Switch to PR workflow for nominations

Author: infinisil

.github/workflows/nomination.yml

@@ -0,0 +1,37 @@
+name: nomination
+
+on:
+  pull_request_target:
+    types: [edited, opened, synchronize, reopened]
+
+# We don't need to use the GitHub App for this workflow,
+# because it's all localised to this repo
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  process:
+    name: Check
+    runs-on: ubuntu-latest
+    if: ${{ ! contains(github.event.pull_request.labels.*.name, 'nomination') && github.event.pull_request.head.ref != 'create-pull-request/sync' }}
+    steps:
+      - name: Fetch source
+        uses: actions/checkout@v4
+      - name: Process nomination
+        run: |
+          set -o pipefail
+          gh api "repos/$REPOSITORY/pulls/$PR_NUMBER/files" \
+            --jq '.[] | "\(.status) \(.filename)"' \
+            | scripts/nomination.sh members "$REPOSITORY" "$PR_NUMBER" "$PR_TITLE" "$ANNOUNCEMENT_ISSUE_NUMBER"
+        env:
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          ANNOUNCEMENT_ISSUE_NUMBER: "${{
+              github.repository_owner == 'NixOS' && 35 ||
+              github.repository_owner == 'infinisil-test-org' && 30 ||
+              'NO_ISSUE_NUMBER'
+            }}"
+          GH_TOKEN: ${{ github.token }}
+          PROD: "1"

README.md

@@ -6,8 +6,16 @@ whose members have write access to [Nixpkgs](https://github.com/nixos/nixpkgs).
 
 The [Nixpkgs commit delegators](https://github.com/orgs/NixOS/teams/commit-bit-delegation)
 maintain the member list in this repository.
-While it's in principle possible to request Nixpkgs commit permissions by creating a PR,
-please nominate yourself in [this issue](https://github.com/NixOS/nixpkgs/issues/321665) instead.
+
+## Nominations
+
+To nominate yourself or somebody else:
+1. Create an empty `members/<GITHUB_HANDLE>` file ([direct GitHub link](/../../new/main/members?filename=%3CGITHUB_HANDLE%3E))
+2. Create a PR with the change with the motivation in the PR description
+
+Such nominations are also automatically announced in [this issue](https://github.com/NixOS/nixpkgs/issues/999999), which you can subscribe to for updates.
+
+You can see all current nominations [here](/../../issues?q=state%3Aopen%20label%3Anomination)
 
 ## Semi-automatic synchronisation
 

scripts/README.md

@@ -41,7 +41,43 @@ scripts/sync.sh infinisil-test-org actors members
 
 Check that it synchronises the files in the `members` directory with the team members of the `actors` team.
 
-## `retire.sh`
+## Testing `nomination.sh`
+
+This script does not depend on the current repository, but has some external effects.
+For testing, we'll use [PR #33](https://github.com/infinisil-test-org/nixpkgs-committers/pull/33) and [issue #30](https://github.com/infinisil-test-org/nixpkgs-committers/issues/30).
+
+To test:
+1. Make sure that the nomination label is not present on the PR
+1. Run the script while simulating that a non-nomination PR was opened:
+   ```bash
+   scripts/nomination.sh members infinisil-test-org/nixpkgs-committers 33 "Removed ghost" 30 <<< "removed members/ghost"
+   ```
+
+   Ensure that it exits with 0 and wouldn't run any effects.
+1. Run the script while simulating that multiple users were nominated together:
+   ```bash
+   scripts/nomination.sh members infinisil-test-org/nixpkgs-committers 33 "Added foo and bar" 30 <<< "removed members/foo"$'\n'"added members/bar"
+   ```
+
+   Ensure that it exits with non-0 and wouldn't run any effects.
+1. Run the script while simulating that the nominated user is not mentioned in the title
+   ```bash
+   scripts/nomination.sh members infinisil-test-org/nixpkgs-committers 33 "Added somebody" 30 <<< "added members/ghost"
+   ```
+
+   Ensure that it exits with non-0 and wouldn't run any effects.
+1. Run the script simulating a successful nomination
+   ```bash
+   scripts/nomination.sh members infinisil-test-org/nixpkgs-committers 33 "Added ghost" 30 <<< "added members/ghost"
+   ```
+
+   Ensure that it exits with 0 and would run effects to label the PR and post a comment in the issue.
+1. Rerun with effects
+   ```bash
+   PROD=1 scripts/nomination.sh members infinisil-test-org/nixpkgs-committers 33 "Added ghost" 30 <<< "added members/ghost"
+   ```
+
+## Testing `retire.sh`
 
 This script has external effects and as such needs a bit more care when testing.
 

scripts/nomination.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+
+source "$(dirname -- "${BASH_SOURCE[0]}")"/common.sh
+
+shopt -s nocasematch
+
+usage() {
+  log "Usage: $0 MEMBERS_DIR REPOSITORY PR_NUMBER PR_TITLE ANNOUNCEMENT_ISSUE_NUMBER"
+  exit 1
+}
+
+MEMBERS_DIR=${1:-$(usage)}
+REPOSITORY=${2:-$(usage)}
+PR_NUMBER=${3:-$(usage)}
+PR_TITLE=${4:-$(usage)}
+ANNOUNCEMENT_ISSUE_NUMBER=${5:-$(usage)}
+
+log "Waiting to get changed files on stdin.."
+readarray -t changedFiles
+declare -p changedFiles
+
+regex="added $MEMBERS_DIR/(.*)"
+
+nomineeHandle=
+for statusFilename in "${changedFiles[@]}"; do
+  if [[ "$statusFilename" =~ $regex ]]; then
+    nomineeHandle=${BASH_REMATCH[1]}
+    break
+  fi
+done
+
+if [[ -z "$nomineeHandle" ]]; then
+  log "Not a nomination PR"
+  exit 0
+elif (( "${#changedFiles[@]}" > 1 )); then
+  log "Only one person can be nominated per PR"
+  exit 1
+fi
+
+if [[ "$PR_TITLE" != *$nomineeHandle* ]]; then
+  log "GitHub user @$nomineeHandle is not mentioned in the PR title"
+  exit 1
+fi
+
+effect gh api \
+  --method POST \
+  "/repos/$REPOSITORY/issues/$ANNOUNCEMENT_ISSUE_NUMBER/comments" \
+  -F "body=@-" << EOF
+The user @$nomineeHandle has been nominated. Endorsements and discussions should be held in the corresponding nomination PR: $REPOSITORY#$PR_NUMBER
+EOF
+
+effect gh api \
+  --method POST \
+  "/repos/$REPOSITORY/issues/$PR_NUMBER/labels" \
+  -f "labels[]=nomination"