this derivation will be built:
  /nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv
building '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv' on 'ssh-ng://nix@eliza'
building '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv'
treefmt-check> treefmt v2.5.0traversed 111 files
treefmt-check> emitted 100 files for processing
treefmt-check> formatted 100 files (6 changed) in 12.681s
treefmt-check>  M README.md
treefmt-check>  M docs/_static/field-lists.css
treefmt-check>  M docs/guides/binary-caches.md
treefmt-check>  M docs/guides/gitea.md
treefmt-check>  M docs/guides/github.md
treefmt-check>  M docs/guides/using.md
treefmt-check> diff --git a/README.md b/README.md
treefmt-check> index d262262..6dd1b01 100644
treefmt-check> --- a/README.md
treefmt-check> +++ b/README.md
treefmt-check> @@ -25,8 +25,7 @@ time.
treefmt-check>  
treefmt-check>  ## Getting Started with Buildbot Setup
treefmt-check>  
treefmt-check> -To set up Buildbot using Buildbot-nix,
treefmt-check> -read the [documentation].
treefmt-check> +To set up Buildbot using Buildbot-nix, read the [documentation].
treefmt-check>  
treefmt-check>  ## Incompatibilities with the lix overlay
treefmt-check>  
treefmt-check> @@ -80,4 +79,4 @@ We have a matrix channel at
treefmt-check>  For commercial support, please contact [Mic92](https://github.com/Mic92/) at
treefmt-check>  joerg@thalheim.io or reach out to [Numtide](https://numtide.com/contact/).
treefmt-check>  
treefmt-check> -  [documentation]: https://buildbot-nix.readthedocs.io/en/stable/
treefmt-check> +[documentation]: https://buildbot-nix.readthedocs.io/en/stable/
treefmt-check> diff --git a/docs/_static/field-lists.css b/docs/_static/field-lists.css
treefmt-check> index 55afe4f..58974f2 100644
treefmt-check> --- a/docs/_static/field-lists.css
treefmt-check> +++ b/docs/_static/field-lists.css
treefmt-check> @@ -10,29 +10,29 @@ dl.field-list {
treefmt-check>  }
treefmt-check>  
treefmt-check>  dl.field-list > dt {
treefmt-check> -	/*font-weight: bold;*/
treefmt-check> -	word-break: break-word;
treefmt-check> -	margin-top: 0em;
treefmt-check> -	padding-left: 0.5em;
treefmt-check> -	padding-right: 5px;
treefmt-check> -	font-size: var(--font-size--normal) !important;
treefmt-check> +  /*font-weight: bold;*/
treefmt-check> +  word-break: break-word;
treefmt-check> +  margin-top: 0em;
treefmt-check> +  padding-left: 0.5em;
treefmt-check> +  padding-right: 5px;
treefmt-check> +  font-size: var(--font-size--normal) !important;
treefmt-check>  }
treefmt-check>  
treefmt-check>  dl.field-list > dd > :first-child {
treefmt-check> -	margin-top: 0 !important;
treefmt-check> +  margin-top: 0 !important;
treefmt-check>  }
treefmt-check>  
treefmt-check>  dl.field-list > dd > :last-child {
treefmt-check> -	margin-bottom: 0 !important;
treefmt-check> +  margin-bottom: 0 !important;
treefmt-check>  }
treefmt-check>  
treefmt-check>  dl.field-list > dd {
treefmt-check> -	padding-left: 0.5em;
treefmt-check> -	margin-top: 0em;
treefmt-check> -	margin-left: 0em;
treefmt-check> -	margin-bottom: .25em;
treefmt-check> +  padding-left: 0.5em;
treefmt-check> +  margin-top: 0em;
treefmt-check> +  margin-left: 0em;
treefmt-check> +  margin-bottom: 0.25em;
treefmt-check>  }
treefmt-check>  
treefmt-check>  dl.field-list > dd a {
treefmt-check> -	overflow-wrap: anywhere;
treefmt-check> +  overflow-wrap: anywhere;
treefmt-check>  }
treefmt-check> diff --git a/docs/guides/binary-caches.md b/docs/guides/binary-caches.md
treefmt-check> index 3af9293..a9aea63 100644
treefmt-check> --- a/docs/guides/binary-caches.md
treefmt-check> +++ b/docs/guides/binary-caches.md
treefmt-check> @@ -24,4 +24,3 @@ integrate run a systemd service as described in
treefmt-check>  [this example configuration](../../examples/attic-watch-store.nix). The systemd
treefmt-check>  service watches for changes in the local buildbot-nix store and uploads the
treefmt-check>  contents to the attic cache.
treefmt-check> -
treefmt-check> diff --git a/docs/guides/gitea.md b/docs/guides/gitea.md
treefmt-check> index 7315054..22d6bbd 100644
treefmt-check> --- a/docs/guides/gitea.md
treefmt-check> +++ b/docs/guides/gitea.md
treefmt-check> @@ -22,8 +22,10 @@ status updates, and secure authentication.
treefmt-check>  
treefmt-check>  1. **Create an OAuth2 Application**:
treefmt-check>     - Navigate to one of these locations:
treefmt-check> -     - {menuselection}`Site Administration --> Applications` (for admins, applies globally)
treefmt-check> -     - {menuselection}`Organization Settings --> Applications` (for organization-wide access)
treefmt-check> +     - {menuselection}`Site Administration --> Applications` (for admins,
treefmt-check> +       applies globally)
treefmt-check> +     - {menuselection}`Organization Settings --> Applications` (for
treefmt-check> +       organization-wide access)
treefmt-check>       - {menuselection}`User Settings --> Applications` (for personal use)
treefmt-check>  
treefmt-check>  2. **Configure the OAuth2 app**:
treefmt-check> diff --git a/docs/guides/github.md b/docs/guides/github.md
treefmt-check> index 073cc17..dbe1ad7 100644
treefmt-check> --- a/docs/guides/github.md
treefmt-check> +++ b/docs/guides/github.md
treefmt-check> @@ -69,8 +69,8 @@ definitions:
treefmt-check>  ]
treefmt-check>  ```
treefmt-check>  
treefmt-check> -- `name`: The worker name (matches {nix:option}`services.buildbot-nix.worker.name`, defaults
treefmt-check> -  to hostname)
treefmt-check> +- `name`: The worker name (matches
treefmt-check> +  {nix:option}`services.buildbot-nix.worker.name`, defaults to hostname)
treefmt-check>  - `pass`: The password (must match
treefmt-check>    {nix:option}`services.buildbot-nix.worker.workerPasswordFile` contents)
treefmt-check>  - `cores`: Number of CPU cores (must match the actual core count of the worker
treefmt-check> @@ -99,34 +99,32 @@ For each repository you want to build:
treefmt-check>  
treefmt-check>  ## How It Works
treefmt-check>  
treefmt-check> -Authentication:
treefmt-check> -: Uses GitHub App JWT tokens for API access and installation tokens for
treefmt-check> -  repository-specific operations
treefmt-check> +Authentication: : Uses GitHub App JWT tokens for API access and installation
treefmt-check> +tokens for repository-specific operations
treefmt-check>  
treefmt-check> -Project Discovery:
treefmt-check> -: Automatically discovers repositories the app has access to, filtered by topic
treefmt-check> -  if configured
treefmt-check> +Project Discovery: : Automatically discovers repositories the app has access to,
treefmt-check> +filtered by topic if configured
treefmt-check>  
treefmt-check> -Webhook Management:
treefmt-check> -: Automatically creates and manages webhooks for push and pull_request events
treefmt-check> +Webhook Management: : Automatically creates and manages webhooks for push and
treefmt-check> +pull_request events
treefmt-check>  
treefmt-check> -Status Updates:
treefmt-check> -: Reports build status back to GitHub commits and pull requests
treefmt-check> +Status Updates: : Reports build status back to GitHub commits and pull requests
treefmt-check>  
treefmt-check> -Access Control:
treefmt-check> -: - Admins: Configured users can reload projects and manage builds
treefmt-check> -  - Organization members: Can restart their own builds
treefmt-check> +Access Control: : - Admins: Configured users can reload projects and manage
treefmt-check> +builds
treefmt-check> +
treefmt-check> +- Organization members: Can restart their own builds
treefmt-check>  
treefmt-check>  ## Troubleshooting
treefmt-check>  
treefmt-check> -Projects not appearing:
treefmt-check> -: Check that:
treefmt-check> -  - The GitHub App is installed for the repository
treefmt-check> -  - The repository has the configured topic (if filtering by topic)
treefmt-check> -  - Reload projects manually through the Buildbot UI
treefmt-check> +Projects not appearing: : Check that:
treefmt-check> +
treefmt-check> +- The GitHub App is installed for the repository
treefmt-check> +- The repository has the configured topic (if filtering by topic)
treefmt-check> +- Reload projects manually through the Buildbot UI
treefmt-check>  
treefmt-check> -Webhooks not created:
treefmt-check> -: Verify the app has webhook write permission for the repository
treefmt-check> +Webhooks not created: : Verify the app has webhook write permission for the
treefmt-check> +repository
treefmt-check>  
treefmt-check> -Authentication issues:
treefmt-check> -: Ensure the private key file is readable by the buildbot service
treefmt-check> +Authentication issues: : Ensure the private key file is readable by the buildbot
treefmt-check> +service
treefmt-check> diff --git a/docs/guides/using.md b/docs/guides/using.md
treefmt-check> index 2cd051e..c2fd3cd 100644
treefmt-check> --- a/docs/guides/using.md
treefmt-check> +++ b/docs/guides/using.md
treefmt-check> @@ -37,24 +37,20 @@ information natively as now.
treefmt-check>  ### Public
treefmt-check>  
treefmt-check>  For some actions a login is required. The authentication backend is set by the
treefmt-check> -{nix:option}`services.buildbot-nix.master.authBackend` NixOS option ("github", "gitea",
treefmt-check> -"oidc", or others).
treefmt-check> +{nix:option}`services.buildbot-nix.master.authBackend` NixOS option ("github",
treefmt-check> +"gitea", "oidc", or others).
treefmt-check>  
treefmt-check> -:::{note}
treefmt-check> -You can configure both GitHub and Gitea integrations simultaneously,
treefmt-check> +:::{note} You can configure both GitHub and Gitea integrations simultaneously,
treefmt-check>  regardless of which authentication backend you choose. The auth backend only
treefmt-check> -determines how users log in to the Buildbot interface.
treefmt-check> -:::
treefmt-check> +determines how users log in to the Buildbot interface. :::
treefmt-check>  
treefmt-check>  We have the following two roles:
treefmt-check>  
treefmt-check> -Admins:
treefmt-check> -: - The list of admin usernames is hard-coded in the NixOS configuration.
treefmt-check> -: - admins can reload the project list
treefmt-check> +Admins: : - The list of admin usernames is hard-coded in the NixOS
treefmt-check> +configuration. : - admins can reload the project list
treefmt-check>  
treefmt-check> -Organisation member:
treefmt-check> -: - All member of the organisation where this repository is located
treefmt-check> -: - They can restart builds
treefmt-check> +Organisation member: : - All member of the organisation where this repository is
treefmt-check> +located : - They can restart builds
treefmt-check>  
treefmt-check>  #### GitHub Integration
treefmt-check>  
treefmt-check> @@ -83,17 +79,17 @@ See {doc}`oidc` for configuration details.
treefmt-check>  ### Fully Private
treefmt-check>  
treefmt-check>  To enable fully private mode, set
treefmt-check> -{nix:option}`services.buildbot-nix.master.accessMode.fullyPrivate` to an
treefmt-check> -attrset containing the required options for fully private use, refer to the
treefmt-check> -examples and module implementation (`nix/master.nix`).
treefmt-check> +{nix:option}`services.buildbot-nix.master.accessMode.fullyPrivate` to an attrset
treefmt-check> +containing the required options for fully private use, refer to the examples and
treefmt-check> +module implementation (`nix/master.nix`).
treefmt-check>  
treefmt-check>  This access mode honors the `admins` option in addition to the
treefmt-check>  {nix:option}`services.buildbot-nix.master.accessMode.fullyPrivate.organisations`
treefmt-check>  option. To allow access from certain organisations, you must explicitly list
treefmt-check>  them.
treefmt-check>  
treefmt-check> -If you've set {nix:option}`services.buildbot-nix.master.authBackend`
treefmt-check> -previously, unset it, or you will get an error about a conflicting definitions.
treefmt-check> +If you've set {nix:option}`services.buildbot-nix.master.authBackend` previously,
treefmt-check> +unset it, or you will get an error about a conflicting definitions.
treefmt-check>  `fullyPrivate` requires the `authBackend` to be set to `basichttpauth` to
treefmt-check>  function (this is handled by the module, which is why you can leave it unset).
treefmt-check>  For a concrete example please refer to
treefmt-check> @@ -106,59 +102,42 @@ root of whichever branch it's currently evaluating, parse it as TOML and apply
treefmt-check>  the configuration specified. The following table illustrates the supported
treefmt-check>  options.
treefmt-check>  
treefmt-check> -:::{confval} lock_file
treefmt-check> -:type: `str`
treefmt-check> -:default: `flake.lock`
treefmt-check> +:::{confval} lock_file :type: `str` :default: `flake.lock`
treefmt-check>  
treefmt-check>  Dictates which lock file `buildbot-nix` will use when evaluating your flake.
treefmt-check>  
treefmt-check> -:example:
treefmt-check> -  have multiple lockfiles, one for nixpkgs-stable, one for nixpkgs-unstable or
treefmt-check> -  by default pin an input to a private repo, but have a lockfile with that
treefmt-check> -  private repo replaced by a public repo for CI
treefmt-check> -:::
treefmt-check> +:example: have multiple lockfiles, one for nixpkgs-stable, one for
treefmt-check> +nixpkgs-unstable or by default pin an input to a private repo, but have a
treefmt-check> +lockfile with that private repo replaced by a public repo for CI :::
treefmt-check>  
treefmt-check> -:::{confval} attribute
treefmt-check> -:type: `str`
treefmt-check> -:default: `checks`
treefmt-check> +:::{confval} attribute :type: `str` :default: `checks`
treefmt-check>  
treefmt-check>  Which attribute in the flake to evaluate and build.
treefmt-check>  
treefmt-check> -:example: using a different attribute, like `hydraJobs`
treefmt-check> -:::
treefmt-check> +:example: using a different attribute, like `hydraJobs` :::
treefmt-check>  
treefmt-check> -:::{confval} flake_dir
treefmt-check> -:type: `str`
treefmt-check> -:default: `.`
treefmt-check> -Which directory the flake is located.
treefmt-check> +:::{confval} flake_dir :type: `str` :default: `.` Which directory the flake is
treefmt-check> +located.
treefmt-check>  
treefmt-check> -:example: using a different flake, like `./tests`
treefmt-check> -:::
treefmt-check> +:example: using a different flake, like `./tests` :::
treefmt-check>  
treefmt-check> -:::{confval} effects_on_pull_requests
treefmt-check> -:type: `bool`
treefmt-check> -:default: `false`
treefmt-check> +:::{confval} effects_on_pull_requests :type: `bool` :default: `false`
treefmt-check>  
treefmt-check> -Run hercules-ci effects on pull requests.
treefmt-check> -:::
treefmt-check> +Run hercules-ci effects on pull requests. :::
treefmt-check>  
treefmt-check> -:::{confval} effects_branches
treefmt-check> -:type: `list[str]`
treefmt-check> -:default:  `[]`
treefmt-check> +:::{confval} effects_branches :type: `list[str]` :default: `[]`
treefmt-check>  
treefmt-check>  Glob patterns for additional branches that run effects
treefmt-check>  
treefmt-check> -:example: `["staging", "release/*"]`
treefmt-check> -:::
treefmt-check> +:example: `["staging", "release/*"]` :::
treefmt-check>  
treefmt-check>  By default, effects only run on the default branch. The
treefmt-check> -{confval}`effects_branches` and {confval}`effects_on_pull_requests` settings
treefmt-check> -are always read from the **default branch's** `buildbot-nix.toml` (via `git
treefmt-check> -show`) so that pull request authors cannot grant themselves effects access.
treefmt-check> -
treefmt-check> -:::{caution}
treefmt-check> -PR effects receive the same `effects_per_repo_secrets` as default-branch
treefmt-check> -effects. A malicious PR can modify the effect code to exfiltrate these secrets.
treefmt-check> -Only enable {confval}`effects_on_pull_requests` for repositories where you
treefmt-check> -trust all contributors, or where no secrets are configured.
treefmt-check> -:::
treefmt-check> +{confval}`effects_branches` and {confval}`effects_on_pull_requests` settings are
treefmt-check> +always read from the **default branch's** `buildbot-nix.toml` (via `git
treefmt-check> +show`)
treefmt-check> +so that pull request authors cannot grant themselves effects access.
treefmt-check> +
treefmt-check> +:::{caution} PR effects receive the same `effects_per_repo_secrets` as
treefmt-check> +default-branch effects. A malicious PR can modify the effect code to exfiltrate
treefmt-check> +these secrets. Only enable {confval}`effects_on_pull_requests` for repositories
treefmt-check> +where you trust all contributors, or where no secrets are configured. :::
error: build of '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv' on 'ssh-ng://nix@eliza' failed: Cannot build '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv'.
       Reason: builder failed with exit code 1.
       Output paths:
         /nix/store/863hybqzmc5v0nhfb7fhr0vj9iqjjaqp-treefmt-check
       Last 25 log lines:
       >  
       > -:example: `["staging", "release/*"]`
       > -:::
       > +:example: `["staging", "release/*"]` :::
       >  
       >  By default, effects only run on the default branch. The
       > -{confval}`effects_branches` and {confval}`effects_on_pull_requests` settings
       > -are always read from the **default branch's** `buildbot-nix.toml` (via `git
       > -show`) so that pull request authors cannot grant themselves effects access.
       > -
       > -:::{caution}
       > -PR effects receive the same `effects_per_repo_secrets` as default-branch
       > -effects. A malicious PR can modify the effect code to exfiltrate these secrets.
       > -Only enable {confval}`effects_on_pull_requests` for repositories where you
       > -trust all contributors, or where no secrets are configured.
       > -:::
       > +{confval}`effects_branches` and {confval}`effects_on_pull_requests` settings are
       > +always read from the **default branch's** `buildbot-nix.toml` (via `git
       > +show`)
       > +so that pull request authors cannot grant themselves effects access.
       > +
       > +:::{caution} PR effects receive the same `effects_per_repo_secrets` as
       > +default-branch effects. A malicious PR can modify the effect code to exfiltrate
       > +these secrets. Only enable {confval}`effects_on_pull_requests` for repositories
       > +where you trust all contributors, or where no secrets are configured. :::
       For full logs, run:
         nix log /nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv
error: Cannot build '/nix/store/8s4n99dar18amzxr0c795najn1bzzx91-treefmt-check.drv'.
       Reason: builder failed with exit code 1.
       Output paths:
         /nix/store/863hybqzmc5v0nhfb7fhr0vj9iqjjaqp-treefmt-check