
+    autostart.enable = mkDefault false;
+    icons.enable = mkDefault false;
+    mime.enable = mkDefault false;
+    sounds.enable = mkDefault false;
+  };
 }

nixos/modules/services/networking/unifi.nix

@@ -143,10 +143,10 @@ in
       restartTriggers = [ cfg.unifiPackage cfg.mongodbPackage ];
 
       serviceConfig = {
-        Type = "simple";
+        Type = "notify";
         ExecStart = "${cmd} start";
         ExecStop = "${cmd} stop";
-        Restart = "on-failure";
+        Restart = "always";
         TimeoutSec = "5min";
         User = "unifi";
         UMask = "0077";

nixos/modules/virtualisation/vmware-guest.nix

@@ -8,6 +8,7 @@ let
   inherit (lib)
     getExe'
     literalExpression
+    maintainers
     mkEnableOption
     mkIf
     mkOption
@@ -25,7 +26,7 @@ in
   ];
 
   meta = {
-    maintainers = [ lib.maintainers.kjeremy ];
+    maintainers = [ maintainers.kjeremy ];
   };
 
   options.virtualisation.vmware.guest = {

pkgs/applications/audio/greg/default.nix

@@ -14,7 +14,7 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "manolomartinez";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-o4+tXVJTgT52JyJOC+Glr2cvZjbTaZL8TIsmz+A4vE4=";
   };
 

pkgs/applications/audio/littlegptracker/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "djdiskmachine";
     repo = "littlegptracker";
-    rev = "refs/tags/${finalAttrs.version}";
+    tag = finalAttrs.version;
     hash = "sha256-1uXC5nJ63YguQuNIkuK0yx9lmrMBqw0WdlmCV8o11cE=";
   };
 

pkgs/applications/audio/pithos/default.nix

@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-3j6IoMi30BQ8WHK4BxbsW+/3XZx7rBFd47EBENa2GiQ=";
   };
 

pkgs/applications/audio/puddletag/default.nix

@@ -16,7 +16,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "puddletag";
     repo = "puddletag";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-oScT8YcQoDf2qZ+J7xKm22Sbfym3tkVUrWT5D2LU5e8=";
   };
 

pkgs/applications/audio/zynaddsubfx/default.nix

@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "refs/tags/${version}";
+    tag = version;
     fetchSubmodules = true;
     hash = "sha256-0siAx141DZx39facXWmKbsi0rHBNpobApTdey07EcXg=";
   };

pkgs/applications/editors/lapce/default.nix

@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "lapce";
     repo = "lapce";
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
     sha256 = "sha256-vBBYNHgZiW5JfGeUG6YZObf4oK0hHxTbsZNTfnIX95Y=";
   };
 

pkgs/applications/editors/manuskript/default.nix

@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     repo = pname;
     owner = "olivierkes";
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-/Ryvv5mHdZ3iwMpZjOa62h8D2B00pzknJ70DfjDTPPA=";
   };
 

pkgs/applications/editors/retext/default.nix

@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "retext-project";
     repo = pname;
-    rev = "refs/tags/${version}";
+    tag = version;
     hash = "sha256-BToW9rPFEbgAErvJ5gtUpNadCLtlRihE7eKKFgO5N68=";
   };