push sheeet

ci/github-script/.editorconfig

@@ -0,0 +1,3 @@
+[run]
+indent_style = space
+indent_size = 2

ci/github-script/.gitignore

@@ -0,0 +1,2 @@
+node_modules
+step-summary.md

ci/github-script/.npmrc

@@ -0,0 +1,2 @@
+package-lock-only = true
+save-exact = true

ci/github-script/README.md

@@ -0,0 +1,17 @@
+# GitHub specific CI scripts
+
+This folder contains [`actions/github-script`](https://github.com/actions/github-script)-based JavaScript code.
+It provides a `nix-shell` environment to run and test these actions locally.
+
+To run any of the scripts locally:
+
+- Enter `nix-shell` in `./ci/github-script`.
+- Ensure `gh` is authenticated.
+
+## Check commits
+
+Run `./run commits OWNER REPO PR`, where OWNER is your username or "NixOS", REPO is the name of your fork or "nixpkgs" and PR is the number of the pull request to check.
+
+## Labeler
+
+Run `./run labels OWNER REPO`, where OWNER is your username or "NixOS" and REPO the name of your fork or "nixpkgs".

ci/github-script/commits.js

@@ -0,0 +1,321 @@
+module.exports = async ({ github, context, core, dry, cherryPicks }) => {
+  const { execFileSync } = require('node:child_process')
+  const { classify } = require('../supportedBranches.js')
+  const withRateLimit = require('./withRateLimit.js')
+  const { dismissReviews, postReview } = require('./reviews.js')
+
+  await withRateLimit({ github, core }, async (stats) => {
+    stats.prs = 1
+
+    const pull_number = context.payload.pull_request.number
+
+    const job_url =
+      context.runId &&
+      (
+        await github.paginate(github.rest.actions.listJobsForWorkflowRun, {
+          ...context.repo,
+          run_id: context.runId,
+          per_page: 100,
+        })
+      ).find(({ name }) => name.endsWith('Check / commits')).html_url +
+        '?pr=' +
+        pull_number
+
+    async function extract({ sha, commit }) {
+      const noCherryPick = Array.from(
+        commit.message.matchAll(/^Not-cherry-picked-because: (.*)$/gm),
+      ).at(0)
+
+      if (noCherryPick)
+        return {
+          sha,
+          commit,
+          severity: 'important',
+          message: `${sha} is not a cherry-pick, because: ${noCherryPick[1]}. Please review this commit manually.`,
+          type: 'no-cherry-pick',
+        }
+
+      // Using the last line with "cherry" + hash, because a chained backport
+      // can result in multiple of those lines. Only the last one counts.
+      const cherry = Array.from(
+        commit.message.matchAll(/cherry.*([0-9a-f]{40})/g),
+      ).at(-1)
+
+      if (!cherry)
+        return {
+          sha,
+          commit,
+          severity: 'warning',
+          message: `Couldn't locate original commit hash in message of ${sha}.`,
+          type: 'no-commit-hash',
+        }
+
+      const original_sha = cherry[1]
+
+      let branches
+      try {
+        branches = (
+          await github.request({
+            // This is an undocumented endpoint to fetch the branches a commit is part of.
+            // There is no equivalent in neither the REST nor the GraphQL API.
+            // The endpoint itself is unlikely to go away, because GitHub uses it to display
+            // the list of branches on the detail page of a commit.
+            url: `https://github.com/${context.repo.owner}/${context.repo.repo}/branch_commits/${original_sha}`,
+            headers: {
+              accept: 'application/json',
+            },
+          })
+        ).data.branches
+          .map(({ branch }) => branch)
+          .filter((branch) => classify(branch).type.includes('development'))
+      } catch (e) {
+        // For some unknown reason a 404 error comes back as 500 without any more details in a GitHub Actions runner.
+        // Ignore these to return a regular error message below.
+        if (![404, 500].includes(e.status)) throw e
+      }
+      if (!branches?.length)
+        return {
+          sha,
+          commit,
+          severity: 'error',
+          message: `${original_sha} given in ${sha} not found in any pickable branch.`,
+        }
+
+      return {
+        sha,
+        commit,
+        original_sha,
+      }
+    }
+
+    function diff({ sha, commit, original_sha }) {
+      const diff = execFileSync('git', [
+        '-C',
+        __dirname,
+        'range-diff',
+        '--no-color',
+        '--ignore-all-space',
+        '--no-notes',
+        // 100 means "any change will be reported"; 0 means "no change will be reported"
+        '--creation-factor=100',
+        `${original_sha}~..${original_sha}`,
+        `${sha}~..${sha}`,
+      ])
+        .toString()
+        .split('\n')
+        // First line contains commit SHAs, which we'll print separately.
+        .slice(1)
+        // # The output of `git range-diff` is indented with 4 spaces, but we'll control indentation manually.
+        .map((line) => line.replace(/^ {4}/, ''))
+
+      if (!diff.some((line) => line.match(/^[+-]{2}/)))
+        return {
+          sha,
+          commit,
+          severity: 'info',
+          message: `✔ ${original_sha} is highly similar to ${sha}.`,
+        }
+
+      const colored_diff = execFileSync('git', [
+        '-C',
+        __dirname,
+        'range-diff',
+        '--color',
+        '--no-notes',
+        '--creation-factor=100',
+        `${original_sha}~..${original_sha}`,
+        `${sha}~..${sha}`,
+      ]).toString()
+
+      return {
+        sha,
+        commit,
+        diff,
+        colored_diff,
+        severity: 'warning',
+        message: `Difference between ${sha} and original ${original_sha} may warrant inspection.`,
+        type: 'diff',
+      }
+    }
+
+    // For now we short-circuit the list of commits when cherryPicks should not be checked.
+    // This will not run any checks, but still trigger the "dismiss reviews" part below.
+    const commits = !cherryPicks
+      ? []
+      : await github.paginate(github.rest.pulls.listCommits, {
+          ...context.repo,
+          pull_number,
+        })
+
+    const extracted = await Promise.all(commits.map(extract))
+
+    const fetch = extracted
+      .filter(({ severity }) => !severity)
+      .flatMap(({ sha, original_sha }) => [sha, original_sha])
+
+    if (fetch.length > 0) {
+      // Fetching all commits we need for diff at once is much faster than any other method.
+      execFileSync('git', [
+        '-C',
+        __dirname,
+        'fetch',
+        '--depth=2',
+        'origin',
+        ...fetch,
+      ])
+    }
+
+    const results = extracted.map((result) =>
+      result.severity ? result : diff(result),
+    )
+
+    // Log all results without truncation, with better highlighting and all whitespace changes to the job log.
+    results.forEach(({ sha, commit, severity, message, colored_diff }) => {
+      core.startGroup(`Commit ${sha}`)
+      core.info(`Author: ${commit.author.name} ${commit.author.email}`)
+      core.info(`Date: ${new Date(commit.author.date)}`)
+      switch (severity) {
+        case 'error':
+          core.error(message)
+          break
+        case 'warning':
+          core.warning(message)
+          break
+        default:
+          core.info(message)
+      }
+      core.endGroup()
+      if (colored_diff) core.info(colored_diff)
+    })
+
+    // Only create step summary below in case of warnings or errors.
+    // Also clean up older reviews, when all checks are good now.
+    // An empty results array will always trigger this condition, which is helpful
+    // to clean up reviews created by the prepare step when on the wrong branch.
+    if (results.every(({ severity }) => severity === 'info')) {
+      await dismissReviews({ github, context, dry })
+      return
+    }
+
+    // In the case of "error" severity, we also fail the job.
+    // Those should be considered blocking and not be dismissable via review.
+    if (results.some(({ severity }) => severity === 'error'))
+      process.exitCode = 1
+
+    core.summary.addRaw(
+      'This report is automatically generated by the `PR / Check / cherry-pick` CI workflow.',
+      true,
+    )
+    core.summary.addEOL()
+    core.summary.addRaw(
+      "Some of the commits in this PR require the author's and reviewer's attention.",
+      true,
+    )
+    core.summary.addEOL()
+
+    if (results.some(({ type }) => type === 'no-commit-hash')) {
+      core.summary.addRaw(
+        'Please follow the [backporting guidelines](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#how-to-backport-pull-requests) and cherry-pick with the `-x` flag.',
+        true,
+      )
+      core.summary.addRaw(
+        'This requires changes to the unstable `master` and `staging` branches first, before backporting them.',
+        true,
+      )
+      core.summary.addEOL()
+      core.summary.addRaw(
+        'Occasionally, commits are not cherry-picked at all, for example when updating minor versions of packages which have already advanced to the next major on unstable.',
+        true,
+      )
+      core.summary.addRaw(
+        'These commits can optionally be marked with a `Not-cherry-picked-because: <reason>` footer.',
+        true,
+      )
+      core.summary.addEOL()
+    }
+
+    if (results.some(({ type }) => type === 'diff')) {
+      core.summary.addRaw(
+        'Sometimes it is not possible to cherry-pick exactly the same patch.',
+        true,
+      )
+      core.summary.addRaw(
+        'This most frequently happens when resolving merge conflicts.',
+        true,
+      )
+      core.summary.addRaw(
+        'The range-diff will help to review the resolution of conflicts.',
+        true,
+      )
+      core.summary.addEOL()
+    }
+
+    core.summary.addRaw(
+      'If you need to merge this PR despite the warnings, please [dismiss](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/dismissing-a-pull-request-review) this review shortly before merging.',
+      true,
+    )
+
+    results.forEach(({ severity, message, diff }) => {
+      if (severity === 'info') return
+
+      // The docs for markdown alerts only show examples with markdown blockquote syntax, like this:
+      //   > [!WARNING]
+      //   > message
+      // However, our testing shows that this also works with a `<blockquote>` html tag, as long as there
+      // is an empty line:
+      //   <blockquote>
+      //
+      //   [!WARNING]
+      //   message
+      //   </blockquote>
+      // Whether this is intended or just an implementation detail is unclear.
+      core.summary.addRaw('<blockquote>')
+      core.summary.addRaw(
+        `\n\n[!${{ important: 'IMPORTANT', warning: 'WARNING', error: 'CAUTION' }[severity]}]`,
+        true,
+      )
+      core.summary.addRaw(`${message}`, true)
+
+      if (diff) {
+        // Limit the output to 10k bytes and remove the last, potentially incomplete line, because GitHub
+        // comments are limited in length. The value of 10k is arbitrary with the assumption, that after
+        // the range-diff becomes a certain size, a reviewer is better off reviewing the regular diff in
+        // GitHub's UI anyway, thus treating the commit as "new" and not cherry-picked.
+        // Note: if multiple commits are close to the limit, this approach could still lead to a comment
+        // that's too long. We think this is unlikely to happen, and so don't deal with it explicitly.
+        const truncated = []
+        let total_length = 0
+        for (line of diff) {
+          total_length += line.length
+          if (total_length > 10000) {
+            truncated.push('', '[...truncated...]')
+            break
+          } else {
+            truncated.push(line)
+          }
+        }
+
+        core.summary.addRaw('<details><summary>Show diff</summary>')
+        core.summary.addRaw('\n\n``````````diff', true)
+        core.summary.addRaw(truncated.join('\n'), true)
+        core.summary.addRaw('``````````', true)
+        core.summary.addRaw('</details>')
+      }
+
+      core.summary.addRaw('</blockquote>')
+    })
+
+    if (job_url)
+      core.summary.addRaw(
+        `\n\n_Hint: The full diffs are also available in the [runner logs](${job_url}) with slightly better highlighting._`,
+      )
+
+    const body = core.summary.stringify()
+    core.summary.write()
+
+    // Posting a review could fail for very long comments. This can only happen with
+    // multiple commits all hitting the truncation limit for the diff. If you ever hit
+    // this case, consider just splitting up those commits into multiple PRs.
+    await postReview({ github, context, core, dry, body })
+  })
+}

ci/github-script/labels.js

@@ -0,0 +1,472 @@
+module.exports = async ({ github, context, core, dry }) => {
+  const path = require('node:path')
+  const { DefaultArtifactClient } = require('@actions/artifact')
+  const { readFile, writeFile } = require('node:fs/promises')
+  const withRateLimit = require('./withRateLimit.js')
+
+  const artifactClient = new DefaultArtifactClient()
+
+  async function handlePullRequest({ item, stats }) {
+    const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
+
+    const pull_number = item.number
+
+    // This API request is important for the merge-conflict label, because it triggers the
+    // creation of a new test merge commit. This is needed to actually determine the state of a PR.
+    const pull_request = (
+      await github.rest.pulls.get({
+        ...context.repo,
+        pull_number,
+      })
+    ).data
+
+    const reviews = await github.paginate(github.rest.pulls.listReviews, {
+      ...context.repo,
+      pull_number,
+    })
+
+    const approvals = new Set(
+      reviews
+        .filter((review) => review.state === 'APPROVED')
+        .map((review) => review.user?.id),
+    )
+
+    // After creation of a Pull Request, `merge_commit_sha` will be null initially:
+    // The very first merge commit will only be calculated after a little while.
+    // To avoid labeling the PR as conflicted before that, we wait a few minutes.
+    // This is intentionally less than the time that Eval takes, so that the label job
+    // running after Eval can indeed label the PR as conflicted if that is the case.
+    const merge_commit_sha_valid =
+      Date.now() - new Date(pull_request.created_at) > 3 * 60 * 1000
+
+    const prLabels = {
+      // We intentionally don't use the mergeable or mergeable_state attributes.
+      // Those have an intermediate state while the test merge commit is created.
+      // This doesn't work well for us, because we might have just triggered another
+      // test merge commit creation by request the pull request via API at the start
+      // of this function.
+      // The attribute merge_commit_sha keeps the old value of null or the hash *until*
+      // the new test merge commit has either successfully been created or failed so.
+      // This essentially means we are updating the merge conflict label in two steps:
+      // On the first pass of the day, we just fetch the pull request, which triggers
+      // the creation. At this stage, the label is likely not updated, yet.
+      // The second pass will then read the result from the first pass and set the label.
+      '2.status: merge conflict':
+        merge_commit_sha_valid && !pull_request.merge_commit_sha,
+      '12.approvals: 1': approvals.size === 1,
+      '12.approvals: 2': approvals.size === 2,
+      '12.approvals: 3+': approvals.size >= 3,
+      '12.first-time contribution': [
+        'NONE',
+        'FIRST_TIMER',
+        'FIRST_TIME_CONTRIBUTOR',
+      ].includes(pull_request.author_association),
+    }
+
+    const { id: run_id, conclusion } =
+      (
+        await github.rest.actions.listWorkflowRuns({
+          ...context.repo,
+          workflow_id: 'pr.yml',
+          event: 'pull_request_target',
+          exclude_pull_requests: true,
+          head_sha: pull_request.head.sha,
+        })
+      ).data.workflow_runs[0] ??
+      // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
+      (
+        await github.rest.actions.listWorkflowRuns({
+          ...context.repo,
+          // In older PRs, we need eval.yml instead of pr.yml.
+          workflow_id: 'eval.yml',
+          event: 'pull_request_target',
+          status: 'success',
+          exclude_pull_requests: true,
+          head_sha: pull_request.head.sha,
+        })
+      ).data.workflow_runs[0] ??
+      {}
+
+    // Newer PRs might not have run Eval to completion, yet.
+    // Older PRs might not have an eval.yml workflow, yet.
+    // In either case we continue without fetching an artifact on a best-effort basis.
+    log('Last eval run', run_id ?? '<n/a>')
+
+    if (conclusion === 'success') {
+      // Check for any human reviews other than GitHub actions and other GitHub apps.
+      // Accounts could be deleted as well, so don't count them.
+      const humanReviews = reviews.filter(
+        (r) =>
+          r.user && !r.user.login.endsWith('[bot]') && r.user.type !== 'Bot',
+      )
+
+      Object.assign(prLabels, {
+        // We only set this label if the latest eval run was successful, because if it was not, it
+        // *could* have requested reviewers. We will let the PR author fix CI first, before "escalating"
+        // this PR to "needs: reviewer".
+        // Since the first Eval run on a PR always sets rebuild labels, the same PR will be "recently
+        // updated" for the next scheduled run. Thus, this label will still be set within a few minutes
+        // after a PR is created, if required.
+        // Note that a "requested reviewer" disappears once they have given a review, so we check
+        // existing reviews, too.
+        '9.needs: reviewer':
+          !pull_request.draft &&
+          pull_request.requested_reviewers.length === 0 &&
+          humanReviews.length === 0,
+      })
+    }
+
+    const artifact =
+      run_id &&
+      (
+        await github.rest.actions.listWorkflowRunArtifacts({
+          ...context.repo,
+          run_id,
+          name: 'comparison',
+        })
+      ).data.artifacts[0]
+
+    // Instead of checking the boolean artifact.expired, we will give us a minute to
+    // actually download the artifact in the next step and avoid that race condition.
+    // Older PRs, where the workflow run was already eval.yml, but the artifact was not
+    // called "comparison", yet, will skip the download.
+    const expired =
+      !artifact ||
+      new Date(artifact?.expires_at ?? 0) < new Date(Date.now() + 60 * 1000)
+    log('Artifact expires at', artifact?.expires_at ?? '<n/a>')
+    if (!expired) {
+      stats.artifacts++
+
+      await artifactClient.downloadArtifact(artifact.id, {
+        findBy: {
+          repositoryName: context.repo.repo,
+          repositoryOwner: context.repo.owner,
+          token: core.getInput('github-token'),
+        },
+        path: path.resolve(pull_number.toString()),
+        expectedHash: artifact.digest,
+      })
+
+      const maintainers = new Set(
+        Object.keys(
+          JSON.parse(
+            await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
+          ),
+        ).map((m) => Number.parseInt(m, 10)),
+      )
+
+      const evalLabels = JSON.parse(
+        await readFile(`${pull_number}/changed-paths.json`, 'utf-8'),
+      ).labels
+
+      Object.assign(
+        prLabels,
+        // Ignore `evalLabels` if it's an array.
+        // This can happen for older eval runs, before we switched to objects.
+        // The old eval labels would have been set by the eval run,
+        // so now they'll be present in `before`.
+        // TODO: Simplify once old eval results have expired (~2025-10)
+        Array.isArray(evalLabels) ? undefined : evalLabels,
+        {
+          '12.approved-by: package-maintainer': Array.from(maintainers).some(
+            (m) => approvals.has(m),
+          ),
+        },
+      )
+    }
+
+    return prLabels
+  }
+
+  // Returns true if the issue was closed. In this case, the labeling does not need to
+  // continue for this issue. Returns false if no action was taken.
+  async function handleAutoClose(item) {
+    const issue_number = item.number
+
+    if (item.labels.some(({ name }) => name === '0.kind: packaging request')) {
+      const body = [
+        'Thank you for your interest in packaging new software in Nixpkgs. Unfortunately, to mitigate the unsustainable growth of unmaintained packages, **Nixpkgs is no longer accepting package requests** via Issues.',
+        '',
+        'As a [volunteer community][community], we are always open to new contributors. If you wish to see this package in Nixpkgs, **we encourage you to [contribute] it yourself**, via a Pull Request. Anyone can [become a package maintainer][maintainers]! You can find language-specific packaging information in the [Nixpkgs Manual][nixpkgs]. Should you need any help, please reach out to the community on [Matrix] or [Discourse].',
+        '',
+        '[community]: https://nixos.org/community',
+        '[contribute]: https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#quick-start-to-adding-a-package',
+        '[maintainers]: https://github.com/NixOS/nixpkgs/blob/master/maintainers/README.md',
+        '[nixpkgs]: https://nixos.org/manual/nixpkgs/unstable/',
+        '[Matrix]: https://matrix.to/#/#dev:nixos.org',
+        '[Discourse]: https://discourse.nixos.org/c/dev/14',
+      ].join('\n')
+
+      core.info(`Issue #${item.number}: auto-closed`)
+
+      if (!dry) {
+        await github.rest.issues.createComment({
+          ...context.repo,
+          issue_number,
+          body,
+        })
+
+        await github.rest.issues.update({
+          ...context.repo,
+          issue_number,
+          state: 'closed',
+          state_reason: 'not_planned',
+        })
+      }
+
+      return true
+    }
+    return false
+  }
+
+  async function handle({ item, stats }) {
+    try {
+      const log = (k, v, skip) => {
+        core.info(`#${item.number} - ${k}: ${v}${skip ? ' (skipped)' : ''}`)
+        return skip
+      }
+
+      log('Last updated at', item.updated_at)
+      log('URL', item.html_url)
+
+      const issue_number = item.number
+
+      const itemLabels = {}
+
+      if (item.pull_request || context.payload.pull_request) {
+        stats.prs++
+        Object.assign(itemLabels, await handlePullRequest({ item, stats }))
+      } else {
+        stats.issues++
+        if (item.labels.some(({ name }) => name === '4.workflow: auto-close')) {
+          // If this returns true, the issue was closed. In this case we return, to not
+          // label the issue anymore. Most importantly this avoids unlabeling stale issues
+          // which are closed via auto-close.
+          if (await handleAutoClose(item)) return
+        }
+      }
+
+      const latest_event_at = new Date(
+        (
+          await github.paginate(github.rest.issues.listEventsForTimeline, {
+            ...context.repo,
+            issue_number,
+            per_page: 100,
+          })
+        )
+          .filter(({ event }) =>
+            [
+              // These events are hand-picked from:
+              //   https://docs.github.com/en/rest/using-the-rest-api/issue-event-types?apiVersion=2022-11-28
+              // Each of those causes a PR/issue to *not* be considered as stale anymore.
+              // Most of these use created_at.
+              'assigned',
+              'commented', // uses updated_at, because that could be > created_at
+              'committed', // uses committer.date
+              ...(item.labels.some(({ name }) => name === '5.scope: tracking')
+                ? ['cross-referenced']
+                : []),
+              'head_ref_force_pushed',
+              'milestoned',
+              'pinned',
+              'ready_for_review',
+              'renamed',
+              'reopened',
+              'review_dismissed',
+              'review_requested',
+              'reviewed', // uses submitted_at
+              'unlocked',
+              'unmarked_as_duplicate',
+            ].includes(event),
+          )
+          .map(
+            ({ created_at, updated_at, committer, submitted_at }) =>
+              new Date(
+                updated_at ?? created_at ?? submitted_at ?? committer.date,
+              ),
+          )
+          // Reverse sort by date value. The default sort() sorts by string representation, which is bad for dates.
+          .sort((a, b) => b - a)
+          .at(0) ?? item.created_at,
+      )
+      log('latest_event_at', latest_event_at.toISOString())
+
+      const stale_at = new Date(new Date().setDate(new Date().getDate() - 180))
+
+      // Create a map (Label -> Boolean) of all currently set labels.
+      // Each label is set to True and can be disabled later.
+      const before = Object.fromEntries(
+        (
+          await github.paginate(github.rest.issues.listLabelsOnIssue, {
+            ...context.repo,
+            issue_number,
+          })
+        ).map(({ name }) => [name, true]),
+      )
+
+      Object.assign(itemLabels, {
+        '2.status: stale':
+          !before['1.severity: security'] && latest_event_at < stale_at,
+      })
+
+      const after = Object.assign({}, before, itemLabels)
+
+      // No need for an API request, if all labels are the same.
+      const hasChanges = Object.keys(after).some(
+        (name) => (before[name] ?? false) !== after[name],
+      )
+      if (log('Has changes', hasChanges, !hasChanges)) return
+
+      // Skipping labeling on a pull_request event, because we have no privileges.
+      const labels = Object.entries(after)
+        .filter(([, value]) => value)
+        .map(([name]) => name)
+      if (log('Set labels', labels, dry)) return
+
+      await github.rest.issues.setLabels({
+        ...context.repo,
+        issue_number,
+        labels,
+      })
+    } catch (cause) {
+      throw new Error(`Labeling #${item.number} failed.`, { cause })
+    }
+  }
+
+  await withRateLimit({ github, core }, async (stats) => {
+    if (context.payload.pull_request) {
+      await handle({ item: context.payload.pull_request, stats })
+    } else {
+      const lastRun = (
+        await github.rest.actions.listWorkflowRuns({
+          ...context.repo,
+          workflow_id: 'labels.yml',
+          event: 'schedule',
+          status: 'success',
+          exclude_pull_requests: true,
+          per_page: 1,
+        })
+      ).data.workflow_runs[0]
+
+      const cutoff = new Date(
+        Math.max(
+          // Go back as far as the last successful run of this workflow to make sure
+          // we are not leaving anyone behind on GHA failures.
+          // Defaults to go back 1 hour on the first run.
+          new Date(
+            lastRun?.created_at ?? Date.now() - 1 * 60 * 60 * 1000,
+          ).getTime(),
+          // Go back max. 1 day to prevent hitting all API rate limits immediately,
+          // when GH API returns a wrong workflow by accident.
+          Date.now() - 24 * 60 * 60 * 1000,
+        ),
+      )
+      core.info(`cutoff timestamp: ${cutoff.toISOString()}`)
+
+      const updatedItems = await github.paginate(
+        github.rest.search.issuesAndPullRequests,
+        {
+          q: [
+            `repo:"${context.repo.owner}/${context.repo.repo}"`,
+            'is:open',
+            `updated:>=${cutoff.toISOString()}`,
+          ].join(' AND '),
+          per_page: 100,
+          // TODO: Remove in 2025-10, when it becomes the default.
+          advanced_search: true,
+        },
+      )
+
+      let cursor
+
+      // No workflow run available the first time.
+      if (lastRun) {
+        // The cursor to iterate through the full list of issues and pull requests
+        // is passed between jobs as an artifact.
+        const artifact = (
+          await github.rest.actions.listWorkflowRunArtifacts({
+            ...context.repo,
+            run_id: lastRun.id,
+            name: 'pagination-cursor',
+          })
+        ).data.artifacts[0]
+
+        // If the artifact is not available, the next iteration starts at the beginning.
+        if (artifact) {
+          stats.artifacts++
+
+          const { downloadPath } = await artifactClient.downloadArtifact(
+            artifact.id,
+            {
+              findBy: {
+                repositoryName: context.repo.repo,
+                repositoryOwner: context.repo.owner,
+                token: core.getInput('github-token'),
+              },
+              expectedHash: artifact.digest,
+            },
+          )
+
+          cursor = await readFile(path.resolve(downloadPath, 'cursor'), 'utf-8')
+        }
+      }
+
+      // From GitHub's API docs:
+      //   GitHub's REST API considers every pull request an issue, but not every issue is a pull request.
+      //   For this reason, "Issues" endpoints may return both issues and pull requests in the response.
+      //   You can identify pull requests by the pull_request key.
+      const allItems = await github.rest.issues.listForRepo({
+        ...context.repo,
+        state: 'open',
+        sort: 'created',
+        direction: 'asc',
+        per_page: 100,
+        after: cursor,
+      })
+
+      // Regex taken and comment adjusted from:
+      // https://github.com/octokit/plugin-paginate-rest.js/blob/8e5da25f975d2f31dda6b8b588d71f2c768a8df2/src/iterator.ts#L36-L41
+      // `allItems.headers.link` format:
+      //   <https://api.github.com/repositories/4542716/issues?page=3&per_page=100&after=Y3Vyc29yOnYyOpLPAAABl8qNnYDOvnSJxA%3D%3D>; rel="next",
+      //   <https://api.github.com/repositories/4542716/issues?page=1&per_page=100&before=Y3Vyc29yOnYyOpLPAAABl8xFV9DOvoouJg%3D%3D>; rel="prev"
+      // Sets `next` to undefined if "next" URL is not present or `link` header is not set.
+      const next = ((allItems.headers.link ?? '').match(
+        /<([^<>]+)>;\s*rel="next"/,
+      ) ?? [])[1]
+      if (next) {
+        cursor = new URL(next).searchParams.get('after')
+        const uploadPath = path.resolve('cursor')
+        await writeFile(uploadPath, cursor, 'utf-8')
+        if (dry) {
+          core.info(`pagination-cursor: ${cursor} (upload skipped)`)
+        } else {
+          // No stats.artifacts++, because this does not allow passing a custom token.
+          // Thus, the upload will not happen with the app token, but the default github.token.
+          await artifactClient.uploadArtifact(
+            'pagination-cursor',
+            [uploadPath],
+            path.resolve('.'),
+            {
+              retentionDays: 1,
+            },
+          )
+        }
+      }
+
+      // Some items might be in both search results, so filtering out duplicates as well.
+      const items = []
+        .concat(updatedItems, allItems.data)
+        .filter(
+          (thisItem, idx, arr) =>
+            idx ===
+            arr.findIndex((firstItem) => firstItem.number === thisItem.number),
+        )
+
+      ;(await Promise.allSettled(items.map((item) => handle({ item, stats }))))
+        .filter(({ status }) => status === 'rejected')
+        .map(({ reason }) =>
+          core.setFailed(`${reason.message}\n${reason.cause.stack}`),
+        )
+    }
+  })
+}

ci/github-script/package.json

@@ -0,0 +1,10 @@
+{
+  "private": true,
+  "dependencies": {
+    "@actions/artifact": "2.3.2",
+    "@actions/core": "1.11.1",
+    "@actions/github": "6.0.1",
+    "bottleneck": "2.19.5",
+    "commander": "14.0.0"
+  }
+}

ci/github-script/prepare.js

@@ -0,0 +1,231 @@
+const { classify } = require('../supportedBranches.js')
+const { postReview } = require('./reviews.js')
+
+module.exports = async ({ github, context, core, dry }) => {
+  const pull_number = context.payload.pull_request.number
+
+  for (const retryInterval of [5, 10, 20, 40, 80]) {
+    core.info('Checking whether the pull request can be merged...')
+    const prInfo = (
+      await github.rest.pulls.get({
+        ...context.repo,
+        pull_number,
+      })
+    ).data
+
+    if (prInfo.state !== 'open') throw new Error('PR is not open anymore.')
+
+    if (prInfo.mergeable == null) {
+      core.info(
+        `GitHub is still computing whether this PR can be merged, waiting ${retryInterval} seconds before trying again...`,
+      )
+      await new Promise((resolve) => setTimeout(resolve, retryInterval * 1000))
+      continue
+    }
+
+    const { base, head } = prInfo
+
+    const baseClassification = classify(base.ref)
+    core.setOutput('base', baseClassification)
+    console.log('base classification:', baseClassification)
+
+    const headClassification =
+      base.repo.full_name === head.repo.full_name
+        ? classify(head.ref)
+        : // PRs from forks are always considered WIP.
+          { type: ['wip'] }
+    core.setOutput('head', headClassification)
+    console.log('head classification:', headClassification)
+
+    if (baseClassification.type.includes('channel')) {
+      const { stable, version } = baseClassification
+      const correctBranch = stable ? `release-${version}` : 'master'
+      const body = [
+        'The `nixos-*` and `nixpkgs-*` branches are pushed to by the channel release script and should not be merged into directly.',
+        '',
+        `Please target \`${correctBranch}\` instead.`,
+      ].join('\n')
+
+      await postReview({ github, context, core, dry, body })
+
+      throw new Error('The PR targets a channel branch.')
+    }
+
+    if (headClassification.type.includes('wip')) {
+      // In the following, we look at the git history to determine the base branch that
+      // this Pull Request branched off of. This is *supposed* to be the branch that it
+      // merges into, but humans make mistakes. Once that happens we want to error out as
+      // early as possible.
+
+      // To determine the "real base", we are looking at the merge-base of primary development
+      // branches and the head of the PR. The merge-base which results in the least number of
+      // commits between that base and head is the real base. We can query for this via GitHub's
+      // REST API. There can be multiple candidates for the real base with the same number of
+      // commits. In this case we pick the "best" candidate by a fixed ordering of branches,
+      // as defined in ci/supportedBranches.js.
+      //
+      // These requests take a while, when comparing against the wrong release - they need
+      // to look at way more than 10k commits in that case. Thus, we try to minimize the
+      // number of requests across releases:
+      // - First, we look at the primary development branches only: master and release-xx.yy.
+      //   The branch with the fewest commits gives us the release this PR belongs to.
+      // - We then compare this number against the relevant staging branches for this release
+      //   to find the exact branch that this belongs to.
+
+      // All potential development branches
+      const branches = (
+        await github.paginate(github.rest.repos.listBranches, {
+          ...context.repo,
+          per_page: 100,
+        })
+      ).map(({ name }) => classify(name))
+
+      // All stable primary development branches from latest to oldest.
+      const releases = branches
+        .filter(({ stable, type }) => type.includes('primary') && stable)
+        .sort((a, b) => b.version.localeCompare(a.version))
+
+      async function mergeBase({ branch, order, version }) {
+        const { data } = await github.rest.repos.compareCommitsWithBasehead({
+          ...context.repo,
+          basehead: `${branch}...${head.sha}`,
+          // Pagination for this endpoint is about the commits listed, which we don't care about.
+          per_page: 1,
+          // Taking the second page skips the list of files of this changeset.
+          page: 2,
+        })
+        return {
+          branch,
+          order,
+          version,
+          commits: data.total_commits,
+          sha: data.merge_base_commit.sha,
+        }
+      }
+
+      // Multiple branches can be OK at the same time, if the PR was created of a merge-base,
+      // thus storing as array.
+      let candidates = [await mergeBase(classify('master'))]
+      for (const release of releases) {
+        const nextCandidate = await mergeBase(release)
+        if (candidates[0].commits === nextCandidate.commits)
+          candidates.push(nextCandidate)
+        if (candidates[0].commits > nextCandidate.commits)
+          candidates = [nextCandidate]
+        // The number 10000 is principally arbitrary, but the GitHub API returns this value
+        // when the number of commits exceeds it in reality. The difference between two stable releases
+        // is certainly more than 10k commits, thus this works for us as well: If we're targeting
+        // a wrong release, the number *will* be 10000.
+        if (candidates[0].commits < 10000) break
+      }
+
+      core.info(`This PR is for NixOS ${candidates[0].version}.`)
+
+      // Secondary development branches for the selected version only.
+      const secondary = branches.filter(
+        ({ branch, type, version }) =>
+          type.includes('secondary') && version === candidates[0].version,
+      )
+
+      // Make sure that we always check the current target as well, even if its a WIP branch.
+      // If it's not a WIP branch, it was already included in either releases or secondary.
+      if (classify(base.ref).type.includes('wip')) {
+        secondary.push(classify(base.ref))
+      }
+
+      for (const branch of secondary) {
+        const nextCandidate = await mergeBase(branch)
+        if (candidates[0].commits === nextCandidate.commits)
+          candidates.push(nextCandidate)
+        if (candidates[0].commits > nextCandidate.commits)
+          candidates = [nextCandidate]
+      }
+
+      // If the current branch is among the candidates, this is always better than any other,
+      // thus sorting at -1.
+      candidates = candidates
+        .map((candidate) =>
+          candidate.branch === base.ref
+            ? { ...candidate, order: -1 }
+            : candidate,
+        )
+        .sort((a, b) => a.order - b.order)
+
+      const best = candidates.at(0)
+
+      core.info('The base branches for this PR are:')
+      core.info(`github: ${base.ref}`)
+      core.info(
+        `candidates: ${candidates.map(({ branch }) => branch).join(',')}`,
+      )
+      core.info(`best candidate: ${best.branch}`)
+
+      if (best.branch !== base.ref) {
+        const current = await mergeBase(classify(base.ref))
+        const body = [
+          `The PR's base branch is set to \`${current.branch}\`, but ${current.commits === 10000 ? 'at least 10000' : current.commits - best.commits} commits from the \`${best.branch}\` branch are included. Make sure you know the [right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions), then:`,
+          `- If the changes should go to the \`${best.branch}\` branch, [change the base branch](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/changing-the-base-branch-of-a-pull-request).`,
+          `- If the changes should go to the \`${current.branch}\` branch, rebase your PR onto the correct merge-base:`,
+          '  ```bash',
+          `  # git rebase --onto $(git merge-base upstream/${current.branch} HEAD) $(git merge-base upstream/${best.branch} HEAD)`,
+          `  git rebase --onto ${current.sha} ${best.sha}`,
+          `  git push --force-with-lease`,
+          '  ```',
+        ].join('\n')
+
+        await postReview({ github, context, core, dry, body })
+
+        throw new Error(`The PR contains commits from a different base.`)
+      }
+    }
+
+    let mergedSha, targetSha
+
+    if (prInfo.mergeable) {
+      core.info('The PR can be merged.')
+
+      mergedSha = prInfo.merge_commit_sha
+      targetSha = (
+        await github.rest.repos.getCommit({
+          ...context.repo,
+          ref: prInfo.merge_commit_sha,
+        })
+      ).data.parents[0].sha
+    } else {
+      core.warning('The PR has a merge conflict.')
+
+      mergedSha = head.sha
+      targetSha = (
+        await github.rest.repos.compareCommitsWithBasehead({
+          ...context.repo,
+          basehead: `${base.sha}...${head.sha}`,
+        })
+      ).data.merge_base_commit.sha
+    }
+
+    core.info(
+      `Checking the commits:\nmerged: ${mergedSha}\ntarget: ${targetSha}`,
+    )
+    core.setOutput('mergedSha', mergedSha)
+    core.setOutput('targetSha', targetSha)
+
+    core.setOutput('systems', require('../supportedSystems.json'))
+
+    const files = (
+      await github.paginate(github.rest.pulls.listFiles, {
+        ...context.repo,
+        pull_number: context.payload.pull_request.number,
+        per_page: 100,
+      })
+    ).map((file) => file.filename)
+
+    const touched = []
+    if (files.includes('ci/pinned.json')) touched.push('pinned')
+    core.setOutput('touched', touched)
+
+    return
+  }
+  throw new Error(
+    "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com.",
+  )
+}

ci/github-script/reviews.js

@@ -0,0 +1,85 @@
+async function dismissReviews({ github, context, dry }) {
+  const pull_number = context.payload.pull_request.number
+
+  if (dry) {
+    return
+  }
+
+  await Promise.all(
+    (
+      await github.paginate(github.rest.pulls.listReviews, {
+        ...context.repo,
+        pull_number,
+      })
+    )
+      .filter((review) => review.user?.login === 'github-actions[bot]')
+      .map(async (review) => {
+        if (review.state === 'CHANGES_REQUESTED') {
+          await github.rest.pulls.dismissReview({
+            ...context.repo,
+            pull_number,
+            review_id: review.id,
+            message: 'All good now, thank you!',
+          })
+        }
+        await github.graphql(
+          `mutation($node_id:ID!) {
+            minimizeComment(input: {
+              classifier: RESOLVED,
+              subjectId: $node_id
+            })
+            { clientMutationId }
+          }`,
+          { node_id: review.node_id },
+        )
+      }),
+  )
+}
+
+async function postReview({ github, context, core, dry, body }) {
+  const pull_number = context.payload.pull_request.number
+
+  const pendingReview = (
+    await github.paginate(github.rest.pulls.listReviews, {
+      ...context.repo,
+      pull_number,
+    })
+  ).find(
+    (review) =>
+      review.user?.login === 'github-actions[bot]' &&
+      // If a review is still pending, we can just update this instead
+      // of posting a new one.
+      (review.state === 'CHANGES_REQUESTED' ||
+        // No need to post a new review, if an older one with the exact
+        // same content had already been dismissed.
+        review.body === body),
+  )
+
+  if (dry) {
+    if (pendingReview)
+      core.info(`pending review found: ${pendingReview.html_url}`)
+    else core.info('no pending review found')
+    core.info(body)
+  } else {
+    if (pendingReview) {
+      await github.rest.pulls.updateReview({
+        ...context.repo,
+        pull_number,
+        review_id: pendingReview.id,
+        body,
+      })
+    } else {
+      await github.rest.pulls.createReview({
+        ...context.repo,
+        pull_number,
+        event: 'REQUEST_CHANGES',
+        body,
+      })
+    }
+  }
+}
+
+module.exports = {
+  dismissReviews,
+  postReview,
+}

ci/github-script/run

@@ -0,0 +1,86 @@
+#!/usr/bin/env -S node --import ./run
+import { execSync } from 'node:child_process'
+import { closeSync, mkdtempSync, openSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { program } from 'commander'
+import * as core from '@actions/core'
+import { getOctokit } from '@actions/github'
+
+async function run(action, owner, repo, pull_number, options = {}) {
+  const token = execSync('gh auth token', { encoding: 'utf-8' }).trim()
+
+  const github = getOctokit(token)
+
+  const payload = !pull_number ? {} : {
+    pull_request: (await github.rest.pulls.get({
+      owner,
+      repo,
+      pull_number,
+    })).data
+  }
+
+  process.env['INPUT_GITHUB-TOKEN'] = token
+
+  closeSync(openSync('step-summary.md', 'w'))
+  process.env.GITHUB_STEP_SUMMARY = 'step-summary.md'
+
+  await action({
+    github,
+    context: {
+      payload,
+      repo: {
+        owner,
+        repo,
+      },
+    },
+    core,
+    dry: true,
+    ...options,
+  })
+}
+
+program
+  .command('prepare')
+  .description('Prepare relevant information of a pull request.')
+  .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')
+  .argument('<pr>', 'Number of the Pull Request to check')
+  .option('--no-dry', 'Make actual modifications')
+  .action(async (owner, repo, pr, options) => {
+    const prepare = (await import('./prepare.js')).default
+    await run(prepare, owner, repo, pr, options)
+  })
+
+program
+  .command('commits')
+  .description('Check commit structure of a pull request.')
+  .argument('<owner>', 'Owner of the GitHub repository to check (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to check (Example: nixpkgs)')
+  .argument('<pr>', 'Number of the Pull Request to check')
+  .option('--no-cherry-picks', 'Do not expect cherry-picks.')
+  .action(async (owner, repo, pr, options) => {
+    const commits = (await import('./commits.js')).default
+    await run(commits, owner, repo, pr, options)
+  })
+
+program
+  .command('labels')
+  .description('Manage labels on pull requests.')
+  .argument('<owner>', 'Owner of the GitHub repository to label (Example: NixOS)')
+  .argument('<repo>', 'Name of the GitHub repository to label (Example: nixpkgs)')
+  .argument('[pr]', 'Number of the Pull Request to label')
+  .option('--no-dry', 'Make actual modifications')
+  .action(async (owner, repo, pr, options) => {
+    const labels = (await import('./labels.js')).default
+    const tmp = mkdtempSync(join(tmpdir(), 'github-script-'))
+    try {
+      process.env.GITHUB_WORKSPACE = tmp
+      process.chdir(tmp)
+      await run(labels, owner, repo, pr, options)
+    } finally {
+      rmSync(tmp, { recursive: true })
+    }
+  })
+
+await program.parse()

ci/github-script/shell.nix

@@ -0,0 +1,25 @@
+{
+  system ? builtins.currentSystem,
+  pkgs ? (import ../. { inherit system; }).pkgs,
+}:
+
+pkgs.callPackage (
+  {
+    gh,
+    importNpmLock,
+    mkShell,
+    nodejs,
+  }:
+  mkShell {
+    packages = [
+      gh
+      importNpmLock.hooks.linkNodeModulesHook
+      nodejs
+    ];
+
+    npmDeps = importNpmLock.buildNodeModules {
+      npmRoot = ./.;
+      inherit nodejs;
+    };
+  }
+) { }

ci/github-script/withRateLimit.js

@@ -0,0 +1,63 @@
+module.exports = async ({ github, core }, callback) => {
+  const Bottleneck = require('bottleneck')
+
+  const stats = {
+    issues: 0,
+    prs: 0,
+    requests: 0,
+    artifacts: 0,
+  }
+
+  // Rate-Limiting and Throttling, see for details:
+  //   https://github.com/octokit/octokit.js/issues/1069#throttling
+  //   https://docs.github.com/en/rest/using-the-rest-api/best-practices-for-using-the-rest-api
+  const allLimits = new Bottleneck({
+    // Avoid concurrent requests
+    maxConcurrent: 1,
+    // Will be updated with first `updateReservoir()` call below.
+    reservoir: 0,
+  })
+  // Pause between mutative requests
+  const writeLimits = new Bottleneck({ minTime: 1000 }).chain(allLimits)
+  github.hook.wrap('request', async (request, options) => {
+    // Requests to a different host do not count against the rate limit.
+    if (options.url.startsWith('https://github.com')) return request(options)
+    // Requests to the /rate_limit endpoint do not count against the rate limit.
+    if (options.url === '/rate_limit') return request(options)
+    // Search requests are in a different resource group, which allows 30 requests / minute.
+    // We do less than a handful each run, so not implementing throttling for now.
+    if (options.url.startsWith('/search/')) return request(options)
+    stats.requests++
+    if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(options.method))
+      return writeLimits.schedule(request.bind(null, options))
+    else return allLimits.schedule(request.bind(null, options))
+  })
+
+  async function updateReservoir() {
+    let response
+    try {
+      response = await github.rest.rateLimit.get()
+    } catch (err) {
+      core.error(`Failed updating reservoir:\n${err}`)
+      // Keep retrying on failed rate limit requests instead of exiting the script early.
+      return
+    }
+    // Always keep 1000 spare requests for other jobs to do their regular duty.
+    // They normally use below 100, so 1000 is *plenty* of room to work with.
+    const reservoir = Math.max(0, response.data.resources.core.remaining - 1000)
+    core.info(`Updating reservoir to: ${reservoir}`)
+    allLimits.updateSettings({ reservoir })
+  }
+  await updateReservoir()
+  // Update remaining requests every minute to account for other jobs running in parallel.
+  const reservoirUpdater = setInterval(updateReservoir, 60 * 1000)
+
+  try {
+    await callback(stats)
+  } finally {
+    clearInterval(reservoirUpdater)
+    core.notice(
+      `Processed ${stats.prs} PRs, ${stats.issues} Issues, made ${stats.requests + stats.artifacts} API requests and downloaded ${stats.artifacts} artifacts.`,
+    )
+  }
+}