Because ${FOO} is already expanded in the Makefile, which leads to
syntax errors in the CI when secrets are replaced by ***, we need to
use $${FOO} so expansion only takes place in the shell.

There is a new make file,

    doc/Makefile

that defines these goals:

  - `check-requirements`:
    Check `requirements.txt` for security problems (CVEs) using `skjold`.
    This goal is intended for the "Users guide" CI.
    SKJOLD_GITHUB_API_TOKEN might have to be set if GITHUB_TOKEN is
    not in the environment, in order to access the GitHub GraphQL API.

  - `build-and-check-requirements`:
    Rebuild `requirements.txt` from `requirements.in` using `pip-compile`,
    and check with `check-requirements`.
    This goal is intended for manual invocation.

    It is invoked from the top Makefile via goal
    `users-guide-requirements`.

Alternatively, these goals could be coupled with the doc build
`make users-guide`.
However, since these goals require a couple of seconds to run, I think
it is annoying to call them on every build of the documentation.

on @hasufell 's advice.

andreas.abel authored 3 years ago and Mikolaj Konarski committed 3 years ago

Simplified from agda/agda/.github/workflows/user-manual.yml

* use queues
* rebase+merge strategy
* merge+squash strategy

Signed-off-by: Francesco Gazzetta <fgaz@fgaz.me>

- regenerate bootstrap plans
- update CI and docker images for 8.8.4 and 8.10.4

* Changes needed for GenValidate and release.py to
  accommmodate new solver dependency
* Bumps bootstrap plans to modern GHC versions
* Update `validate.sh` and `release.py` to accommodate new solver dep.
* Update `Makefile` targets

I want to use stack diffs (https://github.com/ezyang/ghstack/

) to
submit PRs to Cabal.  Stack diffs, simply by virtue of what they
are, are PRs that are targeted to branches that are not master (they
target an appropriate base that lets GitHub render only the change
in question, even if there are other changes below it.)  However,
I don't get CI jobs on those stack diffs because the current
pull_request branch selector is too restrictive.  This PR makes
it less restrictive.

This PR is submitted using ghstack to validate that this indeed
works.

Signed-off-by: Edward Z. Yang <ezyang@fb.com>

ghstack-source-id: b135ea67848f873fc6b50b950405859587ae8d89
Pull Request resolved: https://github.com/haskell/cabal/pull/7308

8.6 was no longer included in the image

The are various motivation points:
- I'm not aware anyone third party running Cabal tests (maybe nixpkgs?)
- No need to do gen-extra-source-files, as Cabal-tests is not distributed
- No multiple rebuilds of Cabal-QuickCheck, Cabal-tree-diff
- Slightly smaller Cabal sdist (which is quite big still)

A script essentially runs `v2-install cabal-install:exe:cabal`,
but does some simple setup, so the result is less luckily
to be influences by environment.

Also improve bootstrap to do out-of-tree builds.
- Use http, https tricky in some environments