Required status checks for merge

[wolfgangwalther]

(only relevant for committers)

We have recently enabled required status checks for the Nixpkgs repo.

For now, every committer is able to bypass these checks and merge anyway (see below). Initially, this will be needed to merge a PR where CI last ran before ~ June, 18th.

Please report any other cases where you needed to bypass the rules for merge in NixOS/org#130!

This will help us make sure we're not blocking any valid use-cases when we eventually disallow bypassing these checks entirely.

Note: Only the GitHub Actions CI is required for merge. You still need to check ofborg results and/or confirm everything builds manually.

---

Additionally, here's a quick rundown of how to work with the required status checks in more detail:

1. There is a new item in the PR's check list now, it looks like this:

   

   As long as this check is either "expected" or "failed", merging the PR is blocked.

2. Once all other jobs passed, this check will become "skipped":

   

   Skipped means success - the PR is now merge-able.

3. When the merge is blocked, it looks like this:

   

   If you need to merge the PR despite failing CI, you'll need to check the box.

4. Older PRs, which last ran CI before the merge of workflows/{pr,push}: init #415006, will keep their "expected" state for that check. In this case, you have multiple options:

   • Re-run CI by closing / opening the PR. This will also run the "no PR failures" check.
   • Re-run CI by (force) pushing the branch. Same applies.
   • Merge despite the missing check by checking the box.

5. If you need to merge a PR with failing CI for any other reasons than the PR being old, please report this in nixpkgs branch protection rules: require status checks to pass org#130.

6. Important note for those merging PRs from the command line via git: As long as you can bypass the required checks, there is no protection for git merges. Merging from the CLI via git push will always bypass the status checks. However, merging via gh pr merge supports those checks, according to the documentation.

[domenkozar]

I'd kindly ask not to remove people from commit access until this rule is clearly communicated and gradually enforced.

See how we did similar transition in 2021 that took over two years without getting personal :)