push sheeet

.github/ISSUE_TEMPLATE.md

@@ -0,0 +1,6 @@
+<!--
+    Please note: This blank issue template is meant for extraordinary issues
+    that do not fit the templates. Unless you know your issue is relevant to
+    Nixpkgs and requires the free-form blank issue, please use the issue
+    templates instead.
+-->

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -0,0 +1,143 @@
+name: "Bug report (package)"
+description: "Create a generic bug report against a package."
+title: "PACKAGENAME: BUG TITLE"
+labels: ["0.kind: bug"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Welcome to Nixpkgs. Please replace the **`PACKAGENAME: BUG TITLE`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) and a short title summarising what the bug entails.
+
+        > [!TIP]
+        > For instance, if you were filing a bug against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it failing to launch on ARM Linux, your title would be as follows:
+        > ```
+        > hello: fails to launch on aarch64-linux
+        > ```
+
+        ---
+  - type: "dropdown"
+    id: "version"
+    attributes:
+      label: "Nixpkgs version"
+      description: |
+        What version of Nixpkgs are you using?
+
+        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
+      options:
+        - "Please select a version."
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+      default: 0
+    validations:
+      required: true
+  - type: "textarea"
+    id: "description"
+    attributes:
+      label: "Describe the bug"
+      description: "Please include a clear and concise description of what the issue is."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "how-to-reproduce"
+    attributes:
+      label: "Steps to reproduce"
+      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
+    validations:
+      required: true
+  - type: "input"
+    id: "expected-behaviour"
+    attributes:
+      label: "Expected behaviour"
+      description: "Please write a concise description of what was supposed to happen."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "screenshots"
+    attributes:
+      label: "Screenshots"
+      description: |
+        If applicable, add screenshots to help explain your problem.
+        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
+    validations:
+      required: false
+  - type: "textarea"
+    id: "logs"
+    attributes:
+      label: "Relevant log output"
+      description: |
+        If applicable, copy and paste any relevant log output.
+        This will be automatically formatted into code, so no need for backticks.
+      render: "console"
+    validations:
+      required: false
+  - type: "textarea"
+    id: "additional-context"
+    attributes:
+      label: "Additional context"
+      description: "Add any other context about the problem here."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "metadata"
+    attributes:
+      label: "System metadata"
+      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      description: |
+        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
+      options:
+        - label: "I assert that this is a bug and not a support request."
+          required: true
+        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+-label%3A%226.topic%3A+darwin%22+-label%3A%226.topic%3A+nixos%22). "
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve Nixpkgs!
+
+        ---
+  - type: "textarea"
+    id: "prioritisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -0,0 +1,157 @@
+name: "Bug report (macOS)"
+description: "Create a bug report against a package where the issue only occurs on macOS."
+title: "PACKAGENAME: BUG TITLE"
+labels: ["0.kind: bug", "6.topic: darwin"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Welcome to Nixpkgs. Please replace the **`PACKAGENAME: BUG TITLE`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) and a short title summarising what the bug entails.
+
+        > [!TIP]
+        > For instance, if you were filing a bug against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it failing to launch on Apple Silicon, your title would be as follows:
+        > ```
+        > hello: fails to launch on aarch64-darwin
+        > ```
+
+        ---
+  - type: "dropdown"
+    id: "version"
+    attributes:
+      label: "Nixpkgs version"
+      description: |
+        What version of Nixpkgs are you using?
+
+        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
+      options:
+        - "Please select a version."
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+      default: 0
+    validations:
+      required: true
+  - type: "textarea"
+    id: "description"
+    attributes:
+      label: "Describe the bug"
+      description: "Please include a clear and concise description of what the issue is."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "how-to-reproduce"
+    attributes:
+      label: "Steps to reproduce"
+      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
+    validations:
+      required: true
+  - type: "input"
+    id: "expected-behaviour"
+    attributes:
+      label: "Expected behaviour"
+      description: "Please write a concise description of what was supposed to happen."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "screenshots"
+    attributes:
+      label: "Screenshots"
+      description: |
+        If applicable, add screenshots to help explain your problem.
+        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
+    validations:
+      required: false
+  - type: "textarea"
+    id: "logs"
+    attributes:
+      label: "Relevant log output"
+      description: |
+        If applicable, copy and paste any relevant log output.
+        This will be automatically formatted into code, so no need for backticks.
+      render: "console"
+    validations:
+      required: false
+  - type: "textarea"
+    id: "additional-context"
+    attributes:
+      label: "Additional context"
+      description: "Add any other context about the problem here."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "metadata"
+    attributes:
+      label: "System metadata"
+      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
+    validations:
+      required: true
+  - type: "dropdown"
+    id: "nix-darwin"
+    attributes:
+      label: "Are you using nix-darwin?"
+      description: |
+        [`nix-darwin`](https://github.com/LnL7/nix-darwin) is a set of NixOS-like modules for macOS systems. Depending on your issue, this information may be relevant.
+      options:
+        - "Yes, I am using nix-darwin."
+        - "No, I am not using nix-darwin."
+      default: 1
+    validations:
+      required: true
+  - type: "textarea"
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
+
+        If this issue is related to the Darwin packaging architecture as a whole, or is related to the core Darwin frameworks, consider mentioning the `@NixOS/darwin-core` team.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      description: |
+        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs/NixOS, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
+      options:
+        - label: "I assert that this is a bug and not a support request."
+          required: true
+        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+darwin%22). "
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve Nixpkgs!
+
+        ---
+  - type: "textarea"
+    id: "prioritisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -0,0 +1,147 @@
+name: "Bug report (NixOS module)"
+description: "Create a bug report against a NixOS Module."
+title: "nixos/MODULENAME: BUG TITLE"
+labels: ["0.kind: bug", "6.topic: nixos"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Welcome to Nixpkgs. Please replace the **`nixos/MODULENAME: BUG TITLE`** template above with the correct module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)) and a short title summarising what the bug entails.
+
+        > [!TIP]
+        > For instance, if you were filing a bug against the [`systemd-boot`](https://search.nixos.org/options?channel=unstable&show=boot.loader.systemd-boot.enable&from=0&size=1) module about it failing to install [`memtest86`](https://search.nixos.org/options?channel=unstable&show=boot.loader.systemd-boot.memtest86.enable&from=0&size=1), your title would be as follows:
+        > ```
+        > nixos/systemd-boot: fails to install memtest86
+        > ```
+
+        ---
+  - type: "dropdown"
+    id: "version"
+    attributes:
+      label: "Nixpkgs version"
+      description: |
+        What version of Nixpkgs are you using?
+
+        If you are using an older version, please update to the latest stable version and check if the issue persists before continuing this bug report.
+      options:
+        - "Please select a version."
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+      default: 0
+    validations:
+      required: true
+  - type: "textarea"
+    id: "description"
+    attributes:
+      label: "Describe the bug"
+      description: "Please include a clear and concise description of what the issue is."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "how-to-reproduce"
+    attributes:
+      label: "Steps to reproduce"
+      description: "Please include a step-by-step guide for reproducing this issue. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
+    validations:
+      required: true
+  - type: "input"
+    id: "expected-behaviour"
+    attributes:
+      label: "Expected behaviour"
+      description: "Please write a concise description of what was supposed to happen."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "screenshots"
+    attributes:
+      label: "Screenshots"
+      description: |
+        If applicable, add screenshots to help explain your problem.
+        If you need help uploading images to GitHub, please review the [relevant documentation](https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#uploading-assets).
+    validations:
+      required: false
+  - type: "textarea"
+    id: "logs"
+    attributes:
+      label: "Relevant log output"
+      description: |
+        If applicable, copy and paste any relevant log output.
+        This will be automatically formatted into code, so no need for backticks.
+      render: "console"
+    validations:
+      required: false
+  - type: "textarea"
+    id: "additional-context"
+    attributes:
+      label: "Additional context"
+      description: "Add any other context about the problem here."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "metadata"
+    attributes:
+      label: "System metadata"
+      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the `meta.maintainers` list of the offending module. This is done by prefixing the person's username with an '@' character. You can quickly go to the source code of a module by searching for it on the [NixOS Option Search](https://search.nixos.org/options) and clicking the "Declared in..." button.
+
+        Please note that the maintainer attribute name does not always match the maintainer's GitHub username. If that occurs, try looking in [`maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix) for the maintainer attribute name, and checking if the maintainer has a listed GitHub username.
+
+        If in doubt, check the associated package's maintainers. Please add the mentions above the `---` characters.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      description: |
+        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
+      options:
+        - label: "I assert that this is a bug and not a support request."
+          required: true
+        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+bug%22+label%3A%226.topic%3A+nixos%22). "
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve Nixpkgs!
+
+        ---
+  - type: "textarea"
+    id: "prioritisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -0,0 +1,153 @@
+name: "Build failure"
+description: "Report a package that is failing to build."
+title: "Build failure: PACKAGENAME"
+labels: ["0.kind: build failure"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Welcome to Nixpkgs. Please replace the **`Build failure: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
+
+        > [!TIP]
+        > For instance, if you were filing a build failure against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package, your title would be as follows:
+        > ```
+        > Build failure: hello
+        > ```
+
+        ---
+  - type: "dropdown"
+    id: "version"
+    attributes:
+      label: "Nixpkgs version"
+      description: |
+        In what version of Nixpkgs did the build failure occur?
+
+        If you are using an older version, please update to the latest stable version and check if the build failure persists before continuing this report.
+
+        If you are purposefully trying to build an ancient version of a package in an older Nixpkgs, please coordinate with the [NixOS Archivists](https://matrix.to/#/#archivists:nixos.org).
+      options:
+        - "Please select a version."
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+      default: 0
+    validations:
+      required: true
+  - type: "textarea"
+    id: "how-to-reproduce"
+    attributes:
+      label: "Steps to reproduce"
+      description: "Please include a step-by-step guide for reproducing this build failure. Consider writing in concise, numbered bullet points to ensure that Nixpkgs developers can retrace your steps."
+    validations:
+      required: true
+  - type: "dropdown"
+    id: "hydra"
+    attributes:
+      label: "Can Hydra reproduce this build failure?"
+      description: |
+        Can [Hydra](https://hydra.nixos.org), Nixpkgs' Continuous Integration system, reproduce this build failure?
+        Please use the search function in the header bar to locate the last build job for the package in question.
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
+          You can still open a build failure report, but please say '**No, Hydra cannot reproduce this build failure.**' below.
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
+        - If Hydra isn't supposed to build the package at all, say '**Hydra doesn’t try to build the package.**'
+      options:
+        - "Please select the Hydra Status."
+        - "Yes, Hydra can reproduce this build failure."
+        - "No, Hydra cannot reproduce this build failure."
+        - "Hydra is currently rebuilding this package."
+        - "The last build job was manually cancelled."
+        - "Hydra doesn’t try to build the package."
+      default: 0
+    validations:
+      required: true
+  - type: "input"
+    id: "hydra-logs"
+    attributes:
+      label: "Link to Hydra build job"
+      description: "If you answered 'yes' in the question above, please copy-and-paste the link to the failing Hydra job here."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "logs"
+    attributes:
+      label: "Relevant log output"
+      description: |
+        Please copy and paste the logs from the failed build.
+        This will be automatically formatted into code, so no need for backticks.
+      render: "console"
+    validations:
+      required: true
+  - type: "textarea"
+    id: "additional-context"
+    attributes:
+      label: "Additional context"
+      description: "Add any other context about the problem here."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "metadata"
+    attributes:
+      label: "System metadata"
+      description: "Please run `nix-shell -p nix-info --run \"nix-info -m\"` on a terminal and paste the output of that command here."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      description: |
+        This bug tracker is for actionable issues that are not the result of user error. If you need help using your system and are unsure if this is a bug with Nixpkgs, please consider asking for help on the [NixOS Discourse](https://discourse.nixos.org/) or the [NixOS Matrix Space](https://matrix.to/#/#community:nixos.org) before opening an issue.
+      options:
+        - label: "I assert that this is a bug and not a support request."
+          required: true
+        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%220.kind%3A+build+failure%22). "
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve Nixpkgs!
+
+        ---
+  - type: "textarea"
+    id: "prioritisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -0,0 +1,126 @@
+name: "Request: package update"
+description: "Create an update request for an existing, but outdated package."
+title: "Update Request: PACKAGENAME OLDVERSION → NEWVERSION"
+labels: ["0.kind: enhancement", "9.needs: package (update)"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Welcome to Nixpkgs. Please replace the **`Update Request: PACKAGENAME OLDVERSION → NEWVERSION`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)), the current version of the package, and the latest version of the package.
+
+        > [!TIP]
+        > For instance, if you were filing a request against the out of date `hello` package, where the current version in Nixpkgs is 1.0.0, but the latest version upstream is 1.0.1, your title would be as follows:
+        > ```
+        > Update Request: hello 1.0.0 → 1.0.1
+        > ```
+
+        ---
+  - type: "dropdown"
+    id: "version"
+    attributes:
+      label: "Nixpkgs version"
+      description: |
+        What version of Nixpkgs are you using?
+
+        If you are using an older or stable version, please update to the latest **unstable** version and check if the package is still out of date.
+
+        If the package has been updated in unstable, but you believe the update should be backported to the stable release of Nixpkgs, please file the '**Request: backport to stable**' form instead.
+      options:
+        - "Please select a version."
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+      default: 0
+    validations:
+      required: true
+  - type: "input"
+    id: "name"
+    attributes:
+      label: "Package name"
+      description: "Please indicate the name of the package."
+    validations:
+      required: true
+  - type: "input"
+    id: "upstream-version"
+    attributes:
+      label: "Upstream version"
+      description: "Please indicate the latest version of the package."
+    validations:
+      required: true
+  - type: "input"
+    id: "nixpkgs-version"
+    attributes:
+      label: "Nixpkgs version"
+      description: |
+        Please indicate the current version number in Nixpkgs' **unstable** channel. You can check this by setting the [NixOS Package Search](https://search.nixos.org/packages?channel=unstable) channel to 'unstable' and searching for the package.
+        If you meant to request an upgrade in the stable channel, please file the '**Request: backport to stable**' form instead.
+    validations:
+      required: true
+  - type: "input"
+    id: "changelog"
+    attributes:
+      label: "Changelog"
+      description: "If applicable, please link the upstream changelog for the latest version."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "additional-context"
+    attributes:
+      label: "Additional context"
+      description: "Add any other context about the update here."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      options:
+        - label: "I assert that this package update does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+package+%28update%29%22) or in [Nixpkgs Unstable](https://search.nixos.org/packages?channel=unstable)."
+          required: true
+        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%229.needs%3A+package+%28update%29%22)."
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve Nixpkgs!
+
+        ---
+  - type: "textarea"
+    id: "prioritisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -0,0 +1,101 @@
+name: "Request: NixOS module"
+description: "Create a new NixOS Module request for an existing package."
+title: "Module Request: nixos/MODULENAME"
+labels: ["0.kind: enhancement", "6.topic: nixos", "9.needs: module (new)"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Welcome to Nixpkgs. Please replace the **`Module Request: nixos/MODULENAME`** template above with the correct module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)).
+
+        > [!TIP]
+        > For instance, if you were filing a request against the missing `hello` module, your title would be as follows:
+        > ```
+        > Module Request: nixos/hello
+        > ```
+
+        ---
+  - type: "dropdown"
+    id: "version"
+    attributes:
+      label: "Nixpkgs version"
+      description: |
+        What version of Nixpkgs are you using?
+
+        If you are using an older or stable version, please update to the latest **unstable** version and check if the module still does not exist before continuing this request.
+      options:
+        - "Please select a version."
+        - "- Unstable (25.11)"
+        - "- Stable (25.05)"
+      default: 0
+    validations:
+      required: true
+  - type: "textarea"
+    id: "description"
+    attributes:
+      label: "Describe the proposed module"
+      description: "Please include a clear and concise description of what the module should accomplish."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "additional-context"
+    attributes:
+      label: "Additional context"
+      description: "Add any other context about the proposed module here."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      options:
+        - label: "I assert that this module does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+is%3Apr+label%3A%228.has%3A+module+%28new%29%22) or in [NixOS Unstable](https://search.nixos.org/options?channel=unstable)."
+          required: true
+        - label: "I assert that this is not a [duplicate of an existing issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%229.needs%3A+module+%28new%29%22). "
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve NixOS!
+
+        ---
+  - type: "textarea"
+    id: "prioritisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/07_backport_request.yml

@@ -0,0 +1,107 @@
+name: "Request: backport to stable"
+description: "Create a backport request for a package that is up-to-date in the unstable channel, but outdated in the stable channel."
+title: "Backport to Stable: PACKAGENAME OLDVERSION → NEWVERSION"
+labels: ["0.kind: enhancement", "9.needs: port to stable"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        > [!CAUTION]
+        > **Before you begin:** Be advised that backports are subject to the [release suitability guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).
+        >
+        > Stable releases of Nixpkgs do not receive breaking changes, which include major package updates that have incompatible API changes and break backwards compatibility. In the [Semantic Versioning standard](https://semver.org/), this is the first version number (1.X.X).
+        >
+        > Generally, only minor package updates, such as security patches, bug fixes and feature additions (but not removals!) will be considered for backporting. Please read the rules above carefully before filing this backport request.
+
+        Welcome to Nixpkgs. Please replace the **`Backport to Stable: PACKAGENAME OLDVERSION → NEWVERSION`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)), the current version of the package in Nixpkgs Stable and the current version of the package in Nixpkgs Unstable.
+
+        > [!TIP]
+        > For instance, if you were filing a request against the out of date `hello` package, where the current version in Nixpkgs Unstable is 1.0.1, but the current version in Nixpkgs Stable is 1.0.0, your title would be as follows:
+        > ```
+        > Backport to Stable: hello 1.0.0 → 1.0.1
+        > ```
+
+        ---
+  - type: "input"
+    id: "name"
+    attributes:
+      label: "Package name"
+      description: "Please indicate the name of the package."
+    validations:
+      required: true
+  - type: "input"
+    id: "unstable-version"
+    attributes:
+      label: "Version in unstable"
+      description: "Please indicate the current version of the package in the unstable channel."
+    validations:
+      required: true
+  - type: "input"
+    id: "stable-version"
+    attributes:
+      label: "Version in stable"
+      description: "Please indicate the current version of the package in the stable channel."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "reasoning"
+    attributes:
+      label: "Reasoning for backport"
+      description: "Please briefly explain why this backport fits the [release suitability guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases) and why you think this update should be backported."
+    validations:
+      required: false
+  - type: "textarea"
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      options:
+        - label: "I assert that this backport does not yet exist in an [open pull request](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+in%3Atitle+backport)."
+          required: true
+        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+port+to+stable%22+)."
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve Nixpkgs!
+
+        ---
+  - type: "textarea"
+    id: "prioritisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/08_documentation_request.yml

@@ -0,0 +1,89 @@
+name: "Request: documentation"
+description: "Report missing or incorrect documentation in the NixOS or Nixpkgs manuals."
+title: "Missing Documentation: PACKAGENAME"
+labels: ["0.kind: enhancement", "9.needs: documentation"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Welcome to Nixpkgs. Please replace the **`Missing Documentation: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)) or module name (As seen in the [NixOS Option Search](https://search.nixos.org/options)).
+
+        > [!TIP]
+        > For instance, if you were filing an issue against the [`hello`](https://search.nixos.org/packages?channel=unstable&from=0&size=1&buckets=%7B%22package_attr_set%22%3A%5B%22No%20package%20set%22%5D%2C%22package_license_set%22%3A%5B%22GNU%20General%20Public%20License%20v3.0%20or%20later%22%5D%2C%22package_maintainers_set%22%3A%5B%5D%2C%22package_platforms%22%3A%5B%5D%7D&sort=relevance&type=packages&query=hello) package about it not having any NixOS-specific documentation, your title would be as follows:
+        > ```
+        > Missing Documentation: hello
+        > ```
+
+        ---
+  - type: "textarea"
+    id: "description"
+    attributes:
+      label: "Describe the problem"
+      description: "Please include a clear and concise description of what the issue is."
+    validations:
+      required: true
+  - type: "textarea"
+    id: "proposal"
+    attributes:
+      label: "Proposed solution"
+      description: |
+        If possible, please draft a tentative documentation chapter to resolve this issue.
+        Your proposal should be written in CommonMark Markdown, optionally enhanced with [Nix-specific extensions](https://github.com/NixOS/nixpkgs/tree/master/doc#syntax).
+      render: "markdown"
+    validations:
+      required: false
+  - type: "textarea"
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      options:
+        - label: "I assert that this request is not already implemented in the latest [NixOS](https://nixos.org/manual/nixos/unstable/) or [Nixpkgs](https://nixos.org/manual/nixpkgs/unstable/) manuals."
+          required: true
+        - label: "I assert that this is not a [duplicate of an existing documentation issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+label%3A%229.needs%3A+documentation%22)."
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve Nixpkgs!
+
+        ---
+  - type: "textarea"
+    id: "priorisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/09_unreproducible_package.yml

@@ -0,0 +1,159 @@
+name: "Unreproducible Package"
+description: "Report a package that does not produce a bit-by-bit reproducible result each time it is built."
+title: "Unreproducible Package: PACKAGENAME"
+labels: ["0.kind: enhancement", "6.topic: reproducible builds"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Welcome to Nixpkgs. Please replace the **`Unreproducible Package: PACKAGENAME`** template above with the correct package name (As seen in the [NixOS Package Search](https://search.nixos.org/packages)).
+
+        > [!NOTE]
+        > This form is for reporting unreproducible packages. For more information, see the [Reproducible Builds Status](https://reproducible.nixos.org/) page.
+        >
+        > To report a package that fails to build entirely, please use the "Build Failure" form instead.
+
+        ---
+  - type: "input"
+    id: "version"
+    attributes:
+      label: "Nixpkgs Revision"
+      description: "In which commit of Nixpkgs is this package displaying unreproducibility?"
+  - type: "textarea"
+    id: "introduction"
+    attributes:
+      label: "Introduction"
+      description: |
+        This is a generic introduction to build reproducibility.
+        Please replace **PACKAGENAME** below with the canonical package name of the package, as you have done for the title above.
+      value: |
+        Building **PACKAGENAME** multiple times does not yield bit-by-bit identical
+        results, complicating the detection of Continuous Integration (CI) breaches. For
+        more information on this issue, visit [reproducible-builds.org](https://reproducible-builds.org/).
+
+        Fixing bit-by-bit reproducibility also has additional advantages, such as
+        avoiding hard-to-reproduce bugs, making content-addressed storage more effective
+        and reducing rebuilds in such systems.
+    validations:
+      required: true
+  - type: "textarea"
+    id: "how-to-reproduce"
+    attributes:
+      label: "Steps to reproduce"
+      description: |
+        This is a step-by-step instruction set meant for maintainers to debug the package that is failing to reproduce. You should also follow it to gather the `diffoscope` logs that will be needed below.
+        Please replace **PACKAGENAME** below with the canonical package name of the package, as you have done for the introduction and the title above.
+      value: |
+        ### 1. Build the package
+
+        This step will build the package. Specific arguments are passed to the command
+        to keep the build artifacts so we can compare them in case of differences.
+
+        Execute the following command:
+
+        ```
+        nix-build '<nixpkgs>' -A PACKAGENAME && nix-build '<nixpkgs>' -A PACKAGENAME --check --keep-failed
+        ```
+
+        Or using the new command line style:
+
+        ```
+        nix build nixpkgs#PACKAGENAME && nix build nixpkgs#PACKAGENAME --rebuild --keep-failed
+        ```
+
+        ### 2. Compare the build artifacts
+
+        If the previous command completes successfully, no differences were found and
+        there's nothing to do, builds are reproducible.
+        If it terminates with the error message `error: derivation '<X>' may not be
+        deterministic: output '<Y>' differs from '<Z>'`, use `diffoscope` to investigate
+        the discrepancies between the two build outputs. You may need to add the
+        `--exclude-directory-metadata recursive` option to ignore files and directories
+        metadata (*e.g. timestamp*) differences.
+
+        ```
+        nix run nixpkgs#diffoscopeMinimal -- --exclude-directory-metadata recursive <Y> <Z>
+        ```
+
+        ### 3. Examine the build log
+
+        To examine the build log, use:
+
+        ```
+        nix-store --read-log $(nix-instantiate '<nixpkgs>' -A PACKAGENAME)
+        ```
+
+        Or with the new command line style:
+
+        ```
+        nix log $(nix path-info --derivation nixpkgs#PACKAGENAME)
+        ```
+    validations:
+      required: true
+  - type: "textarea"
+    id: "logs"
+    attributes:
+      label: "Diffoscope log"
+      description: |
+        Please copy and paste the relevant `diffoscope` log output, gathered from the steps above.
+        This will be automatically formatted into a monospaced text block, so no need for backticks.
+      render: "console"
+  - type: "textarea"
+    id: "additional-context"
+    attributes:
+      label: "Additional context"
+      description: "Add any other context about the problem here."
+    validations:
+      required: false
+    id: "maintainers"
+    attributes:
+      label: "Notify maintainers"
+      description: |
+        Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
+      value: |2
+
+
+        ---
+
+        **Note for maintainers:** Please tag this issue in your pull request description. (i.e. `Resolves #ISSUE`.)
+    validations:
+      required: false
+  - type: "checkboxes"
+    id: "sanity-check"
+    attributes:
+      label: "I assert that this issue is relevant for Nixpkgs"
+      options:
+        - label: "I assert that this is not a [duplicate of any known issue](https://github.com/NixOS/nixpkgs/issues?q=is%3Aopen+is%3Aissue+label%3A%226.topic%3A+reproducible+builds%22)."
+          required: true
+        - label: "I assert that I have read the [NixOS Code of Conduct](https://github.com/NixOS/.github/blob/master/CODE_OF_CONDUCT.md) and agree to abide by it."
+          required: true
+  - type: "markdown"
+    attributes:
+      value: |
+        # Thank you for helping improve Nixpkgs!
+
+        ---
+  - type: "textarea"
+    id: "prioritisation"
+    attributes:
+      label: "Is this issue important to you?"
+      description: |
+        **Please do not modify this text area!**
+
+        This template helps Nixpkgs developers know which issues should be prioritised by allowing users to vote with a :+1: reaction.
+        This is not a guarantee that highly-requested issues will be fixed first, but it helps us to figure out what's important to users. Please react on other users' issues if you find them important.
+      value: |
+        Add a :+1: [reaction] to [issues you find important].
+
+        [reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+        [issues you find important]: https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+sort%3Areactions-%2B1-desc

.github/ISSUE_TEMPLATE/10_package_request.yml

@@ -0,0 +1,36 @@
+name: "Request: Nix Package"
+description: "Package requests are no longer accepted. Please open a Pull Request with your desired package instead."
+title: "Package Request"
+labels: ["0.kind: packaging request", "4.workflow: auto-close"]
+body:
+  - type: "markdown"
+    attributes:
+      value: |
+        <p align="center">
+          <a href="https://nixos.org">
+            <picture>
+              <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg">
+              <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos-white.svg">
+              <img src="https://raw.githubusercontent.com/NixOS/nixos-artwork/refs/heads/master/logo/nixos.svg" width="400px" alt="NixOS logo">
+            </picture>
+          </a>
+        </p>
+
+        Thank you for your interest in packaging new software in Nixpkgs. Unfortunately, to mitigate the unsustainable growth of unmaintained packages, **Nixpkgs is no longer accepting package requests** via Issues.
+
+        As a [volunteer community][community], we are always open to new contributors. If you wish to see this package in Nixpkgs, **we encourage you to [contribute] it yourself**, via a Pull Request. Anyone can [become a package maintainer][maintainers]! You can find language-specific packaging information in the [Nixpkgs Manual][nixpkgs]. Should you need any help, please reach out to the community on [Matrix] or [Discourse].
+
+        [community]: https://nixos.org/community
+        [contribute]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#quick-start-to-adding-a-package
+        [maintainers]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
+        [nixpkgs]: https://nixos.org/manual/nixpkgs/unstable/
+        [Matrix]: https://matrix.to/#/#dev:nixos.org
+        [Discourse]: https://discourse.nixos.org/c/dev/14
+
+        ---
+  - type: "checkboxes"
+    id: "ignored"
+    attributes:
+      label: "Issues for new package requests are not accepted. Please open a Pull Request instead."
+      options:
+        - label: "I didn't read any of that."

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,47 @@
+
+<!--
+^ Please summarise the changes you have done and explain why they are necessary here ^
+
+For package updates please link to a changelog or describe changes, this helps your fellow maintainers discover breaking updates.
+For new packages please briefly describe the package or provide a link to its homepage.
+-->
+
+## Things done
+
+<!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->
+
+- Built on platform:
+  - [ ] x86_64-linux
+  - [ ] aarch64-linux
+  - [ ] x86_64-darwin
+  - [ ] aarch64-darwin
+- Tested, as applicable:
+  - [ ] [NixOS tests] in [nixos/tests].
+  - [ ] [Package tests] at `passthru.tests`.
+  - [ ] Tests in [lib/tests] or [pkgs/test] for functions and "core" functionality.
+- [ ] Ran `nixpkgs-review` on this PR. See [nixpkgs-review usage].
+- [ ] Tested basic functionality of all binary files, usually in `./result/bin/`.
+- Nixpkgs Release Notes
+  - [ ] Package update: when the change is major or breaking.
+- NixOS Release Notes
+  - [ ] Module addition: when adding a new NixOS module.
+  - [ ] Module update: when the change is significant.
+- [ ] Fits [CONTRIBUTING.md], [pkgs/README.md], [maintainers/README.md] and other READMEs.
+
+[NixOS tests]: https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests
+[Package tests]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests
+[nixpkgs-review usage]: https://github.com/Mic92/nixpkgs-review#usage
+
+[CONTRIBUTING.md]: https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md
+[lib/tests]: https://github.com/NixOS/nixpkgs/blob/master/lib/tests
+[maintainers/README.md]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md
+[nixos/tests]: https://github.com/NixOS/nixpkgs/blob/master/nixos/tests
+[pkgs/README.md]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md
+[pkgs/test]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/test
+
+---
+
+Add a :+1: [reaction] to [pull requests you find important].
+
+[reaction]: https://github.blog/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/
+[pull requests you find important]: https://github.com/NixOS/nixpkgs/pulls?q=is%3Aopen+sort%3Areactions-%2B1-desc

.github/STALE-BOT.md

@@ -0,0 +1,36 @@
+# Stale bot information
+
+- Thanks for your contribution!
+- Our stale bot will never close an issue or PR.
+- To remove the stale label, just leave a new comment.
+- _How to find the right people to ping?_ → [`git blame`](https://git-scm.com/docs/git-blame) to the rescue! (or GitHub's history and blame buttons.)
+- You can always ask for help on [our Discourse Forum](https://discourse.nixos.org/), [our Matrix room](https://matrix.to/#/#nix:nixos.org), or on the [#nixos IRC channel](https://web.libera.chat/#nixos).
+
+## Suggestions for PRs
+
+1. GitHub sometimes doesn't notify people who commented / reviewed a PR previously, when you (force) push commits. If you have addressed the reviews you can [officially ask for a review](https://docs.github.com/en/free-pro-team@latest/github/collaborating-with-issues-and-pull-requests/requesting-a-pull-request-review) from those who commented to you or anyone else.
+2. If it is unfinished but you plan to finish it, please mark it as a draft.
+3. If you don't expect to work on it any time soon, closing it with a short comment may encourage someone else to pick up your work.
+4. To get things rolling again, rebase the PR against the target branch and address valid comments.
+5. If you need a review to move forward, ask in [the Discourse thread for PRs that need help](https://discourse.nixos.org/t/prs-in-distress/3604).
+6. If all you need is a merge, check the git history to find and [request reviews](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/requesting-a-pull-request-review) from people who usually merge related contributions.
+
+## Suggestions for issues
+
+1. If it is resolved (either for you personally, or in general), please consider closing it.
+2. If this might still be an issue, but you are not interested in promoting its resolution, please consider closing it while encouraging others to take over and reopen an issue if they care enough.
+3. If you still have interest in resolving it, try to ping somebody who you believe might have an interest in the topic. Consider discussing the problem in [our Discourse Forum](https://discourse.nixos.org/).
+4. As with all open source projects, your best option is to submit a Pull Request that addresses this issue. We :heart: this attitude!
+
+**Memorandum on closing issues**
+
+Don't be afraid to close an issue that holds valuable information. Closed issues stay in the system for people to search, read, cross-reference, or even reopen--nothing is lost! Closing obsolete issues is an important way to help maintainers focus their time and effort.
+
+## Useful GitHub search queries
+
+- [Open PRs with any stale-bot interaction](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+)
+- [Open PRs with any stale-bot interaction and `2.status: stale`](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+label%3A%222.status%3A+stale%22)
+- [Open PRs with any stale-bot interaction and NOT `2.status: stale`](https://github.com/NixOS/nixpkgs/pulls?q=is%3Apr+is%3Aopen+commenter%3Aapp%2Fstale+-label%3A%222.status%3A+stale%22+)
+- [Open Issues with any stale-bot interaction](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+)
+- [Open Issues with any stale-bot interaction and `2.status: stale`](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+label%3A%222.status%3A+stale%22+)
+- [Open Issues with any stale-bot interaction and NOT `2.status: stale`](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+commenter%3Aapp%2Fstale+-label%3A%222.status%3A+stale%22+)

.github/actions/checkout/action.yml

@@ -0,0 +1,96 @@
+name: Checkout
+
+description: 'Checkout into trusted / untrusted / pinned folders consistently.'
+
+inputs:
+  merged-as-untrusted-at:
+    description: "Whether and which SHA to checkout for the merge commit in the ./nixpkgs/untrusted folder."
+  target-as-trusted-at:
+    description: "Whether and which SHA to checkout for the target commit in the ./nixpkgs/trusted folder."
+
+runs:
+  using: composite
+  steps:
+    - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      env:
+        MERGED_SHA: ${{ inputs.merged-as-untrusted-at }}
+        TARGET_SHA: ${{ inputs.target-as-trusted-at }}
+      with:
+        script: |
+          const { spawn } = require('node:child_process')
+          const { join } = require('node:path')
+
+          async function run(cmd, ...args) {
+            return new Promise((resolve, reject) => {
+              const proc = spawn(cmd, args, {
+                stdio: 'inherit'
+              })
+              proc.on('close', (code) => {
+                if (code === 0) resolve()
+                else reject(code)
+              })
+            })
+          }
+
+          // These are set automatically by the spare checkout for .github/actions.
+          // Undo them, otherwise git fetch below will not do anything.
+          await run('git', 'config', 'unset', 'remote.origin.promisor')
+          await run('git', 'config', 'unset', 'remote.origin.partialclonefilter')
+
+          // Getting the pinned SHA via API allows us to do one single fetch call for all commits.
+          // Otherwise we would have to fetch merged/target first, read pinned, fetch again.
+          // A single fetch call comes with a lot less overhead. The fetch takes essentially the
+          // same time no matter whether its 1, 2 or 3 commits at once.
+          async function getPinnedSha(ref) {
+            if (!ref) return undefined
+            const { content, encoding } = (await github.rest.repos.getContent({
+              ...context.repo,
+              path: 'ci/pinned.json',
+              ref,
+            })).data
+            const pinned = JSON.parse(Buffer.from(content, encoding).toString())
+            return pinned.pins.nixpkgs.revision
+          }
+
+          const commits = [
+            {
+              sha: process.env.MERGED_SHA,
+              path: 'untrusted',
+            },
+            {
+              sha: await getPinnedSha(process.env.MERGED_SHA),
+              path: 'untrusted-pinned'
+            },
+            {
+              sha: process.env.TARGET_SHA,
+              path: 'trusted',
+            },
+            {
+              sha: await getPinnedSha(process.env.TARGET_SHA),
+              path: 'trusted-pinned'
+            }
+          ].filter(({ sha }) => Boolean(sha))
+
+          console.log('Checking out the following commits:', commits)
+
+          // Fetching all commits at once is much faster than doing multiple checkouts.
+          // This would fail without --refetch, because the we had a partial clone before, but changed it above.
+          await run('git', 'fetch', '--depth=1', '--refetch', 'origin', ...(commits.map(({ sha }) => sha)))
+
+          // Checking out onto tmpfs takes 1s and is faster by at least factor 10x.
+          await run('mkdir', 'nixpkgs')
+          switch (process.env.RUNNER_OS) {
+            case 'macOS':
+              await run('sudo', 'mount_tmpfs', 'nixpkgs')
+              break
+            case 'Linux':
+              await run('sudo', 'mount', '-t', 'tmpfs', 'tmpfs', 'nixpkgs')
+              break
+          }
+
+          // Create all worktrees in parallel.
+          await Promise.all(commits.map(async ({ sha, path }) => {
+            await run('git', 'worktree', 'add', join('nixpkgs', path), sha, '--no-checkout')
+            await run('git', '-C', join('nixpkgs', path), 'sparse-checkout', 'disable')
+            await run('git', '-C', join('nixpkgs', path), 'checkout', '--progress')
+          }))

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels: []

.github/labeler-development-branches.yml

@@ -0,0 +1,23 @@
+# This file is used by .github/workflows/labels.yml
+# This version is only run for Pull Requests from development branches like staging-next, haskell-updates or python-updates.
+
+"4.workflow: package set update":
+  - any:
+      - head-branch:
+          - '-updates$'
+
+"4.workflow: staging":
+  - any:
+      - head-branch:
+          - '^staging-next$'
+          - '^staging-next-'
+
+"6.topic: haskell":
+  - any:
+      - head-branch:
+          - '^haskell-updates$'
+
+"6.topic: python":
+  - any:
+      - head-branch:
+          - '^python-updates$'

.github/labeler-no-sync.yml

@@ -0,0 +1,33 @@
+# This file is used by .github/workflows/labels.yml
+# This version uses `sync-labels: false`, meaning that a non-match will NOT remove the label
+
+# keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
+
+"6.topic: policy discussion":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - .github/**/*
+              - CONTRIBUTING.md
+              - pkgs/README.md
+              - nixos/README.md
+              - maintainers/README.md
+              - lib/README.md
+              - doc/README.md
+
+"8.has: documentation":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/**/*
+              - nixos/doc/**/*
+
+"backport release-25.05":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - .github/actions/*
+              - .github/workflows/*
+              - ci/**/*.*
+
+# keep-sorted end

.github/labeler.yml

@@ -0,0 +1,604 @@
+# This file is used by .github/workflows/labels.yml
+# This version uses `sync-labels: true`, meaning that a non-match will remove the label
+
+# keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
+
+"4.workflow: backport":
+  - any:
+      - base-branch:
+          - '^release-'
+          - '^staging-\d'
+          - '^staging-next-\d'
+
+# NOTE: bsd, darwin and cross-compilation labels are handled by ofborg
+"6.topic: agda":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/agda.section.md
+              - nixos/tests/agda.nix
+              - pkgs/build-support/agda/**/*
+              - pkgs/development/libraries/agda/**/*
+              - pkgs/top-level/agda-packages.nix
+
+"6.topic: cinnamon":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/x11/desktop-managers/cinnamon.nix
+              - nixos/tests/cinnamon.nix
+              - nixos/tests/cinnamon-wayland.nix
+              - pkgs/by-name/ci/cinnamon/**/*
+              - pkgs/by-name/ci/cinnamon-*/**/*
+              - pkgs/by-name/cj/cjs/**/*
+              - pkgs/by-name/mu/muffin/**/*
+              - pkgs/by-name/ne/nemo/**/*
+              - pkgs/by-name/ne/nemo-*/**/*
+
+"6.topic: continuous integration":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - .github/**/*
+              - ci/**/*.*
+
+"6.topic: coq":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/applications/science/logic/coq/**/*
+              - pkgs/development/coq-modules/**/*
+              - pkgs/top-level/coq-packages.nix
+
+"6.topic: COSMIC":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/desktop-managers/cosmic.nix
+              - nixos/modules/services/display-managers/cosmic-greeter.nix
+              - nixos/tests/cosmic.nix
+              - pkgs/by-name/co/cosmic-*/**/*
+              - pkgs/by-name/li/libcosmicAppHook/*
+              - pkgs/by-name/po/pop-launcher/*
+              - pkgs/by-name/xd/xdg-desktop-portal-cosmic/*
+
+"6.topic: crystal":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/development/compilers/crystal/**/*
+
+"6.topic: cuda":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/development/cuda-modules/**/*
+              - pkgs/top-level/cuda-packages.nix
+
+"6.topic: deepin":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/desktops/deepin/**/*
+              - pkgs/desktops/deepin/**/*
+
+"6.topic: docker tools":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/applications/virtualization/docker/**/*
+
+"6.topic: dotnet":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/dotnet.section.md
+              - maintainers/scripts/update-dotnet-lockfiles.nix
+              - pkgs/build-support/dotnet/**/*
+              - pkgs/development/compilers/dotnet/**/*
+              - pkgs/test/dotnet/**/*
+              - pkgs/top-level/dotnet-packages.nix
+
+"6.topic: emacs":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/editors/emacs.nix
+              - nixos/modules/services/editors/emacs.xml
+              - nixos/tests/emacs-daemon.nix
+              - pkgs/applications/editors/emacs/build-support/**/*
+              - pkgs/applications/editors/emacs/elisp-packages/**/*
+              - pkgs/applications/editors/emacs/**/*
+              - pkgs/top-level/emacs-packages.nix
+
+"6.topic: Enlightenment DE":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/x11/desktop-managers/enlightenment.nix
+              - pkgs/desktops/enlightenment/**/*
+              - pkgs/development/python-modules/python-efl/*
+
+"6.topic: erlang":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/beam.section.md
+              - pkgs/development/beam-modules/**/*
+              - pkgs/development/interpreters/elixir/**/*
+              - pkgs/development/interpreters/erlang/**/*
+              - pkgs/development/tools/build-managers/rebar/**/*
+              - pkgs/development/tools/build-managers/rebar3/**/*
+              - pkgs/development/tools/erlang/**/*
+              - pkgs/top-level/beam-packages.nix
+
+"6.topic: fetch":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/build-support/fetch*/**/*
+
+"6.topic: flakes":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - '**/flake.nix'
+              - lib/systems/flake-systems.nix
+              - nixos/modules/config/nix-flakes.nix
+
+"6.topic: flutter":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/build-support/flutter/*.nix
+              - pkgs/development/compilers/flutter/**/*.nix
+
+"6.topic: games":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/games/**/*
+
+"6.topic: GNOME":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/gnome.section.md
+              - nixos/modules/services/desktops/gnome/**/*
+              - nixos/modules/services/desktop-managers/gnome.nix
+              - nixos/tests/gnome-xorg.nix
+              - nixos/tests/gnome.nix
+              - pkgs/desktops/gnome/**/*
+
+"6.topic: golang":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/go.section.md
+              - pkgs/build-support/go/**/*
+              - pkgs/development/compilers/go/**/*
+
+"6.topic: hardware":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/hardware/**/*
+
+"6.topic: haskell":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/haskell.section.md
+              - maintainers/scripts/haskell/**/*
+              - pkgs/development/compilers/ghc/**/*
+              - pkgs/development/haskell-modules/**/*
+              - pkgs/development/tools/haskell/**/*
+              - pkgs/test/haskell/**/*
+              - pkgs/top-level/haskell-packages.nix
+              - pkgs/top-level/release-haskell.nix
+
+"6.topic: java":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              # Distributions
+              - pkgs/development/compilers/adoptopenjdk-icedtea-web/**/*
+              - pkgs/development/compilers/corretto/**/*
+              - pkgs/development/compilers/graalvm/**/*
+              - pkgs/development/compilers/openjdk/**/*
+              - pkgs/by-name/op/openjfx/**/*
+              - pkgs/development/compilers/semeru-bin/**/*
+              - pkgs/development/compilers/temurin-bin/**/*
+              - pkgs/development/compilers/zulu/**/*
+              # Documentation
+              - doc/languages-frameworks/java.section.md
+              # Gradle
+              - doc/languages-frameworks/gradle.section.md
+              - pkgs/development/tools/build-managers/gradle/**/*
+              - pkgs/by-name/gr/gradle-completion/**/*
+              # Maven
+              - pkgs/by-name/ma/maven/**/*
+              - doc/languages-frameworks/maven.section.md
+              # Ant
+              - pkgs/by-name/an/ant/**/*
+              # javaPackages attrset
+              - pkgs/development/java-modules/**/*
+              - pkgs/top-level/java-packages.nix
+              # Maintainer tooling
+              - pkgs/by-name/ni/nixpkgs-openjdk-updater/**/*
+              # Misc
+              - nixos/modules/programs/java.nix
+
+"6.topic: jitsi":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/networking/jitsi-videobridge.nix
+              - nixos/modules/services/web-apps/jitsi-meet.nix
+              - pkgs/servers/web-apps/jitsi-meet/**/*
+              - pkgs/servers/jitsi-videobridge/**/*
+              - pkgs/applications/networking/instant-messengers/jitsi/**/*
+
+"6.topic: julia":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/julia.section.md
+              - pkgs/development/compilers/julia/**/*
+              - pkgs/development/julia-modules/**/*
+
+"6.topic: jupyter":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/development/python-modules/jupyter*/**/*
+              - pkgs/development/python-modules/mkdocs-jupyter/*
+              - nixos/modules/services/development/jupyter/**/*
+              - pkgs/applications/editors/jupyter-kernels/**/*
+              - pkgs/applications/editors/jupyter/**/*
+
+"6.topic: k3s":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/cluster/k3s/**/*
+              - nixos/tests/k3s/**/*
+              - pkgs/applications/networking/cluster/k3s/**/*
+
+"6.topic: kernel":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/build-support/kernel/**/*
+              - pkgs/os-specific/linux/kernel/**/*
+
+"6.topic: lib":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - lib/**
+
+"6.topic: llvm/clang":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/development/compilers/llvm/**/*
+
+"6.topic: lua":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/development/tools/misc/luarocks/*
+              - pkgs/development/interpreters/lua-5/**/*
+              - pkgs/development/interpreters/luajit/**/*
+              - pkgs/development/lua-modules/**/*
+              - pkgs/top-level/lua-packages.nix
+
+"6.topic: Lumina DE":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/x11/desktop-managers/lumina.nix
+              - pkgs/desktops/lumina/**/*
+
+"6.topic: LXQt":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/x11/desktop-managers/lxqt.nix
+              - pkgs/desktops/lxqt/**/*
+
+"6.topic: mate":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/x11/desktop-managers/mate.nix
+              - nixos/tests/mate.nix
+              - pkgs/desktops/mate/**/*
+
+"6.topic: module system":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - lib/modules.nix
+              - lib/types.nix
+              - lib/options.nix
+              - lib/tests/modules.sh
+              - lib/tests/modules/**
+
+"6.topic: musl":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/os-specific/linux/musl/**/*
+
+"6.topic: nim":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/nim.section.md
+              - pkgs/build-support/build-nim-package.nix
+              - pkgs/build-support/build-nim-sbom.nix
+              - pkgs/by-name/ni/nim*
+              - pkgs/top-level/nim-overrides.nix
+
+"6.topic: nixos":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/**/*
+              - pkgs/by-name/sw/switch-to-configuration-ng/**/*
+              - pkgs/by-name/ni/nixos-rebuild-ng/**/*
+              - pkgs/os-specific/linux/nixos-rebuild/**/*
+
+"6.topic: nixos-container":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/virtualisation/nixos-containers.nix
+              - pkgs/tools/virtualization/nixos-container/**/*
+
+"6.topic: nodejs":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/javascript.section.md
+              - pkgs/build-support/node/**/*
+              - pkgs/development/node-packages/**/*
+              - pkgs/development/tools/yarn/*
+              - pkgs/development/tools/yarn2nix-moretea/**/*
+              - pkgs/development/tools/pnpm/**/*
+              - pkgs/development/web/nodejs/*
+
+"6.topic: nvidia":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/hardware/video/nvidia.nix
+              - nixos/modules/services/hardware/nvidia-container-toolkit/**/*
+              - nixos/modules/services/hardware/nvidia-optimus.nix
+              - pkgs/os-specific/linux/nvidia-x11/**/*
+
+"6.topic: ocaml":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/ocaml.section.md
+              - pkgs/development/compilers/ocaml/**/*
+              - pkgs/development/compilers/reason/**/*
+              - pkgs/development/ocaml-modules/**/*
+              - pkgs/development/tools/ocaml/**/*
+              - pkgs/top-level/ocaml-packages.nix
+
+"6.topic: pantheon":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/desktops/pantheon/**/*
+              - nixos/modules/services/desktop-managers/pantheon.nix
+              - nixos/modules/services/x11/display-managers/lightdm-greeters/pantheon.nix
+              - nixos/tests/pantheon.nix
+              - pkgs/desktops/pantheon/**/*
+
+"6.topic: php":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/php.section.md
+              - nixos/tests/php/**/*
+              - pkgs/build-support/php/**/*
+              - pkgs/development/interpreters/php/**/*
+              - pkgs/development/php-packages/**/*
+              - pkgs/test/php/default.nix
+              - pkgs/top-level/php-packages.nix
+
+"6.topic: printing":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/services/printing/cupsd.nix
+              - pkgs/misc/cups/**/*
+
+"6.topic: python":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/python.section.md
+              - pkgs/development/interpreters/python/**/*
+              - pkgs/development/python-modules/**/*
+              - pkgs/top-level/python-packages.nix
+
+"6.topic: qt/kde":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/qt.section.md
+              - nixos/modules/services/desktop-managers/plasma6.nix
+              - nixos/tests/plasma6.nix
+              - pkgs/kde/**/*
+
+"6.topic: R":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/applications/science/math/R/**/*
+              - pkgs/development/r-modules/**/*
+
+"6.topic: rocm":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/development/rocm-modules/**/*
+
+"6.topic: ruby":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/ruby.section.md
+              - pkgs/development/interpreters/ruby/**/*
+              - pkgs/development/ruby-modules/**/*
+              - pkgs/top-level/ruby-packages.nix
+
+"6.topic: rust":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/rust.section.md
+              - pkgs/build-support/rust/**/*
+              - pkgs/development/compilers/rust/**/*
+
+"6.topic: stdenv":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/stdenv/**/*
+
+"6.topic: steam":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/games/steam/**/*
+
+"6.topic: systemd":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/os-specific/linux/systemd/**/*
+              - nixos/modules/system/boot/systemd*/**/*
+
+"6.topic: tcl":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/tcl.section.md
+              - pkgs/development/interpreters/tcl/*
+              - pkgs/development/tcl-modules/**/*
+              - pkgs/top-level/tcl-packages.nix
+
+"6.topic: teams":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - maintainers/team-list.nix
+
+"6.topic: testing":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              # NOTE: Let's keep the scope limited to test frameworks that are
+              #       *developed in this repo*;
+              #       - not individual tests
+              #       - not packages for test frameworks
+              - pkgs/build-support/testers/**
+              - nixos/lib/testing/**
+              - nixos/lib/test-driver/**
+              - nixos/tests/nixos-test-driver/**
+              - nixos/lib/testing-python.nix # legacy
+              - nixos/tests/make-test-python.nix # legacy
+              # lib/debug.nix has a test framework (runTests) but it's not the main focus
+
+"6.topic: TeX":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/texlive.section.md
+              - pkgs/test/texlive/**
+              - pkgs/tools/typesetting/tex/**/*
+
+"6.topic: updaters":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/common-updater/**/*
+
+"6.topic: vim":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/languages-frameworks/vim.section.md
+              - pkgs/applications/editors/vim/**/*
+              - pkgs/applications/editors/vim/plugins/**/*
+              - nixos/modules/programs/neovim.nix
+              - pkgs/applications/editors/neovim/**/*
+
+"6.topic: vscode":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/applications/editors/vscode/**/*
+
+"6.topic: windows":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/os-specific/windows/**/*
+
+"6.topic: xen-project":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/virtualisation/xen*
+              - pkgs/by-name/xe/xen/*
+              - pkgs/by-name/qe/qemu_xen/*
+              - pkgs/by-name/xe/xen-guest-agent/*
+              - pkgs/by-name/xt/xtf/*
+              - pkgs/build-support/xen/*
+              - pkgs/development/ocaml-modules/xen*/*
+              - pkgs/development/ocaml-modules/vchan/*
+
+"6.topic: xfce":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/doc/manual/configuration/xfce.xml
+              - nixos/modules/services/x11/desktop-managers/xfce.nix
+              - nixos/tests/xfce.nix
+              - pkgs/desktops/xfce/**/*
+
+"6.topic: zig":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - pkgs/development/compilers/zig/**/*
+              - doc/hooks/zig.section.md
+
+"8.has: changelog":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/release-notes/**/*
+              - nixos/doc/manual/release-notes/**/*
+
+"8.has: maintainer-list (update)":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - maintainers/maintainer-list.nix
+
+"8.has: module (update)":
+  - any:
+      - changed-files:
+          - any-glob-to-any-file:
+              - nixos/modules/**/*
+
+# keep-sorted end

.github/workflows/README.md

@@ -0,0 +1,77 @@
+# GitHub Actions Workflows
+
+Some architectural notes about key decisions and concepts in our workflows:
+
+- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows.
+  This has the advantage that those workflows will run without prior approval for external contributors.
+
+- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches.
+  **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible.
+  Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.
+
+- By definition `pull_request_target` runs in the context of the **base** of the pull request.
+  This means, that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default.
+  To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.
+
+- To test the pull request's contents, we checkout the "test merge commit".
+  This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?".
+  The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore).
+  This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout.
+  Thus, we use the `prepare` job to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.
+
+- Various workflows need to make comparisons against the base branch.
+  In this case, we checkout the parent of the "test merge commit" for best results.
+  Note, that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.
+
+## Terminology
+
+- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions.
+  Same as `github.event.pull_request.base.sha`.
+- **head commit**: The HEAD commit in the pull request's branch.
+  Same as `github.event.pull_request.head.sha`.
+- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request.
+  Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.
+- **target commit**: The base branch's parent of the "test merge commit" to compare against.
+
+## Concurrency Groups
+
+We use [GitHub's Concurrency Groups](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs) to cancel older jobs on pushes to Pull Requests.
+When two workflows are in the same group, a newer workflow cancels an older workflow.
+Thus, it is important how to construct the group keys:
+
+- Because we want to run jobs for different events at same time, we add `github.event_name` to the key.
+  This is the case for the `pull_request` which runs on changes to the workflow files to test the new files and the same workflow from the base branch run via `pull_request_event`.
+
+- We don't want workflows of different Pull Requests to cancel each other, so we include `github.event.pull_request.number`.
+  The [GitHub docs](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs#example-using-a-fallback-value) show using `github.head_ref` for this purpose, but this doesn't work well with forks: Different users could have the same head branch name in their forks and run CI for their PRs at the same time.
+
+- Sometimes, there is no `pull_request.number`.
+  To ensure non-PR runs are never cancelled, we add a fallback of `github.run_id`.
+  This is a unique value for each workflow run.
+
+- Of course, we run multiple workflows at the same time, so we add `github.workflow` to the key.
+  Otherwise workflows would cancel each other.
+
+- There is a special case for reusable workflows called via `workflow_call` - they will have `github.workflow` set to their parent workflow's name.
+  Thus, they would cancel each other.
+  That's why we additionally hardcode the name of the workflow as well.
+
+This results in a key with the following semantics:
+
+```
+<running-workflow>-<triggering-workflow>-<triggered-event>-<pull-request/fallback>
+```
+
+## Required Status Checks
+
+The "Required Status Checks" branch ruleset is implemented in two top-level workflows: `pr.yml` and `merge-group.yml`.
+
+The PR workflow defines all checks that need to succeed to add a Pull Request to the Merge Queue.
+If no Merge Queue is set up for a branch, the PR workflow defines the checks required to merge into the target branch.
+
+The Merge Group workflow defines all checks that are run as part of the Merge Queue.
+Only when these pass, a Pull Request is finally merged into the target branch.
+They don't apply when no Merge Queue is set up.
+
+Both workflows work with the same `no PR failures` status check.
+This name can never be changed, because it's used in the branch ruleset for these rules.

.github/workflows/backport.yml

@@ -0,0 +1,78 @@
+# WARNING:
+# When extending this action, be aware that $GITHUB_TOKEN allows write access to
+# the GitHub repository. This means that it should not evaluate user input in a
+# way that allows code injection.
+
+name: Backport
+
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  backport:
+    name: Backport Pull Request
+    if: vars.NIXPKGS_CI_APP_ID && github.event.pull_request.merged == true && (github.event.action != 'labeled' || startsWith(github.event.label.name, 'backport'))
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 3
+    steps:
+      # Use a GitHub App to create the PR so that CI gets triggered
+      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+          permission-workflows: write
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Create backport PRs
+        id: backport
+        uses: korthout/backport-action@ca4972adce8039ff995e618f5fc02d1b7961f27a # v3.3.0
+        with:
+          # Config README: https://github.com/korthout/backport-action#backport-action
+          copy_labels_pattern: 'severity:\ssecurity'
+          github_token: ${{ steps.app-token.outputs.token }}
+          pull_description: |-
+            Bot-based backport to `${target_branch}`, triggered by a label in #${pull_number}.
+
+            * [ ] Before merging, ensure that this backport is [acceptable for the release](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#changes-acceptable-for-releases).
+              * Even as a non-committer, if you find that it is not acceptable, leave a comment.
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: "Add 'has: port to stable' label"
+        if: steps.backport.outputs.created_pull_numbers != ''
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          # Not using the app on purpose to avoid triggering another workflow run after adding this label.
+          script: |
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.payload.pull_request.number,
+              labels: [ '8.has: port to stable' ]
+            })

.github/workflows/build.yml

@@ -0,0 +1,103 @@
+name: Build
+
+on:
+  workflow_call:
+    inputs:
+      baseBranch:
+        required: true
+        type: string
+      mergedSha:
+        required: true
+        type: string
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            name: x86_64-linux
+            systems: x86_64-linux
+            builds: [shell, manual-nixos, lib-tests, tarball]
+            desc: shell, docs, lib, tarball
+          - runner: ubuntu-24.04-arm
+            name: aarch64-linux
+            systems: aarch64-linux
+            builds: [shell, manual-nixos, manual-nixpkgs, manual-nixpkgs-tests]
+            desc: shell, docs
+          - runner: macos-14
+            name: darwin
+            systems: aarch64-darwin x86_64-darwin
+            builds: [shell]
+            desc: shell
+    name: '${{ matrix.name }}: ${{ matrix.desc }}'
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: .github/actions
+      - name: Checkout the merge commit
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+        with:
+          # Sandbox is disabled on MacOS by default.
+          extra_nix_config: sandbox = true
+
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: '(-source$|-nixpkgs-tarball-)'
+
+      - run: nix-env --install -f nixpkgs/untrusted-pinned -A nix-build-uncached
+
+      - name: Build shell
+        if: contains(matrix.builds, 'shell')
+        run: echo "${{ matrix.systems }}" | xargs -n1 nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A shell --argstr system
+
+      - name: Build NixOS manual
+        if: |
+          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
+          contains(fromJSON(inputs.baseBranch).type, 'primary')
+        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixos --out-link nixos-manual
+
+      - name: Build Nixpkgs manual
+        if: contains(matrix.builds, 'manual-nixpkgs') && !cancelled()
+        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixpkgs -A manual-nixpkgs-tests
+
+      - name: Build Nixpkgs manual tests
+        if: contains(matrix.builds, 'manual-nixpkgs-tests') && !cancelled()
+        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixpkgs-tests
+
+      - name: Build lib tests
+        if: contains(matrix.builds, 'lib-tests') && !cancelled()
+        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A lib-tests
+
+      - name: Build tarball
+        if: contains(matrix.builds, 'tarball') && !cancelled()
+        run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A tarball
+
+      - name: Upload NixOS manual
+        if: |
+          contains(matrix.builds, 'manual-nixos') && !cancelled() &&
+          contains(fromJSON(inputs.baseBranch).type, 'primary')
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: nixos-manual-${{ matrix.name }}
+          path: nixos-manual

.github/workflows/check.yml

@@ -0,0 +1,104 @@
+name: Check
+
+on:
+  workflow_call:
+    inputs:
+      baseBranch:
+        required: true
+        type: string
+      headBranch:
+        required: true
+        type: string
+      mergedSha:
+        required: true
+        type: string
+      targetSha:
+        required: true
+        type: string
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  commits:
+    permissions:
+      pull-requests: write
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 3
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: trusted
+          sparse-checkout: |
+            ci/github-script
+
+      - name: Install dependencies
+        run: npm install bottleneck
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Check commits
+        id: check
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          TARGETS_STABLE: ${{ fromJSON(inputs.baseBranch).stable && !contains(fromJSON(inputs.headBranch).type, 'development') }}
+        with:
+          script: |
+            const targetsStable = JSON.parse(process.env.TARGETS_STABLE)
+            require('./trusted/ci/github-script/commits.js')({
+              github,
+              context,
+              core,
+              dry: context.eventName == 'pull_request',
+              cherryPicks: context.eventName == 'pull_request' || targetsStable,
+            })
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
+  owners:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: .github/actions
+      - name: Checkout merge and target commits
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: -source$
+
+      - name: Build codeowners validator
+        run: nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A codeownersValidator
+
+      - name: Validate codeowners
+        env:
+          OWNERS_FILE: nixpkgs/untrusted/ci/OWNERS
+          REPOSITORY_PATH: nixpkgs/untrusted
+          # Omits "owners", which checks whether GitHub handles exist, but fails with nested team
+          # structures.
+          CHECKS: "duppatterns,files,syntax"
+          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
+          EXPERIMENTAL_CHECKS: "avoid-shadowing"
+        run: result/bin/codeowners-validator

.github/workflows/dismissed-review.yml

@@ -0,0 +1,66 @@
+name: Dismissed review
+
+on:
+  workflow_run:
+    workflows:
+      - Review dismissed
+    types: [completed]
+
+concurrency:
+  group: dismissed-review-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  # The `check-cherry-picks` workflow creates review comments which reviewers
+  # are encouraged to manually dismiss if they're not relevant.
+  # When a CI-generated review is dismissed, this job automatically minimizes
+  # it, preventing it from cluttering the PR.
+  minimize:
+    name: Minimize as resolved
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 2
+    steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            // PRs from forks don't have any PRs associated by default.
+            // Thus, we request the PR number with an API call *to* the fork's repo.
+            // Multiple pull requests can be open from the same head commit, either via
+            // different base branches or head branches.
+            const { head_repository, head_sha, repository } = context.payload.workflow_run
+            await Promise.all(
+              (await github.paginate(github.rest.repos.listPullRequestsAssociatedWithCommit, {
+                owner: head_repository.owner.login,
+                repo: head_repository.name,
+                commit_sha: head_sha
+              }))
+              .filter(pull_request => pull_request.base.repo.id == repository.id)
+              .map(async (pull_request) =>
+                Promise.all(
+                  (await github.paginate(github.rest.pulls.listReviews, {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    pull_number: pull_request.number
+                  })).filter(review =>
+                    review.user?.login == 'github-actions[bot]' &&
+                    review.state == 'DISMISSED'
+                  ).map(review => github.graphql(`
+                    mutation($node_id:ID!) {
+                      minimizeComment(input: {
+                        classifier: RESOLVED,
+                        subjectId: $node_id
+                      })
+                      { clientMutationId }
+                    }`,
+                    { node_id: review.node_id }
+                  ))
+                )
+              )
+            )

.github/workflows/edited.yml

@@ -0,0 +1,59 @@
+# Some workflows depend on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
+# Instead it causes an `edited` event.
+# Since `edited` is also triggered when PR title/body is changed, we use this wrapper workflow, to run the other workflows conditionally only.
+# There are already feature requests for adding a `base_changed` event:
+# - https://github.com/orgs/community/discussions/35058
+# - https://github.com/orgs/community/discussions/64119
+#
+# Instead of adding this to each workflow's pull_request_target event, we trigger this in a separate workflow.
+# This has the advantage, that we can actually skip running those jobs for simple edits like changing the title or description.
+# The actual trigger happens by closing and re-opening the pull request, which triggers the default pull_request_target events.
+# This is much simpler and reliable than other approaches.
+
+name: "Edited base branch"
+
+on:
+  pull_request_target:
+    types: [edited]
+
+concurrency:
+  group: edited-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  base:
+    name: Trigger jobs
+    runs-on: ubuntu-24.04
+    if: github.event.changes.base.ref.from && github.event.changes.base.ref.from != github.event.pull_request.base.ref
+    timeout-minutes: 2
+    steps:
+      # Use a GitHub App to create the PR so that CI gets triggered
+      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
+      # We only need Pull Requests: write here, but the app is also used for backports.
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            function changeState(state) {
+              return github.rest.pulls.update({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: context.payload.pull_request.number,
+                state
+              })
+            }
+            await changeState('closed')
+            await changeState('open')

.github/workflows/eval.yml

@@ -0,0 +1,361 @@
+name: Eval
+
+on:
+  workflow_call:
+    inputs:
+      mergedSha:
+        required: true
+        type: string
+      targetSha:
+        type: string
+      systems:
+        required: true
+        type: string
+      testVersions:
+        required: false
+        default: false
+        type: boolean
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  versions:
+    if: inputs.testVersions
+    runs-on: ubuntu-24.04-arm
+    outputs:
+      versions: ${{ steps.versions.outputs.versions }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: trusted
+          sparse-checkout: |
+            ci/supportedVersions.nix
+
+      - name: Check out the PR at the test merge commit
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ inputs.mergedSha }}
+          path: untrusted
+          sparse-checkout: |
+            ci/pinned.json
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      - name: Load supported versions
+        id: versions
+        run: |
+          echo "versions=$(trusted/ci/supportedVersions.nix --arg pinnedJson untrusted/ci/pinned.json)" >> "$GITHUB_OUTPUT"
+
+  eval:
+    runs-on: ubuntu-24.04-arm
+    needs: versions
+    if: ${{ !cancelled() && !failure() }}
+    strategy:
+      fail-fast: false
+      matrix:
+        system: ${{ fromJSON(inputs.systems) }}
+        version:
+          - "" # Default Eval triggering rebuild labels and such.
+          - ${{ fromJSON(needs.versions.outputs.versions || '[]') }} # Only for ci/pinned.json updates.
+    # Failures for versioned Evals will be collected in a separate job below
+    # to not interrupt main Eval's compare step.
+    continue-on-error: ${{ matrix.version != '' }}
+    name: ${{ matrix.system }}${{ matrix.version && format(' @ {0}', matrix.version) || '' }}
+    timeout-minutes: 15
+    steps:
+      # This is not supposed to be used and just acts as a fallback.
+      # Without swap, when Eval runs OOM, it will fail badly with a
+      # job that is sometimes not interruptible anymore.
+      # If Eval starts swapping, decrease chunkSize to keep it fast.
+      - name: Enable swap
+        run: |
+          sudo fallocate -l 10G /swap
+          sudo chmod 600 /swap
+          sudo mkswap /swap
+          sudo swapon /swap
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: .github/actions
+      - name: Check out the PR at merged and target commits
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: '(-source|-single-chunk)$'
+
+      - name: Evaluate the ${{ matrix.system }} output paths at the merge commit
+        env:
+          MATRIX_SYSTEM: ${{ matrix.system }}
+          MATRIX_VERSION: ${{ matrix.version || 'nixVersions.latest' }}
+        run: |
+          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned  -A eval.singleSystem \
+            --argstr evalSystem "$MATRIX_SYSTEM" \
+            --arg chunkSize 8000 \
+            --argstr nixPath "$MATRIX_VERSION" \
+            --out-link merged
+          # If it uses too much memory, slightly decrease chunkSize.
+          # Note: Keep the same further down in sync!
+
+      # Running the attrpath generation step separately from the outpath step afterwards.
+      # The idea is that, *if* Eval on the target branch has not finished, yet, we will
+      # generate the attrpaths in the meantime - and the separate command command afterwards
+      # will check cachix again for whether Eval has finished. If no Eval result from the
+      # target branch can be found the second time, we proceed to run it in here. Attrpaths
+      # generation takes roughly 30 seconds, so for every normal use-case this should be more
+      # than enough of a head start for Eval on the target branch to finish.
+      # This edge-case, that Eval on the target branch is delayed is unlikely to happen anyway:
+      # For a commit to become the target commit of a PR, it must *already* be on the branch.
+      # Normally, CI should always start running on that push event *before* it starts running
+      # on the PR.
+      - name: Evaluate the ${{ matrix.system }} attribute paths at the target commit
+        if: inputs.targetSha
+        env:
+          MATRIX_SYSTEM: ${{ matrix.system }}
+        run: |
+          nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.attrpathsSuperset \
+            --argstr evalSystem "$MATRIX_SYSTEM" \
+            --argstr nixPath "nixVersions.latest"
+
+      - name: Evaluate the ${{ matrix.system }} output paths at the target commit
+        if: inputs.targetSha
+        env:
+          MATRIX_SYSTEM: ${{ matrix.system }}
+        # This should be very quick, because it pulls the eval results from Cachix.
+        run: |
+          nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.singleSystem \
+            --argstr evalSystem "$MATRIX_SYSTEM" \
+            --arg chunkSize 8000 \
+            --argstr nixPath "nixVersions.latest" \
+            --out-link target
+
+      - name: Compare outpaths against the target branch
+        if: inputs.targetSha
+        env:
+          MATRIX_SYSTEM: ${{ matrix.system }}
+        run: |
+          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A eval.diff \
+            --arg beforeDir ./target \
+            --arg afterDir ./merged \
+            --argstr evalSystem "$MATRIX_SYSTEM" \
+            --out-link diff
+
+      - name: Upload outpaths diff and stats
+        if: inputs.targetSha
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: ${{ matrix.version && format('{0}-', matrix.version) || '' }}diff-${{ matrix.system }}
+          path: diff/*
+
+  compare:
+    runs-on: ubuntu-24.04-arm
+    needs: [eval]
+    if: inputs.targetSha && !cancelled() && !failure()
+    permissions:
+      statuses: write
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: .github/actions
+      - name: Check out the PR at the target commit
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
+
+      - name: Download output paths and eval stats for all systems
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          pattern: diff-*
+          path: diff
+          merge-multiple: true
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      - name: Combine all output paths and eval stats
+        run: |
+          nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.combine \
+            --arg diffDir ./diff \
+            --out-link combined
+
+      - name: Compare against the target branch
+        env:
+          AUTHOR_ID: ${{ github.event.pull_request.user.id }}
+        run: |
+          git -C nixpkgs/trusted diff --name-only ${{ inputs.mergedSha }} \
+            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json
+
+          # Use the target branch to get accurate maintainer info
+          nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.compare \
+            --arg combinedDir ./combined \
+            --arg touchedFilesJson ./touched-files.json \
+            --argstr githubAuthorId "$AUTHOR_ID" \
+            --out-link comparison
+
+          cat comparison/step-summary.md >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Upload the comparison results
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: comparison
+          path: comparison/*
+
+      - name: Add eval summary to commit statuses
+        if: ${{ github.event_name == 'pull_request_target' }}
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const { readFile } = require('node:fs/promises')
+            const changed = JSON.parse(await readFile('comparison/changed-paths.json', 'utf-8'))
+            const description =
+              'Package: ' + [
+                `added ${changed.attrdiff.added.length}`,
+                `removed ${changed.attrdiff.removed.length}`,
+                `changed ${changed.attrdiff.changed.length}`
+              ].join(', ') +
+              ' — Rebuild: ' + [
+                `linux ${changed.rebuildCountByKernel.linux}`,
+                `darwin ${changed.rebuildCountByKernel.darwin}`
+              ].join(', ')
+
+            const { serverUrl, repo, runId, payload } = context
+            const target_url =
+              `${serverUrl}/${repo.owner}/${repo.repo}/actions/runs/${runId}?pr=${payload.pull_request.number}`
+
+            await github.rest.repos.createCommitStatus({
+              ...repo,
+              sha: payload.pull_request.head.sha,
+              context: 'Eval Summary',
+              state: 'success',
+              description,
+              target_url
+            })
+
+  # Creates a matrix of Eval performance for various versions and systems.
+  report:
+    runs-on: ubuntu-24.04-arm
+    needs: [versions, eval]
+    steps:
+      - name: Download output paths and eval stats for all versions
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          pattern: "*-diff-*"
+          path: versions
+
+      - name: Add version comparison table to job summary
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          SYSTEMS: ${{ inputs.systems }}
+          VERSIONS: ${{ needs.versions.outputs.versions }}
+        with:
+          script: |
+            const { readFileSync } = require('node:fs')
+            const path = require('node:path')
+
+            const systems = JSON.parse(process.env.SYSTEMS)
+            const versions = JSON.parse(process.env.VERSIONS)
+
+            core.summary.addHeading('Lix/Nix version comparison')
+            core.summary.addTable(
+              [].concat(
+                [
+                  [{ data: 'Version', header: true }].concat(
+                    systems.map((system) => ({ data: system, header: true })),
+                  ),
+                ],
+                versions.map((version) =>
+                  [{ data: version }].concat(
+                    systems.map((system) => {
+                      try {
+                        const artifact = path.join('versions', `${version}-diff-${system}`)
+                        const time = Math.round(
+                          parseFloat(
+                            readFileSync(
+                              path.join(artifact, 'after', system, 'total-time'),
+                              'utf-8',
+                            ),
+                          ),
+                        )
+                        const diff = JSON.parse(
+                          readFileSync(path.join(artifact, system, 'diff.json'), 'utf-8'),
+                        )
+                        const attrs = [].concat(
+                          diff.added,
+                          diff.removed,
+                          diff.changed,
+                          diff.rebuilds
+                        ).filter(attr =>
+                          // Exceptions related to dev shells, which changed at some time between 2.18 and 2.24.
+                          !attr.startsWith('tests.devShellTools.nixos.') &&
+                          !attr.startsWith('tests.devShellTools.unstructuredDerivationInputEnv.')
+                        )
+                        if (attrs.length > 0) {
+                          core.setFailed(
+                            `${version} on ${system} has changed outpaths!\nNote: Please make sure to update ci/pinned.json separately from changes to other packages.`,
+                          )
+                          return { data: ':x:' }
+                        }
+                        return { data: time }
+                      } catch {
+                        core.warning(`${version} on ${system} did not produce artifact.`)
+                        return { data: ':warning:' }
+                      }
+                    }),
+                  ),
+                ),
+              ),
+            )
+            core.summary.addRaw(
+              '\n*Evaluation time in seconds without downloading dependencies.*',
+              true,
+            )
+            core.summary.addRaw('\n*:warning: Job did not report a result.*', true)
+            core.summary.addRaw(
+              '\n*:x: Job produced different outpaths than the target branch.*',
+              true,
+            )
+            core.summary.write()
+
+  misc:
+    if: ${{ github.event_name != 'push' }}
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: .github/actions
+      - name: Checkout the merge commit
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      - name: Run misc eval tasks in parallel
+        run: |
+          # Ensure flake outputs on all systems still evaluate
+          nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1' &
+          # Query nixpkgs with aliases enabled to check for basic syntax errors
+          nix-env -I ./nixpkgs/untrusted -f ./nixpkgs/untrusted -qa '*' --option restrict-eval true --option allow-import-from-derivation false >/dev/null &
+          wait

.github/workflows/labels.yml

@@ -0,0 +1,120 @@
+# WARNING:
+# When extending this action, be aware that $GITHUB_TOKEN allows some write
+# access to the GitHub API. This means that it should not evaluate user input in
+# a way that allows code injection.
+
+name: Labels
+
+on:
+  schedule:
+    - cron: '07,17,27,37,47,57 * * * *'
+  workflow_call:
+    inputs:
+      headBranch:
+        required: true
+        type: string
+    secrets:
+      NIXPKGS_CI_APP_PRIVATE_KEY:
+        required: true
+  workflow_dispatch:
+
+concurrency:
+  # This explicitly avoids using `run_id` for the concurrency key to make sure that only
+  # *one* scheduled run can run at a time.
+  group: labels-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number }}
+  # PR-triggered runs will be cancelled, but scheduled runs will be queued.
+  cancel-in-progress: ${{ github.event_name != 'schedule' }}
+
+# This is used as fallback without app only.
+# This happens when testing in forks without setting up that app.
+permissions:
+  issues: write
+  pull-requests: write
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  update:
+    runs-on: ubuntu-24.04-arm
+    if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: |
+            ci/github-script
+
+      - name: Install dependencies
+        run: npm install @actions/artifact bottleneck
+
+      # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        if: github.event_name != 'pull_request' && vars.NIXPKGS_CI_APP_ID
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-issues: write
+          permission-pull-requests: write
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Labels from API data and Eval results
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          github-token: ${{ steps.app-token.outputs.token || github.token }}
+          retries: 3
+          script: |
+            require('./ci/github-script/labels.js')({
+              github,
+              context,
+              core,
+              dry: context.eventName == 'pull_request'
+            })
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
+        run: gh api /rate_limit | jq
+
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+        name: Labels from touched files
+        if: |
+          github.event_name == 'pull_request_target' &&
+          !contains(fromJSON(inputs.headBranch).type, 'development')
+        with:
+          repo-token: ${{ steps.app-token.outputs.token }}
+          configuration-path: .github/labeler.yml # default
+          sync-labels: true
+
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+        name: Labels from touched files (no sync)
+        if: |
+          github.event_name == 'pull_request_target' &&
+          !contains(fromJSON(inputs.headBranch).type, 'development')
+        with:
+          repo-token: ${{ steps.app-token.outputs.token }}
+          configuration-path: .github/labeler-no-sync.yml
+          sync-labels: false
+
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
+        name: Labels from touched files (development branches)
+        # Development branches like staging-next, haskell-updates and python-updates get special labels.
+        # This is to avoid the mass of labels there, which is mostly useless - and really annoying for
+        # the backport labels.
+        if: |
+          github.event_name == 'pull_request_target' &&
+          contains(fromJSON(inputs.headBranch).type, 'development')
+        with:
+          repo-token: ${{ steps.app-token.outputs.token }}
+          configuration-path: .github/labeler-development-branches.yml
+          sync-labels: true
+
+      - name: Log current API rate limits
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
+        run: gh api /rate_limit | jq

.github/workflows/lint.yml

@@ -0,0 +1,119 @@
+name: Lint
+
+on:
+  workflow_call:
+    inputs:
+      mergedSha:
+        required: true
+        type: string
+      targetSha:
+        required: true
+        type: string
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  treefmt:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: .github/actions
+      - name: Checkout the merge commit
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
+      # because the cache would be invalidated on every commit - treefmt checks every file.
+      # Maybe we can cache treefmt's eval-cache somehow.
+
+      - name: Check that files are formatted
+        run: |
+          # Note that it's fine to run this on untrusted code because:
+          # - There's no secrets accessible here
+          # - The build is sandboxed
+          if ! nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A fmt.check; then
+            echo "Some files are not properly formatted"
+            echo "Please format them by going to the Nixpkgs root directory and running one of:"
+            echo "  nix-shell --run treefmt"
+            echo "  nix develop --command treefmt"
+            echo "  nix fmt"
+            echo "Make sure your branch is up to date with master; rebase if not."
+            echo "If you're having trouble, please ping @NixOS/nix-formatting"
+            exit 1
+          fi
+
+  parse:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: .github/actions
+      - name: Checkout the merge commit
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: -source$
+
+      - name: Parse all nix files
+        run: |
+          # Tests multiple versions at once, let's make sure all of them run, so keep-going.
+          nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A parse --keep-going
+
+  nixpkgs-vet:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: .github/actions
+      - name: Checkout merge and target commits
+        uses: ./.github/actions/checkout
+        with:
+          merged-as-untrusted-at: ${{ inputs.mergedSha }}
+          target-as-trusted-at: ${{ inputs.targetSha }}
+
+      - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: -source$
+
+      - name: Running nixpkgs-vet
+        env:
+          # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
+          CLICOLOR_FORCE: 1
+        run: |
+          if nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A nixpkgs-vet --arg base "./nixpkgs/trusted" --arg head "./nixpkgs/untrusted"; then
+            exit 0
+          else
+            exitCode=$?
+            echo "To run locally: ./ci/nixpkgs-vet.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
+            echo "If you're having trouble, ping @NixOS/nixpkgs-vet"
+            exit "$exitCode"
+          fi

.github/workflows/merge-group.yml

@@ -0,0 +1,57 @@
+name: Merge Group
+
+on:
+  merge_group:
+  workflow_call:
+    inputs:
+      mergedSha:
+        required: true
+        type: string
+      targetSha:
+        required: true
+        type: string
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+
+permissions: {}
+
+jobs:
+  lint:
+    name: Lint
+    uses: ./.github/workflows/lint.yml
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      mergedSha: ${{ inputs.mergedSha || github.event.merge_group.head_sha }}
+      targetSha: ${{ inputs.targetSha || github.event.merge_group.base_sha }}
+
+  # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
+  # It "needs" all the jobs that should block the Merge Queue.
+  unlock:
+    if: github.event_name != 'pull_request' && always()
+    # Modify this list to add or remove jobs from required status checks.
+    needs:
+      - lint
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      statuses: write
+    steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          RESULTS: ${{ toJSON(needs.*.result) }}
+        with:
+          script: |
+            const { serverUrl, repo, runId, payload } = context
+            const target_url =
+              `${serverUrl}/${repo.owner}/${repo.repo}/actions/runs/${runId}`
+            await github.rest.repos.createCommitStatus({
+              ...repo,
+              sha: payload.merge_group.head_sha,
+              // WARNING:
+              // Do NOT change the name of this, otherwise the rule will not catch it anymore.
+              // This would prevent all PRs from merging.
+              context: 'no PR failures',
+              state: JSON.parse(process.env.RESULTS).every(result => result == 'success') ? 'success' : 'error',
+              target_url,
+            })

.github/workflows/periodic-merge-24h.yml

@@ -0,0 +1,46 @@
+# This action periodically merges base branches into staging branches.
+# This is done to
+#  * prevent conflicts or rather resolve them early
+#  * make all potential breakage happen on the staging branch
+#  * and make sure that all major rebuilds happen before the staging
+#    branch get’s merged back into its base branch.
+
+name: "Periodic Merges (24h)"
+
+on:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    # Merge every 24 hours
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  periodic-merge:
+    if: github.repository_owner == 'NixOS'
+    strategy:
+      # don't fail fast, so that all pairs are tried
+      fail-fast: false
+      # certain branches need to be merged in order, like master->staging-next->staging
+      # and disabling parallelism ensures the order of the pairs below.
+      max-parallel: 1
+      matrix:
+        pairs:
+          - from: release-25.05
+            into: staging-next-25.05
+          - from: staging-next-25.05
+            into: staging-25.05
+          - name: merge-base(master,staging) → haskell-updates
+            from: master staging
+            into: haskell-updates
+    uses: ./.github/workflows/periodic-merge.yml
+    with:
+      from: ${{ matrix.pairs.from }}
+      into: ${{ matrix.pairs.into }}
+    name: ${{ matrix.pairs.name || format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
+    secrets: inherit

.github/workflows/periodic-merge-6h.yml

@@ -0,0 +1,45 @@
+# This action periodically merges base branches into staging branches.
+# This is done to
+#  * prevent conflicts or rather resolve them early
+#  * make all potential breakage happen on the staging branch
+#  * and make sure that all major rebuilds happen before the staging
+#    branch get’s merged back into its base branch.
+
+name: "Periodic Merges (6h)"
+
+on:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    # Merge every 6 hours
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  periodic-merge:
+    if: github.repository_owner == 'NixOS'
+    strategy:
+      # don't fail fast, so that all pairs are tried
+      fail-fast: false
+      # certain branches need to be merged in order, like master->staging-next->staging
+      # and disabling parallelism ensures the order of the pairs below.
+      max-parallel: 1
+      matrix:
+        pairs:
+          - from: master
+            into: staging-next
+          - from: staging-next
+            into: staging
+          - from: master
+            into: staging-nixos
+    uses: ./.github/workflows/periodic-merge.yml
+    with:
+      from: ${{ matrix.pairs.from }}
+      into: ${{ matrix.pairs.into }}
+    name: ${{ format('{0} → {1}', matrix.pairs.from, matrix.pairs.into) }}
+    secrets: inherit

.github/workflows/periodic-merge.yml

@@ -0,0 +1,64 @@
+name: "Merge"
+
+on:
+  workflow_call:
+    inputs:
+      from:
+        description: Branch to merge into target branch. Can also be two branches separated by space to find the merge base between them.
+        required: true
+        type: string
+      into:
+        description: Target branch to merge into.
+        required: true
+        type: string
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  merge:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 5
+    steps:
+      # Use a GitHub App to create the PR so that CI gets triggered
+      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Find merge base between two branches
+        if: contains(inputs.from, ' ')
+        id: merge_base
+        env:
+          branches: ${{ inputs.from }}
+        run: |
+          # turn into bash array, split on space
+          read -ra branches <<< "$branches"
+          git fetch --shallow-since="1 month ago" origin "${branches[@]}"
+          merge_base="$(git merge-base "refs/remotes/origin/${branches[0]}" "refs/remotes/origin/${branches[1]}")"
+          echo "Found merge base: $merge_base" >&2
+          echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
+
+      - name: ${{ inputs.from }} → ${{ inputs.into }}
+        uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0
+        with:
+          type: now
+          from_branch: ${{ steps.merge_base.outputs.merge_base || inputs.from }}
+          target_branch: ${{ inputs.into }}
+          github_token: ${{ steps.app-token.outputs.token }}
+
+      - name: Comment on failure
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
+        if: ${{ failure() }}
+        with:
+          issue-number: 105153
+          body: |
+            Periodic merge from `${{ inputs.from }}` into `${{ inputs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
+          token: ${{ steps.app-token.outputs.token }}

.github/workflows/pr.yml

@@ -0,0 +1,154 @@
+name: PR
+
+on:
+  pull_request_target:
+  workflow_call:
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+      NIXPKGS_CI_APP_PRIVATE_KEY:
+        required: true
+      OWNER_APP_PRIVATE_KEY:
+        # The Test workflow should not actually request reviews from owners.
+        required: false
+
+concurrency:
+  group: pr-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      # wrong branch review comment
+      pull-requests: write
+    outputs:
+      baseBranch: ${{ steps.prepare.outputs.base }}
+      headBranch: ${{ steps.prepare.outputs.head }}
+      mergedSha: ${{ steps.prepare.outputs.mergedSha }}
+      targetSha: ${{ steps.prepare.outputs.targetSha }}
+      systems: ${{ steps.prepare.outputs.systems }}
+      touched: ${{ steps.prepare.outputs.touched }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout-cone-mode: true # default, for clarity
+          sparse-checkout: |
+            ci/github-script
+      - id: prepare
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            require('./ci/github-script/prepare.js')({
+              github,
+              context,
+              core,
+              dry: context.eventName == 'pull_request',
+            })
+
+  check:
+    name: Check
+    needs: [prepare]
+    uses: ./.github/workflows/check.yml
+    permissions:
+      # cherry-picks
+      pull-requests: write
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
+      headBranch: ${{ needs.prepare.outputs.headBranch }}
+      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
+      targetSha: ${{ needs.prepare.outputs.targetSha }}
+
+  lint:
+    name: Lint
+    needs: [prepare]
+    uses: ./.github/workflows/lint.yml
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
+      targetSha: ${{ needs.prepare.outputs.targetSha }}
+
+  eval:
+    name: Eval
+    needs: [prepare]
+    uses: ./.github/workflows/eval.yml
+    permissions:
+      # compare
+      statuses: write
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
+      targetSha: ${{ needs.prepare.outputs.targetSha }}
+      systems: ${{ needs.prepare.outputs.systems }}
+      testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
+
+  labels:
+    name: Labels
+    needs: [prepare, eval]
+    uses: ./.github/workflows/labels.yml
+    permissions:
+      issues: write
+      pull-requests: write
+    secrets:
+      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+    with:
+      headBranch: ${{ needs.prepare.outputs.headBranch }}
+
+  reviewers:
+    name: Reviewers
+    needs: [prepare, eval]
+    if: |
+      needs.prepare.outputs.targetSha &&
+      !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development')
+    uses: ./.github/workflows/reviewers.yml
+    secrets:
+      OWNER_APP_PRIVATE_KEY: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+
+  build:
+    name: Build
+    needs: [prepare]
+    uses: ./.github/workflows/build.yml
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      baseBranch: ${{ needs.prepare.outputs.baseBranch }}
+      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
+
+  # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
+  # It "needs" all the jobs that should block merging a PR.
+  unlock:
+    if: github.event_name != 'pull_request' && always()
+    # Modify this list to add or remove jobs from required status checks.
+    needs:
+      - check
+      - lint
+      - eval
+      - build
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      statuses: write
+    steps:
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        env:
+          RESULTS: ${{ toJSON(needs.*.result) }}
+        with:
+          script: |
+            const { serverUrl, repo, runId, payload } = context
+            const target_url =
+              `${serverUrl}/${repo.owner}/${repo.repo}/actions/runs/${runId}?pr=${payload.pull_request.number}`
+            await github.rest.repos.createCommitStatus({
+              ...repo,
+              sha: payload.pull_request.head.sha,
+              // WARNING:
+              // Do NOT change the name of this, otherwise the rule will not catch it anymore.
+              // This would prevent all PRs from merging.
+              context: 'no PR failures',
+              state: JSON.parse(process.env.RESULTS).every(status => status == 'success') ? 'success' : 'error',
+              target_url,
+            })

.github/workflows/push.yml

@@ -0,0 +1,50 @@
+name: Push
+
+on:
+  push:
+    branches:
+      - master
+      - staging
+      - release-*
+      - staging-*
+      - haskell-updates
+  workflow_call:
+    inputs:
+      mergedSha:
+        required: true
+        type: string
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
+
+permissions: {}
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04-arm
+    outputs:
+      systems: ${{ steps.systems.outputs.systems }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout: |
+            ci/supportedSystems.json
+
+      - name: Load supported systems
+        id: systems
+        run: |
+          echo "systems=$(jq -c <ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"
+
+  eval:
+    name: Eval
+    needs: [prepare]
+    uses: ./.github/workflows/eval.yml
+    # Those are not actually used on push, but will throw an error if not set.
+    permissions:
+      # compare
+      statuses: write
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      mergedSha: ${{ inputs.mergedSha || github.sha }}
+      systems: ${{ needs.prepare.outputs.systems }}

.github/workflows/review-dismissed.yml

@@ -0,0 +1,17 @@
+name: Review dismissed
+
+on:
+  pull_request_review:
+    types: [dismissed]
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  trigger:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - run: echo This is a no-op only used as a trigger for workflow_run.

.github/workflows/reviewers.yml

@@ -0,0 +1,170 @@
+# This workflow will request reviews from the maintainers of each package
+# listed in the PR's most recent eval comparison artifact.
+
+name: Reviewers
+
+on:
+  pull_request_target:
+    types: [ready_for_review]
+  workflow_call:
+    secrets:
+      OWNER_APP_PRIVATE_KEY:
+        required: true
+
+concurrency:
+  group: reviewers-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  request:
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 20
+    steps:
+      - name: Check out the PR at the base commit
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: trusted
+          sparse-checkout: ci
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
+
+      - name: Build the requestReviews derivation
+        run: nix-build trusted/ci -A requestReviews
+
+      # For requesting reviewers, this job depends on a GitHub App with the following permissions:
+      # - Permissions:
+      #   - Repository > Administration: read-only
+      #   - Organization > Members: read-only
+      #   - Repository > Pull Requests: read-write
+      # - Install App on this repository, setting these variables:
+      #   - OWNER_APP_ID (variable)
+      #   - OWNER_APP_PRIVATE_KEY (secret)
+      #
+      # Can't use the token received from permissions above, because it can't get enough permissions.
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
+        if: github.event_name == 'pull_request_target' && vars.OWNER_APP_ID
+        id: app-token
+        with:
+          app-id: ${{ vars.OWNER_APP_ID }}
+          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+          permission-administration: read
+          permission-members: read
+          permission-pull-requests: write
+
+      - name: Log current API rate limits (app-token)
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Requesting code owner reviews
+        if: steps.app-token.outputs.token
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPOSITORY: ${{ github.repository }}
+          NUMBER: ${{ github.event.number }}
+          # Don't do anything on draft PRs
+          DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
+        run: result/bin/request-code-owner-reviews.sh "$REPOSITORY" "$NUMBER" ci/OWNERS
+
+      - name: Log current API rate limits (app-token)
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
+      # In the regular case, this workflow is called via workflow_call from the eval workflow directly.
+      # In the more special case, when a PR is undrafted an eval run will have started already.
+      - name: Wait for comparison to be done
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        id: eval
+        with:
+          script: |
+            const run_id = (await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: context.eventName === 'pull_request' ? 'test.yml' : 'pr.yml',
+              event: context.eventName,
+              head_sha: context.payload.pull_request.head.sha
+            })).data.workflow_runs[0].id
+
+            core.setOutput('run-id', run_id)
+
+            // Waiting 120 * 5 sec = 10 min. max.
+            // The extreme case is an Eval run that just started when the PR is undrafted.
+            // Eval takes max 5-6 minutes, normally.
+            for (let i = 0; i < 120; i++) {
+              const result = await github.rest.actions.listWorkflowRunArtifacts({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id,
+                name: 'comparison'
+              })
+              if (result.data.total_count > 0) return
+              await new Promise(resolve => setTimeout(resolve, 5000))
+            }
+            throw new Error("No comparison artifact found.")
+
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Download the comparison results
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          run-id: ${{ steps.eval.outputs.run-id }}
+          github-token: ${{ github.token }}
+          pattern: comparison
+          path: comparison
+          merge-multiple: true
+
+      - name: Log current API rate limits (app-token)
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Requesting maintainer reviews
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          NUMBER: ${{ github.event.number }}
+          AUTHOR: ${{ github.event.pull_request.user.login }}
+          # Don't request reviewers on draft PRs
+          DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
+        run: |
+          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
+          # There appears to be no API to request reviews based on GitHub IDs
+          jq -r 'keys[]' comparison/maintainers.json \
+            | while read -r id; do gh api /user/"$id" --jq .login; done \
+            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
+
+      - name: Log current API rate limits (app-token)
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: gh api /rate_limit | jq
+
+      - name: Log current API rate limits (github.token)
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh api /rate_limit | jq

.github/workflows/test.yml

@@ -0,0 +1,113 @@
+name: Test
+
+on:
+  pull_request:
+
+concurrency:
+  group: test-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  prepare:
+    runs-on: ubuntu-24.04-arm
+    outputs:
+      merge-group: ${{ steps.files.outputs.merge-group }}
+      mergedSha: ${{ steps.prepare.outputs.mergedSha }}
+      pr: ${{ steps.files.outputs.pr }}
+      push: ${{ steps.files.outputs.push }}
+      targetSha: ${{ steps.prepare.outputs.targetSha }}
+    steps:
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          sparse-checkout-cone-mode: true # default, for clarity
+          sparse-checkout: |
+            ci/github-script
+      - id: prepare
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            require('./ci/github-script/prepare.js')({
+              github,
+              context,
+              core,
+              // Review comments will be posted by the main PR workflow on the pull_request_target event.
+              dry: false,
+            })
+
+      - name: Determine changed files
+        id: files
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+        with:
+          script: |
+            const files = (await github.paginate(github.rest.pulls.listFiles, {
+              ...context.repo,
+              pull_number: context.payload.pull_request.number,
+              per_page: 100,
+            })).map(file => file.filename)
+
+            if (files.some(file => [
+              '.github/workflows/lint.yml',
+              '.github/workflows/merge-group.yml',
+              '.github/workflows/test.yml',
+            ].includes(file))) core.setOutput('merge-group', true)
+
+            if (files.some(file => [
+              '.github/actions/checkout/action.yml',
+              '.github/workflows/build.yml',
+              '.github/workflows/check.yml',
+              '.github/workflows/eval.yml',
+              '.github/workflows/labels.yml',
+              '.github/workflows/lint.yml',
+              '.github/workflows/pr.yml',
+              '.github/workflows/reviewers.yml',
+              '.github/workflows/test.yml',
+            ].includes(file))) core.setOutput('pr', true)
+
+            if (files.some(file => [
+              '.github/workflows/eval.yml',
+              '.github/workflows/push.yml',
+              '.github/workflows/test.yml',
+            ].includes(file))) core.setOutput('push', true)
+
+  merge-group:
+    if: needs.prepare.outputs.merge-group
+    name: Merge Group
+    needs: [prepare]
+    uses: ./.github/workflows/merge-group.yml
+    # Those are actually only used on the merge_group event, but will throw an error if not set.
+    permissions:
+      statuses: write
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      mergedSha: ${{ needs.prepare.outputs.mergedSha }}
+      targetSha: ${{ needs.prepare.outputs.targetSha }}
+
+  pr:
+    if: needs.prepare.outputs.pr
+    name: PR
+    needs: [prepare]
+    uses: ./.github/workflows/pr.yml
+    # Those are actually only used on the pull_request_target event, but will throw an error if not set.
+    permissions:
+      issues: write
+      pull-requests: write
+      statuses: write
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+      NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+
+  push:
+    if: needs.prepare.outputs.push
+    name: Push
+    needs: [prepare]
+    uses: ./.github/workflows/push.yml
+    # Those are not actually used on the push or pull_request events, but will throw an error if not set.
+    permissions:
+      statuses: write
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+    with:
+      mergedSha: ${{ needs.prepare.outputs.mergedSha }}