From 8353c8c10eb2c0ef16f94a664dbb7d7b0399f578 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Thu, 21 Aug 2025 16:46:15 +0200
Subject: [PATCH] ci/github-script/prepare: avoid running CI when targeting
 channel branches

This moves the no-channel-base check into the prepare script to exit
early and prevent all of CI to run against those branches. We also
provide better output by posting a "Changes Requested" review, using the
existing infrastructure from the old cherry-picks check.

The review will be dismissed automatically once the branch has been
corrected, because the commits check will run and do it.

(cherry picked from commit 0601cf6fd0868b31429d3e1c90781fbba8b2b0c2)
---
 .github/workflows/check.yml | 14 -------------
 .github/workflows/pr.yml    |  4 ++++
 ci/github-script/prepare.js | 41 +++++++++++++++++++++++++------------
 ci/supportedBranches.js     |  1 +
 4 files changed, 33 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 662796e47ef3..e8fe7c3717dc 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -31,20 +31,6 @@ defaults:
     shell: bash
 
 jobs:
-  no-channel-base:
-    name: no channel base
-    if: contains(fromJSON(inputs.baseBranch).type, 'channel')
-    runs-on: ubuntu-24.04-arm
-    steps:
-      - run: |
-          cat <<EOF
-          The nixos-* and nixpkgs-* branches are pushed to by the channel
-          release script and should not be merged into directly.
-
-          Please target the equivalent release-* branch or master instead.
-          EOF
-          exit 1
-
   commits:
     permissions:
       pull-requests: write
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 81f0f1d0f507..2ab850094e33 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -23,6 +23,9 @@ permissions: {}
 jobs:
   prepare:
     runs-on: ubuntu-24.04-arm
+    permissions:
+      # wrong branch review comment
+      pull-requests: write
     outputs:
       baseBranch: ${{ steps.prepare.outputs.base }}
       headBranch: ${{ steps.prepare.outputs.head }}
@@ -44,6 +47,7 @@ jobs:
               github,
               context,
               core,
+              dry: context.eventName == 'pull_request',
             })
 
   check:
diff --git a/ci/github-script/prepare.js b/ci/github-script/prepare.js
index 0fcec880f376..3df1bfa116e5 100644
--- a/ci/github-script/prepare.js
+++ b/ci/github-script/prepare.js
@@ -1,6 +1,7 @@
 const { classify } = require('../supportedBranches.js')
+const { postReview } = require('./reviews.js')
 
-module.exports = async ({ github, context, core }) => {
+module.exports = async ({ github, context, core, dry }) => {
   const pull_number = context.payload.pull_request.number
 
   for (const retryInterval of [5, 10, 20, 40, 80]) {
@@ -24,6 +25,32 @@ module.exports = async ({ github, context, core }) => {
 
     const { base, head } = prInfo
 
+    const baseClassification = classify(base.ref)
+    core.setOutput('base', baseClassification)
+    console.log('base classification:', baseClassification)
+
+    const headClassification =
+      base.repo.full_name === head.repo.full_name
+        ? classify(head.ref)
+        : // PRs from forks are always considered WIP.
+          { type: ['wip'] }
+    core.setOutput('head', headClassification)
+    console.log('head classification:', headClassification)
+
+    if (baseClassification.type.includes('channel')) {
+      const { stable, version } = baseClassification
+      const correctBranch = stable ? `release-${version}` : 'master'
+      const body = [
+        'The `nixos-*` and `nixpkgs-*` branches are pushed to by the channel release script and should not be merged into directly.',
+        '',
+        `Please target \`${correctBranch}\` instead.`,
+      ].join('\n')
+
+      await postReview({ github, context, core, dry, body })
+
+      throw new Error('The PR targets a channel branch.')
+    }
+
     let mergedSha, targetSha
 
     if (prInfo.mergeable) {
@@ -56,18 +83,6 @@ module.exports = async ({ github, context, core }) => {
 
     core.setOutput('systems', require('../supportedSystems.json'))
 
-    const baseClassification = classify(base.ref)
-    core.setOutput('base', baseClassification)
-    console.log('base classification:', baseClassification)
-
-    const headClassification =
-      base.repo.full_name === head.repo.full_name
-        ? classify(head.ref)
-        : // PRs from forks are always considered WIP.
-          { type: ['wip'] }
-    core.setOutput('head', headClassification)
-    console.log('head classification:', headClassification)
-
     const files = (
       await github.paginate(github.rest.pulls.listFiles, {
         ...context.repo,
diff --git a/ci/supportedBranches.js b/ci/supportedBranches.js
index fd7dcc9144f3..8cc630afce21 100755
--- a/ci/supportedBranches.js
+++ b/ci/supportedBranches.js
@@ -26,6 +26,7 @@ function classify(branch) {
   return {
     stable: (version ?? 'unstable') !== 'unstable',
     type: typeConfig[prefix] ?? ['wip'],
+    version: version ?? 'unstable',
   }
 }