.github/workflows/check-by-name.yml

   1 # Checks pkgs/by-name (see pkgs/by-name/README.md)
   2 # using the nixpkgs-check-by-name tool (see https://github.com/NixOS/nixpkgs-check-by-name)
   3 #
   4 # When you make changes to this workflow, also update pkgs/test/check-by-name/run-local.sh adequately
   5 name: Check pkgs/by-name
   6
   7 on:
   8   # Using pull_request_target instead of pull_request avoids having to approve first time contributors
   9   pull_request_target:
  10     # This workflow depends on the base branch of the PR,
  11     # but changing the base branch is not included in the default trigger events,
  12     # which would be `opened`, `synchronize` or `reopened`.
  13     # Instead it causes an `edited` event, so we need to add it explicitly here
  14     # While `edited` is also triggered when the PR title/body is changed,
  15     # this PR action is fairly quick, and PR's don't get edited that often,
  16     # so it shouldn't be a problem
  17     # There is a feature request for adding a `base_changed` event:
  18     # https://github.com/orgs/community/discussions/35058
  19     types: [opened, synchronize, reopened, edited]
  20
  21 permissions: {}
  22
  23 # We don't use a concurrency group here, because the action is triggered quite often (due to the PR edit
  24 # trigger), and contributers would get notified on any canceled run.
  25 # There is a feature request for supressing notifications on concurrency-canceled runs:
  26 # https://github.com/orgs/community/discussions/13015
  27
  28 jobs:
  29   check:
  30     name: pkgs-by-name-check
  31     # This needs to be x86_64-linux, because we depend on the tooling being pre-built in the GitHub releases
  32     runs-on: ubuntu-latest
  33     # This should take 1 minute at most, but let's be generous.
  34     # The default of 6 hours is definitely too long
  35     timeout-minutes: 10
  36     steps:
  37       # This step has to be in this file,
  38       # because it's needed to determine which revision of the repository to fetch,
  39       # and we can only use other files from the repository once it's fetched.
  40       - name: Resolving the merge commit
  41         env:
  42           GH_TOKEN: ${{ github.token }}
  43         run: |
  44           # This checks for mergeability of a pull request as recommended in
  45           # https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests
  46
  47           # Retry the API query this many times
  48           retryCount=5
  49           # Start with 5 seconds, but double every retry
  50           retryInterval=5
  51           while true; do
  52             echo "Checking whether the pull request can be merged"
  53             prInfo=$(gh api \
  54               -H "Accept: application/vnd.github+json" \
  55               -H "X-GitHub-Api-Version: 2022-11-28" \
  56               /repos/"$GITHUB_REPOSITORY"/pulls/${{ github.event.pull_request.number }})
  57             mergeable=$(jq -r .mergeable <<< "$prInfo")
  58             mergedSha=$(jq -r .merge_commit_sha <<< "$prInfo")
  59
  60             if [[ "$mergeable" == "null" ]]; then
  61               if (( retryCount == 0 )); then
  62                 echo "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com/"
  63                 exit 1
  64               else
  65                 (( retryCount -= 1 )) || true
  66
  67                 # null indicates that GitHub is still computing whether it's mergeable
  68                 # Wait a couple seconds before trying again
  69                 echo "GitHub is still computing whether this PR can be merged, waiting $retryInterval seconds before trying again ($retryCount retries left)"
  70                 sleep "$retryInterval"
  71
  72                 (( retryInterval *= 2 )) || true
  73               fi
  74             else
  75               break
  76             fi
  77           done
  78
  79           if [[ "$mergeable" == "true" ]]; then
  80             echo "The PR can be merged, checking the merge commit $mergedSha"
  81             echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
  82           else
  83             echo "The PR cannot be merged, it has a merge conflict, skipping the rest.."
  84           fi
  85       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
  86         if: env.mergedSha
  87         with:
  88           # pull_request_target checks out the base branch by default
  89           ref: ${{ env.mergedSha }}
  90           # Fetches the merge commit and its parents
  91           fetch-depth: 2
  92       - name: Checking out base branch
  93         if: env.mergedSha
  94         run: |
  95           base=$(mktemp -d)
  96           git worktree add "$base" "$(git rev-parse HEAD^1)"
  97           echo "base=$base" >> "$GITHUB_ENV"
  98       - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
  99         if: env.mergedSha
 100       - name: Fetching the pinned tool
 101         if: env.mergedSha
 102         # Update the pinned version using pkgs/test/check-by-name/update-pinned-tool.sh
 103         run: |
 104           # The pinned version of the tooling to use
 105           toolVersion=$(<pkgs/test/check-by-name/pinned-version.txt)
 106           # Fetch the x86_64-linux-specific release artifact containing the Gzipped NAR of the pre-built tool
 107           toolPath=$(curl -sSfL https://github.com/NixOS/nixpkgs-check-by-name/releases/download/"$toolVersion"/x86_64-linux.nar.gz \
 108             | gzip -cd | nix-store --import | tail -1)
 109           # Adds a result symlink as a GC root
 110           nix-store --realise "$toolPath" --add-root result
 111       - name: Running nixpkgs-check-by-name
 112         if: env.mergedSha
 113         env:
 114           # Force terminal colors to be enabled. The library that
 115           # nixpkgs-check-by-name uses respects: https://bixense.com/clicolors/
 116           CLICOLOR_FORCE: 1
 117         run: |
 118           if result/bin/nixpkgs-check-by-name --base "$base" .; then
 119             exit 0
 120           else
 121             exitCode=$?
 122             echo "To run locally: ./maintainers/scripts/check-by-name.sh $GITHUB_BASE_REF https://github.com/$GITHUB_REPOSITORY.git"
 123             exit "$exitCode"
 124           fi