Add option to disable search

build(deps): bump actions/checkout from 3 to 6

.github/workflows/test.yml

@@ -16,7 +16,7 @@ jobs:
             runner: ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
       with:
         fetch-depth: 0
     - uses: cachix/install-nix-action@v31

.github/workflows/update-flakes.yml

@@ -11,12 +11,12 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v6
     - uses: cachix/install-nix-action@v31
     - name: Update flake inputs
       run: nix flake update
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v5
+      uses: peter-evans/create-pull-request@v8
       with:
         commit-message: "flake.lock: Update"
         title: "Update flake inputs"

flake.lock

@@ -3,11 +3,11 @@
     "nix": {
       "flake": false,
       "locked": {
-        "lastModified": 1760573252,
-        "narHash": "sha256-mcvNeNdJP5R7huOc8Neg0qZESx/0DMg8Fq6lsdx0x8U=",
+        "lastModified": 1767367029,
+        "narHash": "sha256-RsVlkBkxvPPePEo59AVolBFdayxny9FFv8X4aNq9qFc=",
         "owner": "NixOS",
         "repo": "nix",
-        "rev": "3c39583e5512729f9c5a44c3b03b6467a2acd963",
+        "rev": "394a8da9dd9c046de715e451a96b70e64ce4aa7a",
         "type": "github"
       },
       "original": {
@@ -36,16 +36,16 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1759652726,
-        "narHash": "sha256-2VjnimOYDRb3DZHyQ2WH2KCouFqYm9h0Rr007Al/WSA=",
+        "lastModified": 1767475907,
+        "narHash": "sha256-w10AFfl20h5MSBCsCegD4xtmcgDlQQeoFsOaIFwHOrE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "06b2985f0cc9eb4318bf607168f4b15af1e5e81d",
+        "rev": "7a0d60a03534a2d14b0805616aa1fd403fccfa55",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-25.05-small",
+        "ref": "nixos-25.11-small",
         "repo": "nixpkgs",
         "type": "github"
       }

flake.nix

@@ -1,7 +1,7 @@
 {
   description = "A Nix-based continuous build system";
 
-  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05-small";
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11-small";
 
   inputs.nix = {
     url = "github:NixOS/nix/2.32-maintenance";
@@ -59,7 +59,7 @@
 
         manual = forEachSystem (system: let
           pkgs = nixpkgs.legacyPackages.${system};
-          hydra = self.packages.${pkgs.hostPlatform.system}.hydra;
+          hydra = self.packages.${pkgs.stdenv.hostPlatform.system}.hydra;
         in
           pkgs.runCommand "hydra-manual-${hydra.version}" { }
             ''

hydra-api.yaml

@@ -574,6 +574,131 @@ paths:
               schema:
                 $ref: '#/components/schemas/JobsetEvalBuilds'
 
+  /jobset/{project-id}/{jobset-id}/latest-eval:
+    get:
+      summary: Redirects to the latest finished evaluation for a jobset
+      parameters:
+      - name: project-id
+        in: path
+        description: project identifier
+        required: true
+        schema:
+          type: string
+      - name: jobset-id
+        in: path
+        description: jobset identifier
+        required: true
+        schema:
+          type: string
+      responses:
+        '302':
+          description: the evaluation to redirect to
+          headers:
+            Location:
+              example: /eval/1?name={jobset-id}
+              schema:
+                type: string
+
+  /job/{project-id}/{jobset-id}/{job-id}/latest:
+    get:
+      summary: Redirects to the latest succesful build for a job
+      parameters:
+      - name: project-id
+        in: path
+        description: project identifier
+        required: true
+        schema:
+          type: string
+      - name: jobset-id
+        in: path
+        description: jobset identifier
+        required: true
+        schema:
+          type: string
+      - name: job-id
+        in: path
+        description: job identifier
+        required: true
+        schema:
+          type: string
+      responses:
+        '302':
+          description: the build to redirect to
+          headers:
+            Location:
+              example: /build/1
+              schema:
+                type: string
+
+  /job/{project-id}/{jobset-id}/{job-id}/latest-for/{system}:
+    get:
+      summary: Redirects to the latest succesful build for a job
+      parameters:
+      - name: project-id
+        in: path
+        description: project identifier
+        required: true
+        schema:
+          type: string
+      - name: jobset-id
+        in: path
+        description: jobset identifier
+        required: true
+        schema:
+          type: string
+      - name: job-id
+        in: path
+        description: job identifier
+        required: true
+        schema:
+          type: string
+      - name: system
+        in: path
+        description: system
+        required: true
+        schema:
+          type: string
+        example: x86_64-linux
+      responses:
+        '302':
+          description: the build to redirect to
+          headers:
+            Location:
+              example: /build/1
+              schema:
+                type: string
+
+  /job/{project-id}/{jobset-id}/{job-id}/latest-finished:
+    get:
+      summary: Redirects to the latest succesful build for a job from a finished evaluation
+      parameters:
+      - name: project-id
+        in: path
+        description: project identifier
+        required: true
+        schema:
+          type: string
+      - name: jobset-id
+        in: path
+        description: jobset identifier
+        required: true
+        schema:
+          type: string
+      - name: job-id
+        in: path
+        description: job identifier
+        required: true
+        schema:
+          type: string
+      responses:
+        '302':
+          description: the build to redirect to
+          headers:
+            Location:
+              example: /build/1
+              schema:
+                type: string
+
 components:
   schemas:
 

nixos-modules/default.nix

@@ -4,7 +4,7 @@
   hydra = { pkgs, lib,... }: {
     _file = ./default.nix;
     imports = [ ./hydra.nix ];
-    services.hydra-dev.package = lib.mkDefault self.packages.${pkgs.hostPlatform.system}.hydra;
+    services.hydra-dev.package = lib.mkDefault self.packages.${pkgs.stdenv.hostPlatform.system}.hydra;
   };
 
   hydraTest = { pkgs, ... }: {

package.nix

@@ -31,7 +31,7 @@
 , perl
 , pixz
 , boost
-, postgresql_13
+, postgresql_17
 , nlohmann_json
 , prometheus-cpp
 
@@ -192,7 +192,7 @@ stdenv.mkDerivation (finalAttrs: {
     subversion
     breezy
     openldap
-    postgresql_13
+    postgresql_17
     pixz
     nix-eval-jobs
   ];

src/hydra-queue-runner/build-remote.cc

@@ -104,9 +104,9 @@ static void copyClosureTo(
     std::unique_lock<std::timed_mutex> sendLock(conn.machine->state->sendLock,
         std::chrono::seconds(600));
 
-    conn.importPaths(destStore, [&](Sink & sink) {
-        exportPaths(destStore, missing, sink);
-    });
+    conn.to << ServeProto::Command::ImportPaths;
+    exportPaths(destStore, missing, conn.to);
+    conn.to.flush();
 
     if (readInt(conn.from) != 1)
         throw Error("remote machine failed to import closure");
@@ -301,10 +301,11 @@ static void copyPathFromRemote(
               lambda function only gets executed if someone tries to read
               from source2, we will send the command from here rather
               than outside the lambda. */
-          conn.narFromPath(localStore, info.path, [&](Source & source) {
-              TeeSource tee(source, sink);
-              extractNarData(tee, localStore.printStorePath(info.path), narMembers);
-          });
+          conn.to << ServeProto::Command::DumpStorePath << localStore.printStorePath(info.path);
+          conn.to.flush();
+
+          TeeSource tee(conn.from, sink);
+          extractNarData(tee, localStore.printStorePath(info.path), narMembers);
       });
 
       destStore.addToStore(info, *source2, NoRepair, NoCheckSigs);

src/lib/Hydra/Controller/API.pm

@@ -220,11 +220,11 @@ sub scmdiff : Path('/api/scmdiff') Args(0) {
         my $clonePath = getSCMCacheDir . "/git/" . sha256_hex($uri);
         die if ! -d $clonePath;
         my ($stdout1, $stderr1);
-        run3(['git', '-C', $clonePath, 'log', "$rev1..$rev2"], \undef, \$stdout1, \$stderr1);
+        run3(['git', '--git-dir', '.git', '-C', $clonePath, 'log', "$rev1..$rev2"], \undef, \$stdout1, \$stderr1);
         $diff .= $stdout1 if $? == 0;
 
         my ($stdout2, $stderr2);
-        run3(['git', '-C', $clonePath, 'diff', "$rev1..$rev2"], \undef, \$stdout2, \$stderr2);
+        run3(['git', '--git-dir', '.git', '-C', $clonePath, 'diff', "$rev1..$rev2"], \undef, \$stdout2, \$stderr2);
         $diff .= $stdout2 if $? == 0;
     }
 

src/lib/Hydra/Controller/Root.pm

@@ -495,6 +495,9 @@ sub steps :Local Args(0) {
 
 sub search :Local Args(0) {
     my ($self, $c) = @_;
+
+    badRequest($c, "Search is disabled in this Hydra instance") if $c->config->{disable_search};
+
     $c->stash->{template} = 'search.tt';
 
     my $query = trim $c->request->params->{"query"};

src/lib/Hydra/Plugin/GiteaStatus.pm

@@ -63,9 +63,9 @@ sub common {
             my $accessToken = $self->{config}->{gitea_authorization}->{$repoOwner};
 
             my $rev = $i->revision;
-            my $domain = URI->new($i->uri)->host;
             my $host;
             unless (defined $gitea_url) {
+                my $domain = URI->new($i->uri)->host;
                 $host = "https://$domain";
             } else {
                 $host = $gitea_url->value;

src/lib/Hydra/Plugin/GithubRefs.pm

@@ -18,9 +18,8 @@ tags) from GitHub following a certain naming scheme
 
 =head1 DESCRIPTION
 
-This plugin reads the list of branches or tags using GitHub's REST API. The name
-of the reference must follow a particular prefix. This list is stored in the
-nix-store and used as an input to declarative jobsets.
+This plugin reads the list of branches or tags using GitHub's REST API. This
+list is stored in the nix-store and used as an input to declarative jobsets.
 
 =head1 CONFIGURATION
 
@@ -34,7 +33,7 @@ The declarative project C<spec.json> file must contains an input such as
 
    "pulls": {
      "type": "github_refs",
-     "value": "[owner] [repo] heads|tags - [prefix]",
+     "value": "[owner] [repo] [type] - [prefix]",
      "emailresponsible": false
    }
 
@@ -42,12 +41,11 @@ In the above snippet, C<[owner]> is the repository owner and C<[repo]> is the
 repository name. Also note a literal C<->, which is placed there for the future
 use.
 
-C<heads|tags> denotes that one of these two is allowed, that is, the third
-position should hold either the C<heads> or the C<tags> keyword. In case of the former, the plugin
-will fetch all branches, while in case of the latter, it will fetch the tags.
+C<[type]> is the type of ref to list. Typical values are "heads", "tags", and
+"pull". "." will include all types.
 
 C<prefix> denotes the prefix the reference name must start with, in order to be
-included.
+included. "." will include all references.
 
 For example, C<"value": "nixos hydra heads - release/"> refers to
 L<https://github.com/nixos/hydra> repository, and will fetch all branches that
@@ -102,8 +100,6 @@ sub fetchInput {
     return undef if $input_type ne "github_refs";
 
     my ($owner, $repo, $type, $fut, $prefix) = split ' ', $value;
-    die "type field is neither 'heads' nor 'tags', but '$type'"
-        unless $type eq 'heads' or $type eq 'tags';
 
     my $auth = $self->{config}->{github_authorization}->{$owner};
     my $githubEndpoint = $self->{config}->{github_endpoint} // "https://api.github.com";

src/lib/Hydra/Plugin/GitlabPulls.pm

@@ -84,7 +84,7 @@ sub fetchInput {
     my $tempdir = File::Temp->newdir("gitlab-pulls" . "XXXXX", TMPDIR => 1);
     my $filename = "$tempdir/gitlab-pulls-sorted.json";
     open(my $fh, ">", $filename) or die "Cannot open $filename for writing: $!";
-    print $fh JSON::MaybeXS->new(canonical => 1, pretty => 1)->encode(\%pulls);
+    print $fh JSON::MaybeXS->new(canonical => 1, pretty => 1, utf8 => 1)->encode(\%pulls);
     close $fh;
     my $storePath = addToStore($filename);
     my $timestamp = time;

src/lib/Hydra/Plugin/PathInput.pm

@@ -12,19 +12,31 @@ sub supportedInputTypes {
     $inputTypes->{'path'} = 'Local path or URL';
 }
 
+sub _parseValue {
+    # The input is a local path or URL, optionally followed by a
+    # time period specified in seconds.
+    my ($config, $value) = @_;
+    my @parts = split ' ', $value;
+    (my $uri, my $freq) = @parts;
+    # By default don't check a path more often than every 30 seconds,
+    # but the second path argument can change that value or the global
+    # path_input_cache_validity_seconds configuration, in that order.
+    my $timeout = defined $freq ? $freq : ($config->{path_input_cache_validity_seconds} // 30);
+
+    return ($uri, $timeout);
+}
+
 sub fetchInput {
     my ($self, $type, $name, $value) = @_;
 
     return undef if $type ne "path";
 
-    my $uri = $value;
+    my ($uri, $timeout) = _parseValue($self->{config}, $value);
 
     my $timestamp = time;
     my $sha256;
     my $storePath;
 
-    my $timeout = $self->{config}->{path_input_cache_validity_seconds} // 30;
-
     # Some simple caching: don't check a path more than once every N seconds.
     (my $cachedInput) = $self->{db}->resultset('CachedPathInputs')->search(
         {srcpath => $uri, lastseen => {">", $timestamp - $timeout}},

src/lib/Hydra/Schema/Result/Builds.pm

@@ -563,7 +563,7 @@ makeQueries('', "");
 makeQueries('ForProject', "and jobset_id in (select id from jobsets j where j.project = ?)");
 makeQueries('ForJobset', "and jobset_id = ?");
 makeQueries('ForJob', "and jobset_id = ? and job = ?");
-makeQueries('ForJobName', "and jobset_id = (select id from jobsets j where j.name = ?) and job = ?");
+makeQueries('ForJobName', "and jobset_id = (select id from jobsets j where j.project = ? and j.name = ?) and job = ?");
 
 sub as_json {
   my ($self) = @_;

src/root/build.tt

@@ -568,7 +568,7 @@ END;
           running the following command:</p>
 
 <div class="card bg-light"><div class="card-body p-2"><code>
-<span class="shell-prompt"># </span>nix build [% HTML.escape(eval.flake) %]#hydraJobs.[% HTML.escape(job) %]
+<span class="shell-prompt"># </span>nix build '[% HTML.escape(eval.flake) %]#hydraJobs.[% HTML.escape(job) %]'
 </code></div></div>
 
         [% ELSE %]

src/root/common.tt

@@ -347,13 +347,23 @@ BLOCK renderDiffUri;
     url = res.0;
     branch = res.1;
     IF bi1.type == "hg" || bi1.type == "git" %]
-      <a target="_blank" [% HTML.attributes(href => c.uri_for('/api/scmdiff', {
-        uri = url,
-        rev1 = bi1.revision,
-        rev2 = bi2.revision,
-        type = bi1.type,
-        branch = branch
-      })) %]>[% HTML.escape(contents) %]</a>
+      [% IF url.substr(0, 19) == "https://github.com/" %]
+        <a target="_blank" [% HTML.attributes(href =>
+          url
+          _ "/compare/"
+          _ bi1.revision
+          _ "..."
+          _ bi2.revision,
+        ) %]>[% HTML.escape(contents) %]</a>
+      [% ELSE %]
+        <a target="_blank" [% HTML.attributes(href => c.uri_for('/api/scmdiff', {
+          uri = url,
+          rev1 = bi1.revision,
+          rev2 = bi2.revision,
+          type = bi1.type,
+          branch = branch
+        })) %]>[% HTML.escape(contents) %]</a>
+      [% END %]
     [% ELSE;
       contents;
     END;

src/root/job.tt

@@ -9,8 +9,8 @@
 [% INCLUDE includeFlot %]
 
 [% IF !jobExists(jobset, job) %]
-<div class="alert alert-warning">This job is not a member of the <a
-[% HTML.attributes(href => c.uri_for('/jobset' project.name jobset.name
+<div class="alert alert-warning">This job is not a member of the
+<a [% HTML.attributes(href => c.uri_for('/jobset' project.name jobset.name
 'evals')) %]>latest evaluation</a> of its jobset. This means it was
 removed or had an evaluation error.</div>
 [% END %]

src/root/topbar.tt

@@ -121,9 +121,11 @@
 [% END %]
 
 [% IF showPrivate %]
-  <form class="form-inline" action="[% c.uri_for('/search') %]">
-    <input name="query" type="text" class="form-control" placeholder="Search" [% HTML.attributes(value => c.req.params.query) %]/>
-  </form>
+  [% UNLESS c.config.disable_search %]
+    <form class="form-inline" action="[% c.uri_for('/search') %]">
+      <input name="query" type="text" class="form-control" placeholder="Search" [% HTML.attributes(value => c.req.params.query) %]/>
+    </form>
+  [% END %]
 [% END %]
 
 <ul class="navbar-nav">

src/script/hydra-eval-jobset

@@ -160,7 +160,7 @@ sub fetchInputSystemBuild {
     $jobsetName ||= $jobset->name;
 
     my @latestBuilds = $db->resultset('LatestSucceededForJobName')
-        ->search({}, {bind => [$jobsetName, $jobName]});
+        ->search({}, {bind => [$projectName, $jobsetName, $jobName]});
 
     my @validBuilds = ();
     foreach my $build (@latestBuilds) {