Repository navigation
ci: enable weekly Nix lockfile maintenance - #56
Open
chrapkowski-sg wants to merge 1 commit into
Open
chrapkowski-sg wants to merge 1 commit into
chrapkowski-sg wants to merge 1 commit into
Conversation
Refresh flake.lock weekly through Renovate PRs without automerge. Keep dependency pins and manual publication unchanged. Co-authored-by: Amp <amp@ampcode.com> Amp-Thread-ID: https://ampcode.com/threads/T-01a19ca2-54f5-7516-96a2-7e638c85de48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Renovate already enables its Nix manager, but lockfile maintenance is disabled by default. Rust, Cargo, rust-analyzer, and the container packages come from the nixpkgs revision in flake.lock rather than an owned Cargo manifest. Periodic lock refreshes cover new snapshots of the configured channel.
Change
Validation
nix flake check --no-write-lock-filepassed all three x86_64-linux checks: shellcheck, formatting, and Renovate configuration validation (Renovate 43.150.1).git diff --checkpassed.Other platforms and remote Renovate execution were not tested.
Follow-up when refreshing dependencies
The first nixpkgs refresh to cacert 3.131.1 or newer needs the obsolete CA blacklist override removed: upstream has already removed the named roots, and the current override fails if a blocked root is absent. This PR intentionally leaves that compatibility change with the dependency refresh so the currently pinned certificate bundle remains protected.
Lock maintenance follows the configured nixpkgs channel; it does not guarantee the latest upstream Rust or rust-analyzer release. This PR does not itself remediate vulnerabilities or rebuild/publish images. Updated dependencies still require reviewed PRs and the existing manual release process.