Delete merged branches in nixpkgs automatically

[wolfgangwalther]

A lot of times, when merging backport PRs, the branches are not deleted. I and some others keep cleaning them up regularly, but it's manual work that can be avoided.

Please consider setting this in nixpkgs -> Settings -> General:

There is also a related nixpkgs issue: NixOS/nixpkgs#128105, in which a concern was raised, that this could be problematic for PRs from branches like staging-next or haskell-updates - we surely don't want to delete those branches.

However, this is not a concern - with the right branch protection rules, those branches will not be deleted with this setting turned on. I confirmed that in my own fork. I'm pretty sure that the relevant branch protection is already set up, but you probably want to double check:

[pbsds]

The "bypass permissions" scares me a bit, if an org owner decides to merge a staging-next merge, will staging-next get deleted?

[wolfgangwalther]

Nice catch, @pbsds, you are right. The bypass permissions thing plays a role:

• if you can't bypass the permissions, obviously the branch is not deleted (that's what I tested before)
• if you can bypass the permissions with the "always" setting, then the branch is deleted
• but if you can bypass the permissions only with the "allow for pull requests only" setting, then the branch is not deleted

Also note, that when the branch is deleted, that's not that much of a problem in itself. GitHub allows to easily restore the branch with one click in the exact same place. So nothing is lost. Of course, we don't want to go that way for regular operations, but it reduces the risk involved to "just an inconvenience".

So, it would be good if org owners could check how the branch protection rules are currently set up regarding the bypass list. Are people set up to be able to work directly on branches? Or just via Pull Requests?

[mweinelt]

Also note, that when the branch is deleted, that's not that much of a problem in itself.

Pull requests targeting that branch will be automatically closed IIRC.

This also means that repo admins should never merge ideally python-updates, haskell-updates, staging-next PRs.

[wolfgangwalther]

Pull requests targeting that branch will be automatically closed IIRC.

Uh, yeah, that would be bad.

Maybe I should look into writing a simple GHA workflow which will try to delete the branch with regular privileges (could be via an app, which is explicitly not allowed to bypass). Then that should be safe.

[pbsds]

https://github.com/actions/github-script might be sufficient, have it match against the branch name with a regex to limit it to backport PRs and limit it to PRs opened by the backport bot account

[wolfgangwalther]

I'll look into doing that via automation instead, thanks for the discussion!

[wolfgangwalther]

Actually... I think it's possible to do this without automation and as initially proposed. I was a bit skeptical, because of the branch protection rules. We surely need some people to bypass some branch protection rules when we start implementing "required status checks", but:

• We can create a separate branch protection rule covering all development branches (see nixpkgs branch protection rules: prevent creation of new branches! #118 (comment)) to just prevent deletion and force pushes.
• In this rule we never add any bypassers.
• All the other branch protections for those branches can be in a separate rule, for example to create those branches (release team) or to bypass required checks (CI team).

So it is easily possible to set this up in a completely safe way.

I'd say the most tricky question is, that somebody has to configure those rules by hand and we can't discuss them in a PR as code. Thus something like #40 would be really, really helpful.

[wolfgangwalther]

We can create a separate branch protection rule covering all development branches to just prevent deletion and force pushes.

This is now the case: https://github.com/NixOS/org/blob/main/rulesets/nixpkgs/no-delete.json

This rule prevents deletion of those branches from everyone, including org owners and apps.

Thus, we can now enable the "automatically delete head branches" setting without danger.

[infinisil]

Now enabled! Let me know if there's any issues with it :)