workflows/eval: remove attrs step (#406266)

  get-merge-commit:

    uses: ./.github/workflows/get-merge-commit.yml

  attrs:

    name: Attributes

    runs-on: ubuntu-24.04-arm

    needs: get-merge-commit

    if: needs.get-merge-commit.outputs.mergedSha

    outputs:

      targetSha: ${{ steps.targetSha.outputs.targetSha }}

      systems: ${{ steps.systems.outputs.systems }}

    steps:

      - name: Check out the PR at the test merge commit

        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        with:

          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}

          fetch-depth: 2

          path: nixpkgs

      - name: Determine target commit

        if: github.event_name == 'pull_request_target'

        id: targetSha

        run: |

          targetSha=$(git -C nixpkgs rev-parse HEAD^1)

          echo "targetSha=$targetSha" >> "$GITHUB_OUTPUT"

      - name: Install Nix

        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31

        with:

          extra_nix_config: sandbox = true

      - name: Evaluate the list of all attributes and get the systems matrix

        id: systems

        run: |

          nix-build nixpkgs/ci -A eval.attrpathsSuperset

          echo "systems=$(<result/systems.json)" >> "$GITHUB_OUTPUT"

      - name: Upload the list of all attributes

        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

        with:

          name: paths

          path: result/*

  outpaths:

    name: Outpaths

    runs-on: ubuntu-24.04-arm

    needs: [ attrs, get-merge-commit ]

    needs: [ get-merge-commit ]

    strategy:

      fail-fast: false

      matrix:

        system: ${{ fromJSON(needs.attrs.outputs.systems) }}

        system: ${{ fromJSON(needs.get-merge-commit.outputs.systems) }}

    steps:

      - name: Enable swap

        run: |

          sudo mkswap /swap

          sudo swapon /swap

      - name: Download the list of all attributes

        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8

        with:

          name: paths

          path: paths

      - name: Check out the PR at the test merge commit

        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        with:

        run: |

          nix-build nixpkgs/ci -A eval.singleSystem \

            --argstr evalSystem "$MATRIX_SYSTEM" \

            --arg attrpathFile ./paths/paths.json \

            --arg chunkSize 10000

          # If it uses too much memory, slightly decrease chunkSize

  process:

    name: Process

    runs-on: ubuntu-24.04-arm

    needs: [ outpaths, attrs, get-merge-commit ]

    needs: [ outpaths, get-merge-commit ]

    outputs:

      targetRunId: ${{ steps.targetRunId.outputs.targetRunId }}

    steps:

          path: prResult/*

      - name: Get target run id

        if: needs.attrs.outputs.targetSha

        if: needs.get-merge-commit.outputs.targetSha

        id: targetRunId

        run: |

          # Get the latest eval.yml workflow run for the PR's target commit

          echo "targetRunId=$runId" >> "$GITHUB_OUTPUT"

        env:

          REPOSITORY: ${{ github.repository }}

          TARGET_SHA: ${{ needs.attrs.outputs.targetSha }}

          TARGET_SHA: ${{ needs.get-merge-commit.outputs.targetSha }}

          GH_TOKEN: ${{ github.token }}

      - uses: actions/download-artifact@v4

      - name: Compare against the target branch

        if: steps.targetRunId.outputs.targetRunId

        run: |

          git -C nixpkgs worktree add ../target ${{ needs.attrs.outputs.targetSha }}

          git -C nixpkgs diff --name-only ${{ needs.attrs.outputs.targetSha }} \

          git -C nixpkgs worktree add ../target ${{ needs.get-merge-commit.outputs.targetSha }}

          git -C nixpkgs diff --name-only ${{ needs.get-merge-commit.outputs.targetSha }} \

            | jq --raw-input --slurp 'split("\n")[:-1]' > touched-files.json

          # Use the target branch to get accurate maintainer info

  tag:

    name: Tag

    runs-on: ubuntu-24.04-arm

    needs: [ attrs, process ]

    needs: [ process ]

    if: needs.process.outputs.targetRunId

    permissions:

      pull-requests: write

      - name: Check out Nixpkgs at the base commit

        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        with:

          ref: ${{ needs.attrs.outputs.targetSha }}

          ref: ${{ needs.get-merge-commit.outputs.targetSha }}

          path: base

          sparse-checkout: ci

      mergedSha:

        description: "The merge commit SHA"

        value: ${{ jobs.resolve-merge-commit.outputs.mergedSha }}

      targetSha:

        description: "The target commit SHA"

        value: ${{ jobs.resolve-merge-commit.outputs.targetSha }}

      systems:

        description: "The supported systems"

        value: ${{ jobs.resolve-merge-commit.outputs.systems }}

permissions: {}

    runs-on: ubuntu-24.04-arm

    outputs:

      mergedSha: ${{ steps.merged.outputs.mergedSha }}

      targetSha: ${{ steps.merged.outputs.targetSha }}

      systems: ${{ steps.systems.outputs.systems }}

    steps:

      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

        with:

              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"

              ;;

            pull_request_target)

              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then

                echo "Checking the merge commit $mergedSha"

                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"

              if commits=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then

                echo "Checking the commits:\n$commits"

                echo "$commits" >> "$GITHUB_OUTPUT"

              else

                # Skipping so that no notifications are sent

                echo "Skipping the rest..."

              fi

              ;;

          esac

          rm -rf base

      - name: Load supported systems

        id: systems

        run: |

          echo "systems=$(jq -c <base/ci/supportedSystems.json)" >> "$GITHUB_OUTPUT"

## `get-merge-commit.sh GITHUB_REPO PR_NUMBER`

Check whether a PR is mergeable and return the test merge commit as

[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests).

[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests) and its parent.

Arguments:

- `GITHUB_REPO`: The repository of the PR, e.g. `NixOS/nixpkgs`

- `PR_NUMBER`: The PR number, e.g. `1234`

Exit codes:

- 0: The PR can be merged, the test merge commit hash is returned on stdout

- 0: The PR can be merged, the hashes of the test merge commit and the target commit are returned on stdout

- 1: The PR cannot be merged because it's not open anymore

- 2: The PR cannot be merged because it has a merge conflict

- 3: The merge commit isn't being computed, GitHub is likely having internal issues, unknown if the PR is mergeable

  --arg evalSystems '["x86_64-linux" "aarch64-darwin"]'

```

- `--max-jobs`: The maximum number of derivations to run at the same time. Only each [supported system](../supportedSystems.nix) gets a separate derivation, so it doesn't make sense to set this higher than that number.

- `--max-jobs`: The maximum number of derivations to run at the same time. Only each [supported system](../supportedSystems.json) gets a separate derivation, so it doesn't make sense to set this higher than that number.

- `--cores`: The number of cores to use for each job. Recommended to set this to the amount of cores on your system divided by `--max-jobs`.

- `chunkSize`: The number of attributes that are evaluated simultaneously on a single core. Lowering this decreases memory usage at the cost of increased evaluation time. If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.

- `evalSystems`: The set of systems for which `nixpkgs` should be evaluated. Defaults to the four official platforms (`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`).

          "nixos"

          "pkgs"

          ".version"

          "ci/supportedSystems.nix"

          "ci/supportedSystems.json"

        ]

      );

    };

  nix = nixVersions.nix_2_24;

  supportedSystems = import ../supportedSystems.nix;

  supportedSystems = builtins.fromJSON (builtins.readFile ../supportedSystems.json);

  attrpathsSuperset =

    runCommand "attrpaths-superset.json"

          nix

          time

        ];

        env.supportedSystems = builtins.toJSON supportedSystems;

        passAsFile = [ "supportedSystems" ];

      }

      ''

        export NIX_STATE_DIR=$(mktemp -d)

            --option restrict-eval true \

            --option allow-import-from-derivation false \

            --arg enableWarnings false > $out/paths.json

        mv "$supportedSystemsPath" $out/systems.json

      '';

  singleSystem =

      # because `--argstr system` would only be passed to the ci/default.nix file!

      evalSystem,

      # The path to the `paths.json` file from `attrpathsSuperset`

      attrpathFile,

      attrpathFile ? "${attrpathsSuperset}/paths.json",

      # The number of attributes per chunk, see ./README.md for more info.

      chunkSize,

      checkMeta ? true,

          name = evalSystem;

          path = singleSystem {

            inherit quickTest evalSystem chunkSize;

            attrpathFile = attrpathsSuperset + "/paths.json";

          };

        }) evalSystems

      );