[Backport release-25.05] workflows/eval: run when base branch changed

.github/workflows/check-format.yml

@@ -5,7 +5,6 @@ on:
     paths:
       - .github/workflows/check-format.yml
   pull_request_target:
-    types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 

.github/workflows/codeowners-v2.yml

@@ -27,7 +27,7 @@ on:
     paths:
       - .github/workflows/codeowners-v2.yml
   pull_request_target:
-    types: [opened, ready_for_review, synchronize, reopened, edited]
+    types: [opened, ready_for_review, synchronize, reopened]
 
 permissions: {}
 

.github/workflows/edited.yml

@@ -0,0 +1,49 @@
+# Some workflows depend on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
+# Instead it causes an `edited` event.
+# Since `edited` is also triggered when PR title/body is changed, we use this wrapper workflow, to run the other workflows conditionally only.
+# There are already feature requests for adding a `base_changed` event:
+# - https://github.com/orgs/community/discussions/35058
+# - https://github.com/orgs/community/discussions/64119
+#
+# Instead of adding this to each workflow's pull_request_target event, we trigger this in a separate workflow.
+# This has the advantage, that we can actually skip running those jobs for simple edits like changing the title or description.
+# The actual trigger happens by closing and re-opening the pull request, which triggers the default pull_request_target events.
+# This is much simpler and reliable than other approaches.
+
+name: "Edited base branch"
+
+on:
+  pull_request_target:
+    types: [edited]
+
+permissions: {}
+
+jobs:
+  base:
+    name: Trigger jobs
+    runs-on: ubuntu-24.04
+    if: github.event.changes.base.ref.from && github.event.changes.base.ref.from != github.event.pull_request.base.ref
+    steps:
+      # Use a GitHub App to create the PR so that CI gets triggered
+      # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
+      # We only need Pull Requests: write here, but the app is also used for backports.
+      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        id: app-token
+        with:
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+
+      - env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPOSITORY: ${{ github.repository }}
+          NUMBER: ${{ github.event.number }}
+        run: |
+          gh api \
+            --method PATCH \
+            /repos/"$REPOSITORY"/pulls/"$NUMBER" \
+            -f "state=closed"
+          gh api \
+            --method PATCH \
+            /repos/"$REPOSITORY"/pulls/"$NUMBER" \
+            -f "state=open"

.github/workflows/labels.yml

@@ -7,7 +7,6 @@ name: "Label PR"
 
 on:
   pull_request_target:
-    types: [edited, opened, synchronize, reopened]
 
 permissions:
   contents: read

.github/workflows/nixpkgs-vet.yml

@@ -10,11 +10,6 @@ on:
     paths:
       - .github/workflows/nixpkgs-vet.yml
   pull_request_target:
-    # This workflow depends on the base branch of the PR, but changing the base branch is not included in the default trigger events, which would be `opened`, `synchronize` or `reopened`.
-    # Instead it causes an `edited` event, so we need to add it explicitly here.
-    # While `edited` is also triggered when the PR title/body is changed, this PR action is fairly quick, and PRs don't get edited **that** often, so it shouldn't be a problem.
-    # There is a feature request for adding a `base_changed` event: https://github.com/orgs/community/discussions/35058
-    types: [opened, synchronize, reopened, edited]
 
 permissions: {}
 

.github/workflows/no-channel.yml

@@ -5,8 +5,6 @@ on:
     paths:
       - .github/workflows/no-channel.yml
   pull_request_target:
-    # Re-run should be triggered when the base branch is updated, instead of silently failing
-    types: [opened, synchronize, reopened, edited]
 
 permissions: {}