mirror of
https://github.com/CHN-beta/nixpkgs.git
synced 2026-01-12 02:40:31 +08:00
a55f7ddced
By consistently checking out nixpkgs into the same location in every
workflow, it's easier to reason about the different workflows at once.
We also use crystal-clear names to make clear, which checkouts are
considered trusted, because they only contain target-branch-code and
which checkouts are untrusted, because they contain code from the head
branch. By naming the checkout directories trusted/untrusted, it's
obvious at the call-site.
One example of where we likely did the wrong thing is the nixpkgs-vet
workflow: Fetching the toolVersion from the untrusted checkout opens the
door for an injection into the download URL, thus code could be
downloaded from anywhere. This is not a problem, because this workflow
does not run with elevated privileges, but it's a scary oversight
nonetheless.
(cherry picked from commit 6720d25429)
47 lines
1.6 KiB
YAML
47 lines
1.6 KiB
YAML
name: Check that files are formatted
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- .github/workflows/check-format.yml
|
|
pull_request_target:
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
nixos:
|
|
name: fmt-check
|
|
runs-on: ubuntu-24.04-arm
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
sparse-checkout: .github/actions
|
|
- name: Check if the PR can be merged and get the test merge commit
|
|
uses: ./.github/actions/get-merge-commit
|
|
id: get-merge-commit
|
|
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
ref: ${{ steps.get-merge-commit.outputs.mergedSha }}
|
|
path: untrusted
|
|
|
|
- uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
|
|
with:
|
|
extra_nix_config: sandbox = true
|
|
|
|
- name: Check that files are formatted
|
|
run: |
|
|
# Note that it's fine to run this on untrusted code because:
|
|
# - There's no secrets accessible here
|
|
# - The build is sandboxed
|
|
if ! nix-build untrusted/ci -A fmt.check; then
|
|
echo "Some files are not properly formatted"
|
|
echo "Please format them by going to the Nixpkgs root directory and running one of:"
|
|
echo " nix-shell --run treefmt"
|
|
echo " nix develop --command treefmt"
|
|
echo " nix fmt"
|
|
echo "Make sure your branch is up to date with master; rebase if not."
|
|
echo "If you're having trouble, please ping @NixOS/nix-formatting"
|
|
exit 1
|
|
fi
|