Backport 431468 to release 25.05

.git-blame-ignore-revs

@@ -193,6 +193,9 @@ cffc27daf06c77c0d76bc35d24b929cb9d68c3c9
 # nixos/kanidm: inherit lib, nixfmt
 8f18393d380079904d072007fb19dc64baef0a3a
 
+# fetchhg: format after refactoring with lib.extendMkDerivation and make overridable (#423539)
+34a5b1eb23129f8fb62c677e3760903f6d43228f
+
 # fetchurl: nixfmt-rfc-style
 ce21e97a1f20dee15da85c084f9d1148d84f853b
 
@@ -266,3 +269,7 @@ a034fb50f79816c6738fb48b48503b09ea3b0132
 
 # treewide: switch instances of lib.teams.*.members to the new meta.teams attribute
 05580f4b4433fda48fff30f60dfd303d6ee05d21
+
+# nixfmt 1.0.0
+a46262ae77e4016fe5a4a390c4a39c0c1b266428 # !autorebase nix-shell --run treefmt
+aefcb0d50d1124314429a11ed6b7aaaedf2861c5 # !autorebase nix-shell --run treefmt

.github/ISSUE_TEMPLATE/01_bug_report.yml

@@ -100,7 +100,7 @@ body:
       label: "Notify maintainers"
       description: |
         Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
+      value: |2
 
 
         ---

.github/ISSUE_TEMPLATE/02_bug_report_darwin.yml

@@ -114,7 +114,7 @@ body:
         Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
 
         If this issue is related to the Darwin packaging architecture as a whole, or is related to the core Darwin frameworks, consider mentioning the `@NixOS/darwin-core` team.
-      value: |
+      value: |2
 
 
         ---

.github/ISSUE_TEMPLATE/03_bug_report_nixos.yml

@@ -104,7 +104,7 @@ body:
         Please note that the maintainer attribute name does not always match the maintainer's GitHub username. If that occurs, try looking in [`maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix) for the maintainer attribute name, and checking if the maintainer has a listed GitHub username.
 
         If in doubt, check `git blame` for whoever last touched the module, or check the associated package's maintainers. Please add the mentions above the `---` characters.
-      value: |
+      value: |2
 
 
         ---

.github/ISSUE_TEMPLATE/04_build_failure.yml

@@ -109,7 +109,7 @@ body:
       label: "Notify maintainers"
       description: |
         Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
+      value: |2
 
 
         ---

.github/ISSUE_TEMPLATE/05_update_request.yml

@@ -84,7 +84,7 @@ body:
       label: "Notify maintainers"
       description: |
         Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
+      value: |2
 
 
         ---

.github/ISSUE_TEMPLATE/06_module_request.yml

@@ -60,7 +60,7 @@ body:
       label: "Notify maintainers"
       description: |
         Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
+      value: |2
 
 
         ---

.github/ISSUE_TEMPLATE/07_backport_request.yml

@@ -62,7 +62,7 @@ body:
       label: "Notify maintainers"
       description: |
         Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
+      value: |2
 
 
         ---

.github/ISSUE_TEMPLATE/08_documentation_request.yml

@@ -46,7 +46,7 @@ body:
       label: "Notify maintainers"
       description: |
         Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
+      value: |2
 
 
         ---

.github/ISSUE_TEMPLATE/09_unreproducible_package.yml

@@ -119,7 +119,7 @@ body:
       label: "Notify maintainers"
       description: |
         Please mention the people who are in the **Maintainers** list of the offending package. This is done by by searching for the package on the [NixOS Package Search](https://search.nixos.org/packages) and mentioning the people listed under **Maintainers** by prefixing their GitHub usernames with an '@' character. Please add the mentions above the `---` characters in the template below.
-      value: |
+      value: |2
 
 
         ---

.github/actions/get-merge-commit/action.yml

@@ -0,0 +1,95 @@
+name: Get merge commit
+
+description: 'Checks whether the Pull Request is mergeable and checks out the repo at up to two commits: The result of a temporary merge of the head branch into the target branch ("merged"), and the parent of that commit on the target branch ("target"). Handles push events and merge conflicts gracefully.'
+
+inputs:
+  mergedSha:
+    description: "The merge commit SHA, previously collected."
+    type: string
+  merged-as-untrusted:
+    description: "Whether to checkout the merge commit in the ./untrusted folder."
+    type: boolean
+  targetSha:
+    description: "The target commit SHA, previously collected."
+    type: string
+  target-as-trusted:
+    description: "Whether to checkout the target commit in the ./trusted folder."
+    type: boolean
+
+outputs:
+  mergedSha:
+    description: "The merge commit SHA"
+    value: ${{ steps.commits.outputs.mergedSha }}
+  targetSha:
+    description: "The target commit SHA"
+    value: ${{ steps.commits.outputs.targetSha }}
+
+runs:
+  using: composite
+  steps:
+    - id: commits
+      if: ${{ !inputs.mergedSha && !inputs.targetSha }}
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+      with:
+        script: |
+          if (context.eventName == 'push') return core.setOutput('mergedSha', context.sha)
+
+          for (const retryInterval of [5, 10, 20, 40, 80]) {
+            console.log("Checking whether the pull request can be merged...")
+            const prInfo = (await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: context.payload.pull_request.number
+            })).data
+
+            if (prInfo.state != 'open') throw new Error ("PR is not open anymore.")
+
+            if (prInfo.mergeable == null) {
+              console.log(`GitHub is still computing whether this PR can be merged, waiting ${retryInterval} seconds before trying again...`)
+              await new Promise(resolve => setTimeout(resolve, retryInterval * 1000))
+              continue
+            }
+
+            let mergedSha, targetSha
+
+            if (prInfo.mergeable) {
+              console.log("The PR can be merged.")
+
+              mergedSha = prInfo.merge_commit_sha
+              targetSha = (await github.rest.repos.getCommit({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                ref: prInfo.merge_commit_sha
+              })).data.parents[0].sha
+            } else {
+              console.log("The PR has a merge conflict.")
+
+              mergedSha = prInfo.head.sha
+              targetSha = (await github.rest.repos.compareCommitsWithBasehead({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                basehead: `${prInfo.base.sha}...${prInfo.head.sha}`
+              })).data.merge_base_commit.sha
+            }
+
+            console.log(`Checking the commits:\nmerged:${mergedSha}\ntarget:${targetSha}`)
+            core.setOutput('mergedSha', mergedSha)
+            core.setOutput('targetSha', targetSha)
+            return
+          }
+          throw new Error("Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com.")
+
+    - if: inputs.merged-as-untrusted && (inputs.mergedSha || steps.commits.outputs.mergedSha)
+      # Would be great to do the checkouts in git worktrees of the existing spare checkout instead,
+      # but Nix is broken with them:
+      # https://github.com/NixOS/nix/issues/6073
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        ref: ${{ inputs.mergedSha || steps.commits.outputs.mergedSha }}
+        path: untrusted
+
+    - if: inputs.target-as-trusted && (inputs.targetSha || steps.commits.outputs.targetSha)
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        ref: ${{ inputs.targetSha || steps.commits.outputs.targetSha }}
+        path: trusted

.github/dependabot.yml

@@ -4,4 +4,4 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
-    labels: [ ]
+    labels: []

.github/labeler-development-branches.yml

@@ -3,21 +3,21 @@
 
 "4.workflow: package set update":
   - any:
-    - head-branch:
-      - '-updates$'
+      - head-branch:
+          - '-updates$'
 
 "4.workflow: staging":
   - any:
-    - head-branch:
-      - '^staging-next$'
-      - '^staging-next-'
+      - head-branch:
+          - '^staging-next$'
+          - '^staging-next-'
 
 "6.topic: haskell":
   - any:
-    - head-branch:
-      - '^haskell-updates$'
+      - head-branch:
+          - '^haskell-updates$'
 
 "6.topic: python":
   - any:
-    - head-branch:
-      - '^python-updates$'
+      - head-branch:
+          - '^python-updates$'

.github/labeler-no-sync.yml

@@ -5,28 +5,21 @@
 
 "6.topic: policy discussion":
   - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - .github/**/*
-        - CONTRIBUTING.md
-        - pkgs/README.md
-        - nixos/README.md
-        - maintainers/README.md
-        - lib/README.md
-        - doc/README.md
+      - changed-files:
+          - any-glob-to-any-file:
+              - .github/**/*
+              - CONTRIBUTING.md
+              - pkgs/README.md
+              - nixos/README.md
+              - maintainers/README.md
+              - lib/README.md
+              - doc/README.md
 
 "8.has: documentation":
   - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - doc/**/*
-        - nixos/doc/**/*
-
-"backport release-24.11":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - .github/workflows/*
-        - ci/**/*.*
+      - changed-files:
+          - any-glob-to-any-file:
+              - doc/**/*
+              - nixos/doc/**/*
 
 # keep-sorted end