workflows/auto-merge{,-enable,-abort}: init

[felschr]

Description of changes

Add GitHub workflow for auto-merging PRs once checks all succeed based on a label that only committers can set.

This is very much WIP, not tested at all and I'm not that familiar with GitHub actions, but it seems feasible.

@delroth shared this idea on Matrix.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.11 Release Notes (or backporting 23.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[delroth]

@delroth shared this idea on Matrix: https://matrix.to/#/!kjdutkOsheZdjqYmqp:nixos.org/$CdzV5mNDPxohBv_NMz6zrwmIgTR5EQ3pYoiPn364LpU?via=nixos.org&via=matrix.org&via=nixos.dev

To expand on the rationale: I've noticed that I very commonly have to tell people "this PR seems fine, I'll merge it once ofborg is green". Then I either forget, or I have to context switch at some later point in the future when I hope that ofborg will have completed :-) I'd much rather this be automated to save on that context switch and decrease merge latency.

[delroth]

I'm worried about TOCTOU problems here - it seems hard to "prove" for sure that they don't exist with how this is currently architectured. If you're confident that this implementation doesn't have TOCTOU problems, I'd thoroughly document it somewhere.

[Mic92]

In the github API, you can specify the sha hash to merge: https://docs.github.com/en/free-pro-team@latest/rest/pulls/pulls?apiVersion=2022-11-28#merge-a-pull-request
This means you can make sure that the PR was not updated with newer content than what your current state was.

[delroth]

I think that check_suite events contain the SHA of the commit for which they were ran. Maybe this is something we could use for merge-branch to additionally make sure that we're merging the right thing?

[delroth]

Let's use this thread to bikeshed label name :P

My suggestion: "merge-on-green" or something along those lines, which attempts to state the condition for the merge to happen automatically.

[delroth]

Alternative implementations:

• GH's native implem of this: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/incorporating-changes-from-a-pull-request/automatically-merging-a-pull-request
  • Requires enforcing the CI check, according to @alyssais. TODO: have we 100% confirmed this?
    • Might not be a deal breaker if all "enforcing" means is that mergers get a warning and a checkbox to click when merging a PR where ofborg fails?
  • Clunky, according to @RaitoBezarius who has experience using this on Lanzaboote.
  • Benefits: not "abusing" labels for process control, which also means we wouldn't need hacks on top of GH's permission model. Likely more secure, less buggy, better integrated with better UX.
• An actual CQ/merge queue for nixpkgs.
  • Significantly more effort, would almost certainly need to be RFC'd, months to years away.

[felschr]

auto-merge-enable & auto-merge-abort work now, but auto-merge isn't being triggered for some reason.

I've been testing this over here: https://github.com/felschr-org/nixpkgs/pull/6

[felschr]

check_run never seems to get invoked for workflows (and workflow_run requires specifying workflows).
Seems that OfBorg will invoke check_run, though. OfBorg doesn't run for my fork, so haven't tested this.

Usually OfBorg will be the last check to finish, so it might be alright to ignore workflows. We can also include the workflows, but we need to specify all of them which is a bit error-prone.

I'll still try using workflow_run later, just to be able to test this in my fork.

[felschr]

I think this might be a better fit for nixpkgs-merge-bot now.
There is a related issue: NixOS/nixpkgs-merge-bot#95

Either way, since I unfortunately don't have time to look into this further at the moment, I'm closing this PR.