workflows: small refactors (#371216)

# GitHub Actions Workflows

Some architectural notes about key decisions and concepts in our workflows:

- Instead of `pull_request` we use [`pull_request_target`](https://docs.github.com/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#pull_request_target) for all PR-related workflows. This has the advantage that those workflows will run without prior approval for external contributors.

- Running on `pull_request_target` also optionally provides us with a GH_TOKEN with elevated privileges (write access), which we need to do things like adding labels, requesting reviewers or pushing branches. **Note about security:** We need to be careful to limit the scope of elevated privileges as much as possible. Thus they should be lowered to the minimum with `permissions: {}` in every workflow by default.

- By definition `pull_request_target` runs in the context of the **base** of the pull request. This means, that the workflow files to run will be taken from the base branch, not the PR, and actions/checkout will not checkout the PR, but the base branch, by default. To protect our secrets, we need to make sure to **never execute code** from the pull request and always evaluate or build nix code from the pull request with the **sandbox enabled**.

- To test the pull request's contents, we checkout the "test merge commit". This is a temporary commit that GitHub creates automatically as "what would happen, if this PR was merged into the base branch now?". The checkout could be done via the virtual branch `refs/pull/<pr-number>/merge`, but doing so would cause failures when this virtual branch doesn't exist (anymore). This can happen when the PR has conflicts, in which case the virtual branch is not created, or when the PR is getting merged while workflows are still running, in which case the branch won't exist anymore at the time of checkout. Thus, we use the `get-merge-commit.yml` workflow to check whether the PR is mergeable and the test merge commit exists and only then run the relevant jobs.

- Various workflows need to make comparisons against the base branch. In this case, we checkout the parent of the "test merge commit" for best results. Note, that this is not necessarily the same as the default commit that actions/checkout would use, which is also a commit from the base branch (see above), but might be older.

## Terminology

- **base commit**: The pull_request_target event's context commit, i.e. the base commit given by GitHub Actions. Same as `github.event.pull_request.base.sha`.

- **head commit**: The HEAD commit in the pull request's branch. Same as `github.event.pull_request.head.sha`.

- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request. Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.

- **target commit**: The base branch's parent of the "test merge commit" to compare against.

name: Backport

on:

  pull_request_target:

    types: [closed, labeled]

# WARNING:

# When extending this action, be aware that $GITHUB_TOKEN allows write access to

# the GitHub repository. This means that it should not evaluate user input in a

# way that allows code injection.

name: Backport

on:

  pull_request_target:

    types: [closed, labeled]

permissions: {}

jobs:

        with:

          app-id: ${{ vars.BACKPORT_APP_ID }}

          private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        with:

          ref: ${{ github.event.pull_request.head.sha }}

          token: ${{ steps.app-token.outputs.token }}

      - name: Create backport PRs

        uses: korthout/backport-action@be567af183754f6a5d831ae90f648954763f17f5 # v3.1.0

        with:

name: Basic evaluation checks

on:

  workflow_dispatch

  # pull_request:

  #   branches:

  #    - master

  #    - release-**

  # push:

  #   branches:

  #    - master

  #    - release-**

permissions:

  contents: read

jobs:

  tests:

    name: basic-eval-checks

    runs-on: ubuntu-24.04

    # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback

    steps:

    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15

      with:

        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

        name: nixpkgs-ci

        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'

    - run: nix --experimental-features 'nix-command flakes' flake check --all-systems --no-build

    # explicit list of supportedSystems is needed until aarch64-darwin becomes part of the trunk jobset

    - run: nix-build pkgs/top-level/release.nix -A release-checks --arg supportedSystems '[ "aarch64-darwin" "aarch64-linux" "x86_64-linux" "x86_64-darwin"  ]'

name: "Check cherry-picks"

on:

  pull_request_target:

    branches:

        with:

          fetch-depth: 0

          filter: blob:none

      - name: Check cherry-picks

        env:

          BASE_SHA: ${{ github.event.pull_request.base.sha }}

  pull_request_target:

    paths:

      - 'maintainers/maintainer-list.nix'

permissions:

  contents: read

permissions: {}

jobs:

  nixos:

    name: maintainer-list-check

    runs-on: ubuntu-24.04

    if: github.repository_owner == 'NixOS'

    steps:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        with:

          # pull_request_target checks out the base branch by default

          ref: refs/pull/${{ github.event.pull_request.number }}/merge

          # Only these directories to perform the check

          sparse-checkout: |

            lib

            maintainers

      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

        with:

          # explicitly enable sandbox

          extra_nix_config: sandbox = true

      - name: Check that maintainer-list.nix is sorted

        run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix