Merge branch 'main' into weekly-plugin-bumps

.github/workflows/backport.yml

@@ -0,0 +1,33 @@
+name: Backport PR on Label
+
+on:
+  pull_request_target:
+    types:
+      - labeled
+
+# Permissions needed for the korthout/backport-action to create branches and PRs
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  backport:
+    name: Create Backport PR
+    runs-on: ubuntu-latest
+    if: |
+      github.event.pull_request.merged == true && startsWith(github.event.label.name, 'backport-')
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Backport Action
+        uses: korthout/backport-action@v3
+        with:
+          # Regex pattern for labels that should trigger a backport AND extracts the target branch
+          # from the name (e.g. v0.x or v0.x.y; we use zerover). This action will ONLY proceed if
+          # the label that triggered the workflow fully matches this pattern.
+          # Example matching labels: "backport-v0.1", "backport-v0.10.1"
+          # Example non-matching labels: "backport-foo", "backport-v1.0"
+          label_pattern: '^backport-(v0\.\d+(\.\d+)?)$'

.github/workflows/cachix.yml

@@ -21,16 +21,7 @@ jobs:
           - nix
           - maximal
     steps:
-      - uses: easimon/maximize-build-space@v10
-        name: Maximize build space
-        with:
-          overprovision-lvm: true
-          remove-android: true
-          remove-dotnet: true
-          remove-haskell: true
-          remove-codeql: true
-
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         name: Checkout
 
       - name: Install Nix

.github/workflows/check.yml

@@ -17,7 +17,7 @@ jobs:
     if: "!contains(github.event.pull_request.title, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -31,7 +31,7 @@ jobs:
     if: "!contains(github.event.pull_request.title, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Install Nix
         uses: DeterminateSystems/nix-installer-action@main
@@ -39,13 +39,24 @@ jobs:
       - name: Check formatting via Alejandra
         run: nix run nixpkgs#alejandra -- --check . --exclude npins
 
+      - name: Check formatting via Deno
+        run: nix run nixpkgs#deno -- fmt --check --ext md **/*.md
+
+      - if: ${{ failure() }}
+        shell: bash
+        run: |
+          echo "::error:: Current codebase contains formatting errors that were caught by the CI!"
+          echo "Please ensure that all Nix code is formatted with Alejandra, and Markdown with `deno fmt"
+          echo "[skip ci] label may be added to the PR title if this is a one-time issue and is safe to ignore"
+          exit 1
+
   check-typos:
     name: "Check source tree for typos"
     runs-on: ubuntu-latest
     if: "!contains(github.event.pull_request.title, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Check for typos
         uses: crate-ci/typos@master
@@ -76,7 +87,7 @@ jobs:
         uses: DeterminateSystems/nix-installer-action@main
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set default git branch (to reduce log spam)
         run: git config --global init.defaultBranch main
@@ -90,7 +101,7 @@ jobs:
         run: echo "date=$(date +'%Y-%m-%d-%H%M%S')" >> ${GITHUB_OUTPUT}
 
       - name: Upload doc artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: "${{ matrix.package }}"
           path: result/share/doc/nvf
@@ -104,7 +115,7 @@ jobs:
         uses: DeterminateSystems/nix-installer-action@main
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Build linkcheck package
         run: nix build .#docs-linkcheck -Lv
@@ -115,7 +126,7 @@ jobs:
     if: "!contains(github.event.pull_request.title, '[skip ci]')"
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 2 # slows down checkout, but we need to compare against the previous commit on push events
 
@@ -142,7 +153,8 @@ jobs:
       - name: Checking Editorconfig conformance
         shell: bash
         run: |
-          < "$HOME/changed_files" nix-shell -p editorconfig-checker --run 'xargs -r editorconfig-checker -disable-indent-size'
+          < "$HOME/changed_files" nix-shell -p editorconfig-checker \
+                                    --run 'xargs -r editorconfig-checker -disable-indent-size --exclude flake.lock'
 
       - if: ${{ failure() }}
         shell: bash

.github/workflows/cleanup.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: "Delete old branches"
         uses: beatlabs/delete-old-branches-action@v0.0.11

.github/workflows/docs-preview.yml

@@ -28,7 +28,7 @@ jobs:
         uses: DeterminateSystems/nix-installer-action@main
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set default git branch (to reduce log spam)
         run: git config --global init.defaultBranch main
@@ -90,7 +90,7 @@ jobs:
           echo "Preview can be found at ${URL}" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Find Comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@v4
         id: fc
         with:
           comment-author: "github-actions[bot]"
@@ -98,7 +98,7 @@ jobs:
           body-includes: "Live preview deployed"
 
       - name: Post live preview comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5
         env:
           COMMENT_ID: ${{ steps.fc.outputs.comment-id }}
           URL: ${{ steps.prelude.outputs.URL }}
@@ -127,7 +127,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Delete preview for closed/merged PR
         run: |
@@ -164,7 +164,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Double check preview directory deletion
         run: |
@@ -177,7 +177,7 @@ jobs:
           fi
 
       - name: Post cleanup verification
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@v5
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body: |

.github/workflows/labeler.yml

@@ -0,0 +1,21 @@
+name: "Label PR"
+
+on:
+  pull_request_target:
+    types: [edited, opened, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  labels:
+    name: "Label PR"
+    runs-on: ubuntu-latest
+    if: "!contains(github.event.pull_request.title, '[skip ci]')"
+    steps:
+      - uses: actions/labeler@v6
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          configuration-path: .github/labels.yml
+          sync-labels: true

.github/workflows/manual.yml

@@ -28,7 +28,7 @@ jobs:
     outputs:
       should_run: ${{ steps.should_run.outputs.should_run }}
     steps:
-      - uses: actions/checkout@v4.1.7
+      - uses: actions/checkout@v5
       - name: print latest_commit
         run: echo ${{ github.sha }}
 
@@ -43,7 +43,7 @@ jobs:
     if: ${{ needs.check_date.outputs.should_run != 'false' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.7
+      - uses: actions/checkout@v5
       - uses: DeterminateSystems/nix-installer-action@main
       - run: |
           nix build .#docs -Lv