Merge master into staging-next

Author: nixpkgs-ci[bot]

.github/workflows/check.yml

@@ -12,17 +12,12 @@ on:
       mergedSha:
         required: true
         type: string
-      ownersCanFail:
-        required: true
-        type: boolean
       targetSha:
         required: true
         type: string
     secrets:
       CACHIX_AUTH_TOKEN:
         required: true
-      OWNER_RO_APP_PRIVATE_KEY:
-        required: true
 
 permissions: {}
 
@@ -72,19 +67,8 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh api /rate_limit | jq
 
-  # For checking code owners, this job depends on a GitHub App with the following permissions:
-  # - Permissions:
-  #   - Repository > Administration: read-only
-  #   - Organization > Members: read-only
-  # - Install App on this repository, setting these variables:
-  #   - OWNER_RO_APP_ID (variable)
-  #   - OWNER_RO_APP_PRIVATE_KEY (secret)
-  #
-  # This should not use the same app as the job to request reviewers, because this job requires
-  # handling untrusted PR input.
   owners:
     runs-on: ubuntu-24.04-arm
-    continue-on-error: ${{ inputs.ownersCanFail }}
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -94,7 +78,6 @@ jobs:
         uses: ./.github/actions/checkout
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
-          target-as-trusted-at: ${{ inputs.targetSha }}
 
       - uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
 
@@ -107,36 +90,15 @@ jobs:
           pushFilter: -source$
 
       - name: Build codeowners validator
-        run: nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A codeownersValidator
-
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
-        if: github.event_name == 'pull_request_target' && vars.OWNER_RO_APP_ID
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_RO_APP_ID }}
-          private-key: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
-          permission-administration: read
-          permission-members: read
-
-      - name: Log current API rate limits
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq
+        run: nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A codeownersValidator
 
       - name: Validate codeowners
-        if: steps.app-token.outputs.token
         env:
           OWNERS_FILE: nixpkgs/untrusted/ci/OWNERS
-          GITHUB_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
           REPOSITORY_PATH: nixpkgs/untrusted
-          OWNER_CHECKER_REPOSITORY: ${{ github.repository }}
+          # Omits "owners", which checks whether GitHub handles exist, but fails with nested team
+          # structures.
+          CHECKS: "duppatterns,files,syntax"
           # Set this to "notowned,avoid-shadowing" to check that all files are owned by somebody
           EXPERIMENTAL_CHECKS: "avoid-shadowing"
         run: result/bin/codeowners-validator
-
-      - name: Log current API rate limits
-        if: steps.app-token.outputs.token
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: gh api /rate_limit | jq

.github/workflows/pr.yml

@@ -11,8 +11,6 @@ on:
       OWNER_APP_PRIVATE_KEY:
         # The Test workflow should not actually request reviews from owners.
         required: false
-      OWNER_RO_APP_PRIVATE_KEY:
-        required: true
 
 concurrency:
   group: pr-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
@@ -59,13 +57,11 @@ jobs:
       pull-requests: write
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
-      OWNER_RO_APP_PRIVATE_KEY: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
     with:
       baseBranch: ${{ needs.prepare.outputs.baseBranch }}
       headBranch: ${{ needs.prepare.outputs.headBranch }}
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
-      ownersCanFail: ${{ !contains(fromJSON(needs.prepare.outputs.touched), 'owners') }}
 
   lint:
     name: Lint

.github/workflows/test.yml

@@ -98,7 +98,6 @@ jobs:
     secrets:
       CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
       NIXPKGS_CI_APP_PRIVATE_KEY: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-      OWNER_RO_APP_PRIVATE_KEY: ${{ secrets.OWNER_RO_APP_PRIVATE_KEY }}
 
   push:
     if: needs.prepare.outputs.push

ci/github-script/prepare.js

@@ -221,7 +221,6 @@ module.exports = async ({ github, context, core, dry }) => {
 
     const touched = []
     if (files.includes('ci/pinned.json')) touched.push('pinned')
-    if (files.includes('ci/OWNERS')) touched.push('owners')
     core.setOutput('touched', touched)
 
     return

maintainers/README.md

@@ -155,8 +155,15 @@ When reviewing changes to a team, read the team's scope and the context around t
 In any case, request reviews from the existing team members.
 If the team lists no specific membership policy, feel free to merge changes to the team after giving the existing members a few days to respond.
 
-*Important:* If a team says it is a closed group, do not merge additions to the team without an approval by at least one existing member.
+> [!IMPORTANT]
+> If a team says it is a closed group, do not merge additions to the team without an approval by at least one existing member.
 
+A corresponding GitHub team can be created by any org member.
+When creating the team it should be created with the `nixpkgs-maintainers` team as parent.
+Once approved, the team will have the right privileges to be pinged and requested for review in Nixpkgs.
+
+> [!TIP]
+> The team name should be as short as possible; because it is nested under the maintainers group, no -maintainers suffix is needed.
 
 # Maintainer scripts
 

maintainers/maintainer-list.nix

@@ -18098,12 +18098,6 @@
     githubId = 50854675;
     name = "Nelson Jeppesen";
   };
-  neonfuz = {
-    email = "neonfuz@gmail.com";
-    github = "neonfuz";
-    githubId = 2590830;
-    name = "Sage Raflik";
-  };
   neosimsim = {
     email = "me@abn.sh";
     github = "neosimsim";
@@ -19975,12 +19969,6 @@
     githubId = 63069986;
     name = "Per Stark";
   };
-  petee = {
-    name = "Pete Erickson";
-    email = "pete.perickson@gmail.com";
-    github = "petee";
-    githubId = 89916;
-  };
   Peter3579 = {
     github = "Peter3579";
     githubId = 170885528;

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -198,6 +198,8 @@
 
 - The `services.postgresql` module now sets up a systemd unit `postgresql.target`. Depending on `postgresql.target` guarantees that postgres is in read-write mode and initial/ensure scripts were executed. Depending on `postgresql.service` only guarantees a read-only connection.
 
+- The `services.mysql` module now restarts the database `on-abnormal`, which means that it now will be restarted in certain situations, it wasn't before. For example an OOM-kill.
+
 - The `services.siproxd` module has been removed as `siproxd` is unmaintained and broken with libosip 5.x.
 
 - `services.tor.torsocks.enable` no longer defaults to true if Tor and Tor client functionality is enabled.

nixos/modules/hardware/opentabletdriver.nix

@@ -53,18 +53,16 @@ in
 
     boot.blacklistedKernelModules = cfg.blacklistedKernelModules;
 
-    systemd.user.services.opentabletdriver =
-      with pkgs;
-      lib.mkIf cfg.daemon.enable {
-        description = "Open source, cross-platform, user-mode tablet driver";
-        wantedBy = [ "graphical-session.target" ];
-        partOf = [ "graphical-session.target" ];
+    systemd.user.services.opentabletdriver = lib.mkIf cfg.daemon.enable {
+      description = "Open source, cross-platform, user-mode tablet driver";
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
 
-        serviceConfig = {
-          Type = "simple";
-          ExecStart = "${cfg.package}/bin/otd-daemon";
-          Restart = "on-failure";
-        };
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = lib.getExe' cfg.package "otd-daemon";
+        Restart = "on-failure";
       };
+    };
   };
 }

nixos/modules/services/databases/mysql.nix

@@ -691,7 +691,7 @@ in
       serviceConfig = lib.mkMerge [
         {
           Type = if hasNotify then "notify" else "simple";
-          Restart = "on-abort";
+          Restart = "on-abnormal";
           RestartSec = "5s";
 
           # User and group

nixos/modules/services/networking/bird-lg.nix

@@ -16,7 +16,7 @@ let
     {
       "--servers" = lib.concatStringsSep "," fe.servers;
       "--domain" = fe.domain;
-      "--listen" = fe.listenAddress;
+      "--listen" = stringOrConcat "," fe.listenAddresses;
       "--proxy-port" = fe.proxyPort;
       "--whois" = fe.whois;
       "--dns-interface" = fe.dnsInterface;
@@ -37,7 +37,7 @@ let
     {
       "--allowed" = lib.concatStringsSep "," px.allowedIPs;
       "--bird" = px.birdSocket;
-      "--listen" = px.listenAddress;
+      "--listen" = stringOrConcat "," px.listenAddresses;
       "--traceroute_bin" = px.traceroute.binary;
       "--traceroute_flags" = lib.concatStringsSep " " px.traceroute.flags;
       "--traceroute_raw" = px.traceroute.rawOutput;
@@ -58,6 +58,17 @@ let
     args: lib.mapAttrsToList (name: value: "${name} " + mkArgValue value) (filterNull args);
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "bird-lg" "frontend" "listenAddress" ]
+      [ "services" "bird-lg" "frontend" "listenAddresses" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "bird-lg" "proxy" "listenAddress" ]
+      [ "services" "bird-lg" "proxy" "listenAddresses" ]
+    )
+  ];
+
   options = {
     services.bird-lg = {
       package = lib.mkPackageOption pkgs "bird-lg" { };
@@ -77,8 +88,8 @@ in
       frontend = {
         enable = lib.mkEnableOption "Bird Looking Glass Frontend Webserver";
 
-        listenAddress = lib.mkOption {
-          type = lib.types.str;
+        listenAddresses = lib.mkOption {
+          type = with lib.types; either str (listOf str);
           default = "127.0.0.1:5000";
           description = "Address to listen on.";
         };
@@ -202,8 +213,8 @@ in
       proxy = {
         enable = lib.mkEnableOption "Bird Looking Glass Proxy";
 
-        listenAddress = lib.mkOption {
-          type = lib.types.str;
+        listenAddresses = lib.mkOption {
+          type = with lib.types; either str (listOf str);
           default = "127.0.0.1:8000";
           description = "Address to listen on.";
         };