workflows/{merge-group,pr}: improve "no PR failures" handling#435929
Merged
wolfgangwalther merged 3 commits intoNixOS:masterfrom Aug 24, 2025
Merged
workflows/{merge-group,pr}: improve "no PR failures" handling#435929wolfgangwalther merged 3 commits intoNixOS:masterfrom
wolfgangwalther merged 3 commits intoNixOS:masterfrom
Conversation
Merged
2 tasks
nixpkgs-ci
bot
added
10.rebuild-darwin: 0
nix-owners
bot
requested review from
MattSturgeon,
Mic92,
philiptaron and
zowoq
nixpkgs-ci
bot
added
9.needs: reviewer
wolfgangwalther
force-pushed
the
ci-pr-failures
branch
from
152b445 to
f64779c
Compare
wolfgangwalther
force-pushed
the
ci-pr-failures
branch
2 times, most recently
from
723f644 to
5ebc6f7
Compare
MattSturgeon
approved these changes
Aug 24, 2025
.github/workflows/test.yml
Outdated
Comment on lines
79
to
81
Contributor
There was a problem hiding this comment.
To satisfy my curiosity, does it matter whether permissions are set in the calling or called workflow?
I.e. if a called workflow asked for a permission not present in the calling workflow/job, that will fail?
Contributor
Author
There was a problem hiding this comment.
Yeah, so GitHub will complain when requesting permissions in the called workflow, when they were not given in the calling workflow. That will just lead to a start up error, where the workflow won't even start running.
It looks like this: https://github.com/NixOS/nixpkgs/actions/runs/17187479040
Invalid workflow file: .github/workflows/test.yml#L74
The workflow is not valid. .github/workflows/test.yml (Line: 74, Col: 3): Error calling workflow 'NixOS/nixpkgs/.github/workflows/merge-group.yml@5a137567929f60e719b0764d353e13f60580f3d6'. The nested job 'unlock' is requesting 'statuses: write', but is only allowed 'statuses: none'.
Posting the status manually allows us to avoid the strange "skipped == success" logic and properly skip the `unlock` job for pull_request events in the next commit. This should be much easier to understand than the previous logic.
…equest trigger The required status checks should depend on exactly one workflow, triggered via pull_request_target or merge_group. Anything that is triggered by pull_request is for testing purposes of the workflows themselves only.
The owners check is not reproducible, because it depends on the state of the NixOS org on GitHub. Owners can rename their accounts or they can leave the organisation and access to Nixpkgs can be removed from teams. All of this breaks the owners check for reasons unrelated to the PR at hand. This PR makes the check for the owners file conditionally required: Only when the ci/OWNERS file is actually modified a failed check will block merging the PR. When that's not the case, the check will still fail visibily in the checklist, but the failure can be ignored. This is especially relevant for the Merge Queue, which should not be entirely blocked whenever any of these events happen. Also, it allows passing the checks in a fork when testing, where the owners check will *always* fail, because the respective teams and members are never part of the "user org" that a fork is.
wolfgangwalther
force-pushed
the
ci-pr-failures
branch
from
5ebc6f7 to
956d0a7
Compare
Contributor
|
Successfully created backport PR for |
Merged
1 task
github-actions
bot
added
the
8.has: port to stable
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The first two commits follow up on #435547 (comment) and #435547 (comment).
The last commit improves the "requiredness" of the owners check. The commit message:
Things done
Add a 👍 reaction to pull requests you find important.