2026-07-22, Version 26.6.0 (Current)

.github/workflows/benchmark.yml

@@ -25,11 +25,43 @@ on:
         type: number
         default: 30
         description: How many times to repeat each benchmark
+      post-comment:
+        type: boolean
+        description: Post a comment linking to the run, with the aggregated result once known.
+      token:
+        type: string
+        description: A GitHub token to post comments cross repository (not recommended)
 
 permissions:
   contents: read
 
 jobs:
+  post-comment:
+    if: inputs.post-comment
+    outputs:
+      body: ${{ steps.comment.outputs.COMMENT_BODY }}
+      url: ${{ steps.comment.outputs.COMMENT_URL }}
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Mark token input as sensitive
+        if: inputs.token != ''
+        run: echo "::add-mask::${{ inputs.token }}"
+      - name: Add link to the current run
+        id: comment
+        run: |
+          FILTER_IF_SET=
+          [ -z "$FILTER" ] || FILTER_IF_SET=" / $FILTER"
+          COMMENT_BODY="Benchmark GHA (${CATEGORIES}${FILTER_IF_SET}): ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+          echo "COMMENT_BODY=$COMMENT_BODY" >> "$GITHUB_OUTPUT"
+          echo "COMMENT_URL=$(gh pr comment -R "${REPO:-$GITHUB_REPOSITORY}" "$PR_ID" --body "$COMMENT_BODY")" >> "$GITHUB_OUTPUT"
+        env:
+          CATEGORIES: ${{ inputs.category }}
+          FILTER: ${{ inputs.filter }}
+          GH_TOKEN: ${{ inputs.token || github.token }}
+          REPO: ${{ inputs.repo }}
+          PR_ID: ${{ inputs.pr_id }}
   build:
     strategy:
       fail-fast: true
@@ -155,9 +187,13 @@ jobs:
           path: ${{ matrix.system }}.csv
 
   aggregate-results:
-    needs: build
+    needs: [build, post-comment]
+    if: ${{ always() && needs.build.result == 'success' && needs.post-comment.result == (inputs.post-comment && 'success' || 'skipped') }}
     name: Aggregate benchmark results
     runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
@@ -200,4 +236,30 @@ jobs:
                 echo "> [!WARNING] "
                 echo "> Do not take GHA benchmark results as face value, always confirm them"
                 echo "> using a dedicated machine, e.g. Jenkins CI."
-            ' | tee /dev/stderr >> "$GITHUB_STEP_SUMMARY"
+            ' | tee /dev/stderr ${{ inputs.post-comment && 'body.txt' || '' }} >> "$GITHUB_STEP_SUMMARY"
+      - name: Mark token input as sensitive
+        if: inputs.token != ''
+        run: echo "::add-mask::${{ inputs.token }}"
+      - name: Edit comment
+        if: inputs.post-comment
+        run: |
+          {
+            echo "$COMMENT_BODY"
+            echo
+            echo '<details><summary>Results</summary>'
+            echo
+            cat body.txt
+            echo
+            echo '</details>'
+          } | jq -Rrcs '{ body: . }' | gh api \
+            --method PATCH \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2026-03-10" \
+            "/repos/${REPO:-$GITHUB_REPOSITORY}/issues/comments/${COMMENT_URL##*-}" \
+            --input -
+        env:
+          GH_TOKEN: ${{ inputs.token || github.token }}
+          REPO: ${{ inputs.repo }}
+          COMMENT_BODY: ${{ needs.post-comment.outputs.body }}
+          COMMENT_URL: ${{ needs.post-comment.outputs.url }}
+          PR_ID: ${{ inputs.pr_id }}

.github/workflows/build-shared.yml

@@ -38,8 +38,9 @@ jobs:
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
-          name: tarballs
           path: tarballs
+          pattern: '*.tar.gz'
+          merge-multiple: true
 
       - name: Extract tarball
         shell: bash

.github/workflows/build-tarball.yml

@@ -91,9 +91,8 @@ jobs:
       - name: Upload tarball artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
-          name: tarballs
           path: '*.tar.gz'
-          compression-level: 0
+          archive: false
   test-tarball-linux:
     needs: build-tarball
     runs-on: ubuntu-24.04-arm
@@ -125,7 +124,6 @@ jobs:
       - name: Download tarball
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
-          name: tarballs
           path: tarballs
       - name: Extract tarball
         run: |

.github/workflows/linters.yml

@@ -132,26 +132,6 @@ jobs:
           NODE=$(command -v node) make lint-md
         env:
           NODE_RELEASED_VERSIONS: ${{ steps.get-released-versions.outputs.NODE_RELEASED_VERSIONS }}
-  lint-nix:
-    if: github.event.pull_request.draft == false
-    runs-on: ubuntu-slim
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          persist-credentials: false
-          sparse-checkout: '*.nix'
-          sparse-checkout-cone-mode: false
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3  # v31.10.6
-      - name: Lint Nix files
-        run: |
-          nix-shell -I nixpkgs=./tools/nix/pkgs.nix -p 'nixfmt-tree' --run '
-            treefmt --quiet --ci
-          ' && EXIT_CODE="$?" || EXIT_CODE="$?"
-          if [ "$EXIT_CODE" != "0" ]
-          then
-            git --no-pager diff || true
-            exit "$EXIT_CODE"
-          fi
 
   lint-py:
     if: github.event.pull_request.draft == false

.github/workflows/nix-changes-comment.yml

@@ -0,0 +1,98 @@
+# This action requires the following secrets to be set on the repository:
+#   GH_USER_TOKEN: GitHub user token, to be used by ncu and to push changes
+name: Comment on PR on Nix changes
+
+on:
+  workflow_run:
+    workflows: [Nix files edited]
+    types: [completed]
+
+permissions: {}
+
+jobs:
+  aggregate-results:
+    if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'pull_request' }}
+    name: Aggregate results
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Download artefacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
+        with:
+          run-id: ${{ github.event.workflow_run.id }}
+          # Using privileged token to be able to download file from a different workflow
+          github-token: ${{ secrets.GH_USER_TOKEN }}
+
+      - name: Fetch PR data
+        id: pr-data
+        run: |
+          mv requisites-*/* .
+          ls
+          if grep -nvHE '^/nix/store/[0-9a-df-np-sv-z]{32}-[A-Za-z0-9?=._+-]+$' requisites-*.list; then
+            echo 'Unexpected line format in requisites list; refusing to process.' >&2
+            exit 1
+          fi
+          echo "NUMBER=$(grep -E '^[0-9]+$' pr_number.txt || true)" >> "$GITHUB_OUTPUT"
+
+      - name: Aggregate results
+        if: ${{ steps.pr-data.outputs.NUMBER }}
+        run: |
+          set -x
+          > requisites-before.list
+          > requisites-after.list
+          TABLE=$(
+            echo '| Platform | Number of requisites | Proportion of new derivations |'
+            echo '| :-: | -: | -: |'
+            TOTAL_BEFORE=0
+            TOTAL_AFTER=0
+            TOTAL_CHANGED=0
+            QUOTE='`'
+            for PLATFORM in x86_64-linux aarch64-linux x86_64-darwin aarch64-darwin; do
+              BEFORE=$(wc -l < "requisites-${PLATFORM}-before.list")
+              TOTAL_BEFORE=$(($TOTAL_BEFORE + $BEFORE))
+              AFTER=$(wc -l < "requisites-${PLATFORM}-after.list")
+              TOTAL_AFTER=$(($TOTAL_AFTER + $AFTER))
+              DIFF="_no changes_"
+              [ "$BEFORE" = "$AFTER" ] || DIFF="**$([ "$AFTER" < "$BEFORE" ] || echo '+')$(($AFTER - $BEFORE))**"
+              CHANGED=$(git diff --no-index "requisites-${PLATFORM}-before.list" "requisites-${PLATFORM}-after.list" | grep -c '^+[^+]')
+              TOTAL_CHANGED=$(($TOTAL_CHANGED + $CHANGED))
+              PERCENT=100
+              [ "$CHANGED" = "$AFTER" ] || {
+                PERMILLE=$((1000 * $CHANGED / $AFTER))
+                PERCENT="$((PERMILLE / 10)).$((PERMILLE % 10))"
+              }
+              echo "| ${QUOTE}${PLATFORM}${QUOTE} | $BEFORE -> $AFTER => $DIFF | $CHANGED / $AFTER = $PERCENT% |"
+              awk '{ print $0 " ('"$PLATFORM"')" }' "requisites-${PLATFORM}-before.list" >> requisites-before.list
+              awk '{ print $0 " ('"$PLATFORM"')" }' "requisites-${PLATFORM}-after.list" >> requisites-after.list
+            done
+
+            DIFF="_no changes_"
+            [ "$TOTAL_BEFORE" = "$TOTAL_AFTER" ] || DIFF="**$([ "$TOTAL_AFTER" < "$TOTAL_BEFORE" ] || echo '+')$(($TOTAL_AFTER - $TOTAL_BEFORE))**"
+            PERCENT=100
+            [ "$TOTAL_CHANGED" = "$TOTAL_AFTER" ] || {
+              PERMILLE=$((1000 * $TOTAL_CHANGED / $TOTAL_AFTER))
+              PERCENT="$((PERMILLE / 10)).$((PERMILLE % 10))"
+            }
+            echo "| **Total** | $TOTAL_BEFORE -> $TOTAL_AFTER => $DIFF | $TOTAL_CHANGED / $TOTAL_AFTER = $PERCENT% |"
+          )
+          sort -k1.45 requisites-before.list > requisites-before.sort
+          sort -k1.45 requisites-after.list > requisites-after.sort
+          if git diff -U0 --no-color --no-index requisites-before.sort requisites-after.sort > requisites.diff; then
+            echo 'No changes detected.'
+          else
+          {
+            echo "$TABLE"
+            echo
+            echo '<details><summary>Changelog</summary>'
+            echo
+            echo '```diff'
+            tail -n +5 requisites.diff
+            echo '```'
+            echo
+            echo '</details>'
+          } | gh pr comment -R "$GITHUB_REPOSITORY" "$PR_NUMBER" -F -
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ steps.pr-data.outputs.NUMBER }}

.github/workflows/nix-changes.yml

@@ -0,0 +1,140 @@
+# This action uses the following secrets:
+#   CACHIX_AUTH_TOKEN: Write access to nodejs.cachix.org – without it, the cache is read-only.
+name: Nix files edited
+
+on:
+  push:
+    branches:
+      - main
+      - canary
+      - v[0-9]+.x-staging
+      - v[0-9]+.x
+    paths:
+      - '**.nix'
+      - .github/workflows/nix-changes.yml
+  pull_request:
+    paths:
+      - '**.nix'
+      - .github/workflows/nix-changes.yml
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  diff:
+    if: github.event.pull_request.draft == false
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: ubuntu-24.04
+            system: x86_64-linux
+          - runner: ubuntu-24.04-arm
+            system: aarch64-linux
+          - runner: macos-15-intel
+            system: x86_64-darwin
+          - runner: macos-latest
+            system: aarch64-darwin
+    name: '${{ matrix.system }}: dependencies diff'
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          fetch-depth: 2
+          persist-credentials: false
+          sparse-checkout: '*.nix'
+          sparse-checkout-cone-mode: false
+
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3  # v31.10.6
+        with:
+          extra_nix_config: sandbox = true
+
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71  # v17
+        with:
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          name: nodejs
+
+      - name: Compute requisites after change
+        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
+        run: |
+          nix-store --query --references "$(
+            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+              --arg devTools "
+                (import ./tools/nix/devTools.nix {})
+                ++ builtins.attrValues (
+                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
+                  // import ./tools/nix/openssl-matrix.nix {}
+                )")" \
+          | xargs nix-store --realise \
+          | xargs nix-store --query --requisites \
+          | sort -k1.45 \
+          > requisites-${{ matrix.system }}-after.list
+
+      - name: Compute requisites before change
+        shell: bash  # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference, we want the pipefail option.
+        run: |
+          git reset HEAD^ --hard
+          nix-store --query --references "$(
+            nix-instantiate -I "nixpkgs=./tools/nix/pkgs.nix" shell.nix \
+              --arg devTools "
+                (import ./tools/nix/devTools.nix {})
+                ++ builtins.attrValues (
+                  { inherit (import <nixpkgs> {}) nixfmt-tree sccache; }
+                  // import ./tools/nix/openssl-matrix.nix {}
+                )")" \
+          | xargs nix-store --realise \
+          | xargs nix-store --query --requisites \
+          | sort -k1.45 \
+          > requisites-${{ matrix.system }}-before.list
+
+      - name: Output diff
+        run: |
+          {
+            if diff_output="$(git diff -U0 --no-color --no-index requisites-${{ matrix.system }}-before.list requisites-${{ matrix.system }}-after.list)"; then
+              echo 'No changes detected.'
+            else
+              echo '```diff'
+              echo "$diff_output" | tail -n +5
+              echo '```'
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+
+      - name: Store PR number
+        if: ${{ github.event.pull_request && matrix.system == 'x86_64-linux' }}
+        run: echo "${{ github.event.pull_request.number }}" > pr_number.txt
+
+      - name: Upload requisites lists
+        if: ${{ github.event.pull_request }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        with:
+          name: requisites-${{ matrix.system }}
+          path: |
+            pr_number.*
+            requisites-${{ matrix.system }}-before.list
+            requisites-${{ matrix.system }}-after.list
+
+  lint-nix:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-slim
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: false
+          sparse-checkout: '*.nix'
+          sparse-checkout-cone-mode: false
+      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3  # v31.10.6
+      - name: Lint Nix files
+        run: |
+          nix-shell -I nixpkgs=./tools/nix/pkgs.nix -p 'nixfmt-tree' --run '
+            treefmt --quiet --ci
+          ' && EXIT_CODE="$?" || EXIT_CODE="$?"
+          if [ "$EXIT_CODE" != "0" ]
+          then
+            git --no-pager diff || true
+            exit "$EXIT_CODE"
+          fi