ci: add no-channel check

[zimbatm]

Motivation for this change

Somebody merged a change in nixos-20.09. See #109384

Proposal

This is a proposal to prevent such issues in the future.

1. Add a CI check that always fails, that contains an explanation.
2. Configure nixpkgs to require this CI status to pass on the protected branches.

Here is how the error looks like:

And the branch protection change that would be put in place:

[Mic92]

I assume CI is needed because there is no different way to prevent people from pushing to these branches?

[SuperSandro2000]

I assume CI is needed because there is no different way to prevent people from pushing to these branches?

I think admins ignore the branch protection.

[zowoq]

NixOS/ofborg#546 does similar to this with ofborg but I think this is better as we can "require" it which isn't possible with the ofborg check.

Being able to "require" ofborg checks has been mentioned previously but AFAIK there hasn't been anything since #87853 (comment).

[Mic92]

NixOS/ofborg#546 does similar to this with ofborg but I think this is better as we can "require" it which isn't possible with the ofborg check.

Being able to "require" ofborg checks has been mentioned previously but AFAIK there hasn't been anything since #87853 (comment).

I think the major concern there was that if ofborg would be not available the whole nixpkgs development would break. There are probably less concerns with github actions as there is a dedicated team with pager duty.

[stale]

I marked this as stale due to inactivity. → More info

[zimbatm]

Tested and #130906 works as expected