···1818- **head commit**: The HEAD commit in the pull request's branch. Same as `github.event.pull_request.head.sha`.
1919- **merge commit**: The temporary "test merge commit" that GitHub Actions creates and updates for the pull request. Same as `refs/pull/${{ github.event.pull_request.number }}/merge`.
2020- **target commit**: The base branch's parent of the "test merge commit" to compare against.
2121+2222+## Concurrency Groups
2323+2424+We use [GitHub's Concurrency Groups](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs) to cancel older jobs on pushes to Pull Requests.
2525+When two workflows are in the same group, a newer workflow cancels an older workflow.
2626+Thus, it is important how to construct the group keys:
2727+2828+- Because we want to run jobs for different events at same time, we add `github.event_name` to the key. This is the case for the `pull_request` which runs on changes to the workflow files to test the new files and the same workflow from the base branch run via `pull_request_event`.
2929+3030+- We don't want workflows of different Pull Requests to cancel each other, so we include `github.event.pull_request.number`. The [GitHub docs](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/control-the-concurrency-of-workflows-and-jobs#example-using-a-fallback-value) show using `github.head_ref` for this purpose, but this doesn't work well with forks: Different users could have the same head branch name in their forks and run CI for their PRs at the same time.
3131+3232+- Sometimes, there is no `pull_request.number`. That's the case for `push` or `workflow_run` events. To ensure non-PR runs are never cancelled, we add a fallback of `github.run_id`. This is a unique value for each workflow run.
3333+3434+- Of course, we run multiple workflows at the same time, so we add `github.workflow` to the key. Otherwise workflows would cancel each other.
3535+3636+- There is a special case for reusable workflows called via `workflow_call` - they will have `github.workflow` set to their parent workflow's name. Thus, they would cancel each other. That's why we additionally hardcode the name of the workflow as well.
3737+3838+This results in a key with the following semantics:
3939+4040+```
4141+<running-workflow>-<triggering-workflow>-<triggered-event>-<pull-request/fallback>
4242+```
···348348349349 profile incusd ${lib.getExe' config.virtualisation.incus.package "incusd"} flags=(unconfined) {
350350 userns,
351351- </var/lib/incus/security/apparmor/cache>
352352- </var/lib/incus/security/apparmor/profiles>
351351+352352+ include "/var/lib/incus/security/apparmor/cache"
353353354354 # Site-specific additions and overrides. See local/README for details.
355355 include if exists <local/incusd>
356356 }
357357+358358+ include "/var/lib/incus/security/apparmor/profiles"
357359 '';
358360 };
359361 includes."abstractions/base" =
+8
nixos/tests/incus/incus-tests.nix
···221221 machine.succeed("incus storage show default")
222222223223 ''
224224+ + lib.optionalString appArmor ''
225225+ with subtest("Verify AppArmor service is started without issue"):
226226+ # restart AppArmor service since the Incus AppArmor folders are
227227+ # created after AA service is started
228228+ machine.systemctl("restart apparmor.service")
229229+ machine.succeed("systemctl --no-pager -l status apparmor.service")
230230+ machine.wait_for_unit("apparmor.service")
231231+ ''
224232 + lib.optionalString instanceContainer (
225233 lib.foldl (
226234 acc: variant:
···3535 suspend fun downloadMavenTelemetryDependencies(communityRoot: BuildDependenciesCommunityRoot): Path =
3636--- a/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.kt
3737+++ b/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/BuildDependenciesDownloader.kt
3838-@@ -70,7 +70,7 @@
3939- version: String,
4040- classifier: String?,
4141- packaging: String): URI {
3838+@@ -68,7 +68,7 @@
3939+ classifier: String?,
4040+ packaging: String,
4141+ ): URI {
4242- val base = mavenRepository.trim('/')
4343+ val base = mavenRepository.trimEnd('/')
4444 val groupStr = groupId.replace('.', '/')
···4646 return URI.create("${base}/${groupStr}/${artifactId}/${version}/${artifactId}-${version}${classifierStr}.${packaging}")
4747--- a/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/JdkDownloader.kt
4848+++ b/platform/build-scripts/downloader/src/org/jetbrains/intellij/build/dependencies/JdkDownloader.kt
4949-@@ -55,11 +55,7 @@
5050- variation: String? = null,
4949+@@ -59,11 +59,7 @@
5150 infoLog: (String) -> Unit,
5251 ): Path {
5353-- val jdkUrl = getUrl(communityRoot = communityRoot, os = os, arch = arch, jdkBuildNumber = jdkBuildNumber, variation = variation)
5252+ val effectiveVariation = if (isMusl) null else variation
5353+- val jdkUrl = getUrl(communityRoot = communityRoot, os = os, arch = arch, isMusl = isMusl, jdkBuildNumber = jdkBuildNumber, variation = effectiveVariation)
5454- val jdkArchive = downloadFileToCacheLocation(url = jdkUrl.toString(), communityRoot = communityRoot)
5555- val jdkExtracted = BuildDependenciesDownloader.extractFileToCacheLocation(communityRoot = communityRoot,
5656- archiveFile = jdkArchive,
+3-6
pkgs/applications/editors/jetbrains/readme.md
···2424## How to update stuff:
2525 - Run ./bin/update_bin.py, this will update binary IDEs and plugins, and automatically commit them
2626 - Source builds need a bit more effort, as they **aren't automated at the moment**:
2727- - Find the build of the stable release you want to target (usually different for pycharm and idea, should have three components)
2828- - Build number is available on JetBrains website:
2929- - IDEA: https://www.jetbrains.com/idea/download/other.html
3030- - PyCharm: https://www.jetbrains.com/pycharm/download/other.html
3131- - Update the `version` & `buildNumber` fields in source/ides.json
3232- - Empty the `ideaHash`, `androidHash`, `jpsHash` and `restarterHash` (only `ideaHash` and `restarterHash` changes on a regular basis) fields and try to build to get the new hashes
2727+ - Run ./source/update.py ./source/ides.json ./bin/versions.json. This will update the source version to the version of their corresponding binary packages.
3328 - Run these commands respectively:
3429 - `nix build .#jetbrains.idea-community-src.src.src && ./source/build_maven.py source/idea_maven_artefacts.json result/` for IDEA
3530 - `nix build .#jetbrains.pycharm-community-src.src.src && ./source/build_maven.py source/pycharm_maven_artefacts.json result/` for PyCharm
3631 - Update `brokenPlugins` timestamp and hash (from https://web.archive.org/web/*/https://plugins.jetbrains.com/files/brokenPlugins.json)
3732 - Do a test build
3333+ - Notice that sometimes a newer Kotlin version is required to build from source, if build fails, first check the recommended Kotlin version in `.idea/kotlinc.xml` in the IDEA source root
3434+ - Feel free to update the Kotlin version to a compatible one
3835 - If it succeeds, make a commit
3936 - Run ./plugins/update_plugins.py, this will update plugins and automatically commit them
4037 - make a PR/merge
···5353 useVSCodeRipgrep ? false,
5454 ripgrep,
5555 hasVsceSign ? false,
5656+ patchVSCodePath ? true,
5657}:
57585859stdenv.mkDerivation (
···262263 mkdir -p "$out/share/pixmaps"
263264 cp "$out/lib/${libraryName}/resources/app/resources/linux/code.png" "$out/share/pixmaps/${iconName}.png"
264265266266+ ''
267267+ + (lib.optionalString patchVSCodePath ''
265268 # Override the previously determined VSCODE_PATH with the one we know to be correct
266269 sed -i "/ELECTRON=/iVSCODE_PATH='$out/lib/${libraryName}'" "$out/bin/${executableName}"
267270 grep -q "VSCODE_PATH='$out/lib/${libraryName}'" "$out/bin/${executableName}" # check if sed succeeded
271271+ '')
272272+ + ''
268273269274 # Remove native encryption code, as it derives the key from the executable path which does not work for us.
270275 # The credentials should be stored in a secure keychain already, so the benefit of this is questionable
+8-8
pkgs/applications/editors/vscode/vscode.nix
···36363737 sha256 =
3838 {
3939- x86_64-linux = "0kd4nb8b17j7ii5lhq4cih62pghb4j9gylgz9yqippxivzzkq6dd";
4040- x86_64-darwin = "1y96sp3lkm32fnhjak2js11m9qf8155gglp9g83ynv9d8sdy14ya";
4141- aarch64-linux = "162wac7s0l4pq6r6sh32lh69j90rna430z57ksb6g9w8spqzqnv4";
4242- aarch64-darwin = "1rqq131f1hs2z14ddh7sp6flwsgb58r8nw1ydbcclcmzi3vbdgr9";
4343- armv7l-linux = "06czqpzwlrx98bv2vmawjxxmzw9z6bcfxikp7nxhi8qp8nsjfvgy";
3939+ x86_64-linux = "1zc64d1n84kzwmwh8m3j897di5955qlm7glnpjvl8g7q70b4rdax";
4040+ x86_64-darwin = "04ycsad1khxjmiph9fk9449w942m8gmq65amwkf8jxqzn0rybh76";
4141+ aarch64-linux = "0lhqmp59vccs35fksgvdgvw82b0mr9b2wlyafxlwb8pk2q0l0xga";
4242+ aarch64-darwin = "1axzsk6xqlzs3j9irjxp5f4fbdxyi4fffhdk89h45q3zkw8m9m4i";
4343+ armv7l-linux = "1rv3a8xj7iv1d8mfikpj58n398ww5cndbyvgy5328nj7dh6azrsw";
4444 }
4545 .${system} or throwSystem;
4646in
4747callPackage ./generic.nix rec {
4848 # Please backport all compatible updates to the stable release.
4949 # This is important for the extension ecosystem.
5050- version = "1.100.3";
5050+ version = "1.101.0";
5151 pname = "vscode" + lib.optionalString isInsiders "-insiders";
52525353 # This is used for VS Code - Remote SSH test
5454- rev = "258e40fedc6cb8edf399a463ce3a9d32e7e1f6f3";
5454+ rev = "dfaf44141ea9deb3b4096f7cd6d24e00c147a4b1";
55555656 executableName = "code" + lib.optionalString isInsiders "-insiders";
5757 longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
···7575 src = fetchurl {
7676 name = "vscode-server-${rev}.tar.gz";
7777 url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
7878- sha256 = "0bd04p4i5hkkccglw5x3vxf4vbq9hj83gdwfnaps5yskcqizhw77";
7878+ sha256 = "0rjd4f54k58k97gxvnivwj52aha5s8prws1izvmg43vphhfvk014";
7979 };
8080 stdenv = stdenvNoCC;
8181 };
···3838 python = python3.override {
3939 self = python;
4040 packageOverrides = final: prev: {
4141- django = prev.django_5;
4141+ django = prev.django_5_1;
42424343 # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
4444 ocrmypdf = prev.ocrmypdf.override { tesseract = tesseract5; };
···255255 # we have to update both the python hash and the cargo one,
256256 # so use nix-update-script
257257 extraArgs = [
258258- "--versionRegex"
258258+ "--version-regex"
259259 "([0-9].+)"
260260 ];
261261 };