workflows: basic consistency in formatting workflows

Same top-level ordering of keys / empty lines and same indentation for
yaml lists. One blank line between each step.

Makes it easier to read and compare the workflows.

.github/workflows/backport.yml

@@ -1,13 +1,14 @@
-name: Backport
-on:
-  pull_request_target:
-    types: [closed, labeled]
-
 # WARNING:
 # When extending this action, be aware that $GITHUB_TOKEN allows write access to
 # the GitHub repository. This means that it should not evaluate user input in a
 # way that allows code injection.
 
+name: Backport
+
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
 permissions: {}
 
 jobs:
@@ -23,10 +24,12 @@ jobs:
         with:
           app-id: ${{ vars.BACKPORT_APP_ID }}
           private-key: ${{ secrets.BACKPORT_PRIVATE_KEY }}
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
+
       - name: Create backport PRs
         uses: korthout/backport-action@be567af183754f6a5d831ae90f648954763f17f5 # v3.1.0
         with:

.github/workflows/check-cherry-picks.yml

@@ -1,10 +1,11 @@
 name: "Check cherry-picks"
+
 on:
   pull_request_target:
     branches:
-     - 'release-**'
-     - 'staging-**'
-     - '!staging-next'
+      - 'release-**'
+      - 'staging-**'
+      - '!staging-next'
 
 permissions: {}
 
@@ -14,13 +15,14 @@ jobs:
     runs-on: ubuntu-24.04
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        fetch-depth: 0
-        filter: blob:none
-    - name: Check cherry-picks
-      env:
-        BASE_SHA: ${{ github.event.pull_request.base.sha }}
-        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-      run: |
-        ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          filter: blob:none
+
+      - name: Check cherry-picks
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          ./maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"

.github/workflows/check-maintainers-sorted.yml

@@ -4,6 +4,7 @@ on:
   pull_request_target:
     paths:
       - 'maintainers/maintainer-list.nix'
+
 permissions:
   contents: read
 
@@ -21,9 +22,11 @@ jobs:
           sparse-checkout: |
             lib
             maintainers
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
+
       - name: Check that maintainer-list.nix is sorted
         run: nix-instantiate --eval maintainers/scripts/check-maintainers-sorted.nix

.github/workflows/check-nix-format.yml

@@ -3,12 +3,14 @@
 # https://github.com/NixOS/rfcs/pull/166.
 # Because of this, this action is not yet enabled for all files -- only for
 # those who have opted in.
+
 name: Check that Nix files are formatted
 
 on:
   pull_request_target:
     # See the comment at the same location in ./nixpkgs-vet.yml
     types: [opened, synchronize, reopened, edited]
+
 permissions:
   contents: read
 
@@ -28,6 +30,7 @@ jobs:
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
           # Fetches the merge commit and its parents
           fetch-depth: 2
+
       - name: Checking out base branch
         run: |
           base=$(mktemp -d)
@@ -35,6 +38,7 @@ jobs:
           git worktree add "$base" "$baseRev"
           echo "baseRev=$baseRev" >> "$GITHUB_ENV"
           echo "base=$base" >> "$GITHUB_ENV"
+
       - name: Get Nixpkgs revision for nixfmt
         run: |
           # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt
@@ -42,13 +46,16 @@ jobs:
           # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=${{ env.url }}
+
       - name: Install nixfmt
         run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
+
       - name: Check that Nix files are formatted according to the RFC style
         run: |
           unformattedFiles=()

.github/workflows/check-nixf-tidy.yml

@@ -3,6 +3,7 @@ name: Check changed Nix files with nixf-tidy (experimental)
 on:
   pull_request_target:
     types: [opened, synchronize, reopened, edited]
+
 permissions:
   contents: read
 
@@ -18,6 +19,7 @@ jobs:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
           # Fetches the merge commit and its parents
           fetch-depth: 2
+
       - name: Checking out base branch
         run: |
           base=$(mktemp -d)
@@ -25,6 +27,7 @@ jobs:
           git worktree add "$base" "$baseRev"
           echo "baseRev=$baseRev" >> "$GITHUB_ENV"
           echo "base=$base" >> "$GITHUB_ENV"
+
       - name: Get Nixpkgs revision for nixf
         run: |
           # pin to a commit from nixpkgs-unstable to avoid e.g. building nixf
@@ -32,14 +35,17 @@ jobs:
           # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
           nix_path: nixpkgs=${{ env.url }}
+
       - name: Install nixf and jq
         # provided jq is incompatible with our expression
         run: "nix-env -f '<nixpkgs>' -iAP nixf jq"
+
       - name: Check that Nix files pass nixf-tidy
         run: |
           # Filtering error messages we don't like

.github/workflows/check-shell.yml

@@ -27,6 +27,8 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
       - name: Build shell
         run: nix-build shell.nix

.github/workflows/codeowners-v2.yml

@@ -1,5 +1,3 @@
-name: Codeowners v2
-
 # This workflow depends on two GitHub Apps with the following permissions:
 # - For checking code owners:
 #   - Permissions:
@@ -22,6 +20,8 @@ name: Codeowners v2
 #
 # Note that the latter is also used for ./eval.yml requesting reviewers.
 
+name: Codeowners v2
+
 on:
   pull_request_target:
     types: [opened, ready_for_review, synchronize, reopened, edited]
@@ -45,67 +45,67 @@ jobs:
     needs: get-merge-commit
     if: needs.get-merge-commit.outputs.mergedSha
     steps:
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
 
-    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
-      if: github.repository_owner == 'NixOS'
-      with:
-        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-        name: nixpkgs-ci
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+        if: github.repository_owner == 'NixOS'
+        with:
+          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+          name: nixpkgs-ci
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
-    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
-    # We later build and run code from the base branch with access to secrets,
-    # so it's important this is not the PRs code.
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        path: base
+      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
+      # We later build and run code from the base branch with access to secrets,
+      # so it's important this is not the PRs code.
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          path: base
 
-    - name: Build codeowners validator
-      run: nix-build base/ci -A codeownersValidator
+      - name: Build codeowners validator
+        run: nix-build base/ci -A codeownersValidator
 
-    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
-      id: app-token
-      with:
-        app-id: ${{ vars.OWNER_RO_APP_ID }}
-        private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
+      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+        id: app-token
+        with:
+          app-id: ${{ vars.OWNER_RO_APP_ID }}
+          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
 
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-        path: pr
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+          path: pr
 
-    - name: Validate codeowners
-      run: result/bin/codeowners-validator
-      env:
-        OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
-        GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
-        REPOSITORY_PATH: pr
-        OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
-        # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
-        EXPERIMENTAL_CHECKS: "avoid-shadowing"
+      - name: Validate codeowners
+        run: result/bin/codeowners-validator
+        env:
+          OWNERS_FILE: pr/${{ env.OWNERS_FILE }}
+          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPOSITORY_PATH: pr
+          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
+          # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
+          EXPERIMENTAL_CHECKS: "avoid-shadowing"
 
   # Request reviews from code owners
   request:
     name: Request
     runs-on: ubuntu-24.04
     steps:
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
 
-    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
-    # This is intentional, because we need to request the review of owners as declared in the base branch.
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR head.
+      # This is intentional, because we need to request the review of owners as declared in the base branch.
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
-      id: app-token
-      with:
-        app-id: ${{ vars.OWNER_APP_ID }}
-        private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
+        id: app-token
+        with:
+          app-id: ${{ vars.OWNER_APP_ID }}
+          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
 
-    - name: Build review request package
-      run: nix-build ci -A requestReviews
+      - name: Build review request package
+        run: nix-build ci -A requestReviews
 
-    - name: Request reviews
-      run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
-      env:
-        GH_TOKEN: ${{ steps.app-token.outputs.token }}
+      - name: Request reviews
+        run: result/bin/request-code-owner-reviews.sh ${{ github.repository }} ${{ github.event.number }} "$OWNERS_FILE"
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/editorconfig-v2.yml

@@ -1,15 +1,15 @@
 name: "Checking EditorConfig v2"
 
-permissions:
-  pull-requests: read
-  contents: read
-
 on:
   # avoids approving first time contributors
   pull_request_target:
     branches-ignore:
       - 'release-**'
 
+permissions:
+  pull-requests: read
+  contents: read
+
 jobs:
   get-merge-commit:
     uses: ./.github/workflows/get-merge-commit.yml
@@ -20,29 +20,34 @@ jobs:
     needs: get-merge-commit
     if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - name: Get list of changed files from PR
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh api \
-          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
-          | jq '.[] | select(.status != "removed") | .filename' \
-          > "$HOME/changed_files"
-    - name: print list of changed files
-      run: |
-        cat "$HOME/changed_files"
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        # pull_request_target checks out the base branch by default
-        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
-      with:
-        # nixpkgs commit is pinned so that it doesn't break
-        # editorconfig-checker 2.4.0
-        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
-    - name: Checking EditorConfig
-      run: |
-        < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
-    - if: ${{ failure() }}
-      run: |
-        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."
+      - name: Get list of changed files from PR
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
+            | jq '.[] | select(.status != "removed") | .filename' \
+            > "$HOME/changed_files"
+
+      - name: print list of changed files
+        run: |
+          cat "$HOME/changed_files"
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          # nixpkgs commit is pinned so that it doesn't break
+          # editorconfig-checker 2.4.0
+          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/c473cc8714710179df205b153f4e9fa007107ff9.tar.gz
+
+      - name: Checking EditorConfig
+        run: |
+          < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
+
+      - if: ${{ failure() }}
+        run: |
+          echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."

.github/workflows/eval-lib-tests.yml

@@ -1,12 +1,13 @@
 name: "Building Nixpkgs lib-tests"
 
-permissions:
-  contents: read
-
 on:
   pull_request_target:
     paths:
       - 'lib/**'
+
+permissions:
+  contents: read
+
 jobs:
   get-merge-commit:
     uses: ./.github/workflows/get-merge-commit.yml
@@ -21,10 +22,12 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
+
       - name: Building Nixpkgs lib-tests
         run: |
           nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix

.github/workflows/get-merge-commit.yml

@@ -16,28 +16,29 @@ jobs:
     outputs:
       mergedSha: ${{ steps.merged.outputs.mergedSha }}
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        path: base
-        sparse-checkout: ci
-    - name: Check if the PR can be merged and get the test merge commit
-      id: merged
-      env:
-        GH_TOKEN: ${{ github.token }}
-        GH_EVENT: ${{ github.event_name }}
-      run: |
-        case "$GH_EVENT" in
-          push)
-            echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
-            ;;
-          pull_request_target)
-            if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
-              echo "Checking the merge commit $mergedSha"
-              echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
-            else
-              # Skipping so that no notifications are sent
-              echo "Skipping the rest..."
-            fi
-            ;;
-        esac
-        rm -rf base
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          path: base
+          sparse-checkout: ci
+
+      - name: Check if the PR can be merged and get the test merge commit
+        id: merged
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_EVENT: ${{ github.event_name }}
+        run: |
+          case "$GH_EVENT" in
+            push)
+              echo "mergedSha=${{ github.sha }}" >> "$GITHUB_OUTPUT"
+              ;;
+            pull_request_target)
+              if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
+                echo "Checking the merge commit $mergedSha"
+                echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
+              else
+                # Skipping so that no notifications are sent
+                echo "Skipping the rest..."
+              fi
+              ;;
+          esac
+          rm -rf base

.github/workflows/labels.yml

@@ -1,14 +1,14 @@
+# WARNING:
+# When extending this action, be aware that $GITHUB_TOKEN allows some write
+# access to the GitHub API. This means that it should not evaluate user input in
+# a way that allows code injection.
+
 name: "Label PR"
 
 on:
   pull_request_target:
     types: [edited, opened, synchronize, reopened]
 
-# WARNING:
-# When extending this action, be aware that $GITHUB_TOKEN allows some write
-# access to the GitHub API. This means that it should not evaluate user input in
-# a way that allows code injection.
-
 permissions:
   contents: read
   pull-requests: write
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        sync-labels: true
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          sync-labels: true

.github/workflows/manual-nixos-v2.yml

@@ -1,8 +1,5 @@
 name: "Build NixOS manual v2"
 
-permissions:
-  contents: read
-
 on:
   pull_request_target:
     branches:
@@ -10,6 +7,9 @@ on:
     paths:
       - 'nixos/**'
 
+permissions:
+  contents: read
+
 jobs:
   nixos:
     name: nixos-manual-build
@@ -20,14 +20,17 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
+
       - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
       - name: Building NixOS manual
         run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true nixos/release.nix -A manual.x86_64-linux

.github/workflows/manual-nixpkgs-v2.yml

@@ -1,8 +1,5 @@
 name: "Build Nixpkgs manual v2"
 
-permissions:
-  contents: read
-
 on:
   pull_request_target:
     branches:
@@ -12,6 +9,9 @@ on:
       - 'lib/**'
       - 'pkgs/tools/nix/nixdoc/**'
 
+permissions:
+  contents: read
+
 jobs:
   nixpkgs:
     name: nixpkgs-manual-build
@@ -22,14 +22,17 @@ jobs:
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
+
       - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
         with:
           # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
           name: nixpkgs-ci
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
       - name: Building Nixpkgs manual
         run: NIX_PATH=nixpkgs=$(pwd) nix-build --option restrict-eval true pkgs/top-level/release.nix -A manual -A manual.tests

.github/workflows/nix-parse-v2.yml

@@ -1,15 +1,15 @@
 name: "Check whether nix files are parseable v2"
 
-permissions:
-  pull-requests: read
-  contents: read
-
 on:
   # avoids approving first time contributors
   pull_request_target:
     branches-ignore:
       - 'release-**'
 
+permissions:
+  pull-requests: read
+  contents: read
+
 jobs:
   get-merge-commit:
     uses: ./.github/workflows/get-merge-commit.yml
@@ -20,30 +20,33 @@ jobs:
     needs: get-merge-commit
     if: "needs.get-merge-commit.outputs.mergedSha && github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-    - name: Get list of changed files from PR
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      run: |
-        gh api \
-          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
-          | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
-          > "$HOME/changed_files"
-        if [[ -s "$HOME/changed_files" ]]; then
-          echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
-        fi
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      with:
-        # pull_request_target checks out the base branch by default
-        ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
-      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
-      with:
-        nix_path: nixpkgs=channel:nixpkgs-unstable
-    - name: Parse all changed or added nix files
-      run: |
-        ret=0
-        while IFS= read -r file; do
-          out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
-        done < "$HOME/changed_files"
-        exit "$ret"
-      if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
+      - name: Get list of changed files from PR
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api \
+            repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
+            | jq --raw-output '.[] | select(.status != "removed" and (.filename | endswith(".nix"))) | .filename' \
+            > "$HOME/changed_files"
+          if [[ -s "$HOME/changed_files" ]]; then
+            echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
+          fi
+
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
+
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          nix_path: nixpkgs=channel:nixpkgs-unstable
+
+      - name: Parse all changed or added nix files
+        run: |
+          ret=0
+          while IFS= read -r file; do
+            out="$(nix-instantiate --parse "$file")" || { echo "$out" && ret=1; }
+          done < "$HOME/changed_files"
+          exit "$ret"
+        if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}

.github/workflows/nixpkgs-vet.yml

@@ -2,6 +2,7 @@
 # Among other checks, it makes sure that `pkgs/by-name` (see `../../pkgs/by-name/README.md`) follows the validity rules outlined in [RFC 140](https://github.com/NixOS/rfcs/pull/140).
 # When you make changes to this workflow, please also update `ci/nixpkgs-vet.sh` to reflect the impact of your work to the CI.
 # See https://github.com/NixOS/nixpkgs-vet for details on the tool and its checks.
+
 name: Vet nixpkgs
 
 on:
@@ -37,12 +38,15 @@ jobs:
           ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
           # Fetches the merge commit and its parents
           fetch-depth: 2
+
       - name: Checking out base branch
         run: |
           base=$(mktemp -d)
           git worktree add "$base" "$(git rev-parse HEAD^1)"
           echo "base=$base" >> "$GITHUB_ENV"
+
       - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
       - name: Fetching the pinned tool
         # Update the pinned version using ci/nixpkgs-vet/update-pinned-tool.sh
         run: |
@@ -55,6 +59,7 @@ jobs:
 
           # Adds a result symlink as a GC root.
           nix-store --realise "$toolPath" --add-root result
+
       - name: Running nixpkgs-vet
         env:
           # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/

.github/workflows/no-channel.yml

@@ -15,11 +15,11 @@ jobs:
     name: "This PR is is targeting a channel branch"
     runs-on: ubuntu-24.04
     steps:
-    - run: |
-        cat <<EOF
-        The nixos-* and nixpkgs-* branches are pushed to by the channel
-        release script and should not be merged into directly.
+      - run: |
+          cat <<EOF
+          The nixos-* and nixpkgs-* branches are pushed to by the channel
+          release script and should not be merged into directly.
 
-        Please target the equivalent release-* branch or master instead.
-        EOF
-        exit 1
+          Please target the equivalent release-* branch or master instead.
+          EOF
+          exit 1

.github/workflows/periodic-merge-24h.yml

@@ -7,7 +7,6 @@
 
 name: "Periodic Merges (24h)"
 
-
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string

.github/workflows/periodic-merge-6h.yml

@@ -7,7 +7,6 @@
 
 name: "Periodic Merges (6h)"
 
-
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string

.github/workflows/periodic-merge-haskell-updates.yml

@@ -9,7 +9,6 @@
 
 name: "Periodic Merges (haskell-updates)"
 
-
 on:
   schedule:
     # * is a special character in YAML so you have to quote this string