flake.lock: Update

Flake lock file updates:

• Updated input 'nixpkgs':
    'https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.614481%2Brev-5c24cf2f0a12ad855f444c30b2421d044120c66f/018efa00-a443-7f41-b371-ce568b5c7e9f/source.tar.gz?narHash=sha256-XtTSSIB2DA6tOv%2Bl0FhvfDMiyCmhoRbNB%2B0SeInZkbk%3D' (2024-04-19)
  → 'https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.801034%2Brev-e06158e58f3adee28b139e9c2bcfcc41f8625b46/0196dcb0-347d-72e4-9e49-72254d6d1366/source.tar.gz?narHash=sha256-LSmTbiq/nqZR9B2t4MRnWG7cb0KVNU70dB7RT4%2BwYK4%3D' (2025-05-15)

.github/workflows/ci.yml

@@ -1,5 +1,4 @@
 name: CI
-
 on:
   pull_request:
   push:
@@ -7,22 +6,15 @@ on:
 
 jobs:
   typescript-action:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
-    permissions:
-      id-token: write
-      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Check Nixpkgs
+      - name: Install Nix
-        uses: DeterminateSystems/flake-checker-action@main
+        uses: DeterminateSystems/nix-installer-action@main
-        with:
+      - name: Enable magic Nix cache
-          fail-mode: true
+        uses: DeterminateSystems/magic-nix-cache-action@main
-      - name: Install Determinate Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
-      - name: Enable FlakeHub Cache
-        uses: DeterminateSystems/flakehub-cache-action@main
       - name: Install pnpm dependencies
         run: nix develop --command pnpm install
       - name: Check formatting

.github/workflows/update.yml

@@ -1,5 +1,4 @@
 name: update-flake-lock
-
 on:
   workflow_dispatch:
   schedule:
@@ -7,17 +6,16 @@ on:
 
 jobs:
   lockfile:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
-    permissions:
-      id-token: write
-      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@main
-      - name: Enable FlakeHub Cache
+      - name: Enable magic Nix cache
-        uses: DeterminateSystems/flakehub-cache-action@main
+        uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Check flake
+        uses: DeterminateSystems/flake-checker-action@main
       - name: Update flake.lock
         uses: ./.
         with:

.github/workflows/validate.yml

@@ -1,5 +1,4 @@
 name: CI
-
 on:
   pull_request:
   push:
@@ -7,7 +6,7 @@ on:
 
 jobs:
   validate:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
         with:

README.md

@@ -1,37 +1,32 @@
 # update-flake-lock
 
-This is a GitHub Action that updates the [`flake.lock`][lockfile] file for your [Nix flake][flakes] whenever it is run.
+This is a GitHub Action that will update your flake.lock file whenever it is run.
 
-> [!NOTE]
+> **NOTE:** As of v3, this action will no longer automatically install Nix to the action runner. You **MUST** set up a Nix with flakes support enabled prior to running this action, or your workflow will not function as expected.
-> As of v3, this action no longer automatically installs [Determinate Nix][det-nix] to the action runner.
-> You **must** set up Nix with flakes support enabled prior to running this action or your workflow will not function as expected.
 
 ## Example
 
-Here's an example GitHub Action workflow using this Action:
+An example GitHub Action workflow using this action would look like the following:
 
 ```yaml
-name: "Flake.lock: update Nix dependencies"
+name: update-flake-lock
-
 on:
   workflow_dispatch: # allows manual triggering
   schedule:
     - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
 
 jobs:
-  nix-flake-update:
+  lockfile:
-    permissions:
-      contents: write
-      id-token: write
-      issues: write
-      pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
-      - uses: DeterminateSystems/determinate-nix-action@v3
+        uses: actions/checkout@v4
-      - uses: DeterminateSystems/update-flake-lock@main
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: Update flake.lock
+        uses: DeterminateSystems/update-flake-lock@main
         with:
-          pr-title: "Update Nix flake inputs" # Title of PR to be created
+          pr-title: "Update flake.lock" # Title of PR to be created
           pr-labels: |                  # Labels to be set on the PR
             dependencies
             automated
@@ -39,14 +34,12 @@ jobs:
 
 ## Example updating specific input(s)
 
-> [!NOTE]
+> **NOTE**: If any inputs have a stale reference (e.g. the lockfile thinks a git input wants its "ref" to be "nixos-unstable", but the flake.nix specifies "nixos-unstable-small"), they will also be updated. At this time, there is no known workaround.
-> If any inputs have a stale reference (e.g. the lockfile thinks a git input wants its "ref" to be "nixos-unstable", but the flake.nix specifies "nixos-unstable-small"), they are also updated. At this time, there is no known workaround.
 
-It's also possible to update specific [flake inputs][inputs] by specifying them in a space-separated list:
+It is also possible to update specific inputs by specifying them in a space-separated list:
 
 ```yaml
 name: update-flake-lock
-
 on:
   workflow_dispatch: # allows manual triggering
   schedule:
@@ -58,17 +51,17 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@v1
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@main
+        uses: DeterminateSystems/update-flake-lock@vX
         with:
           inputs: input1 input2 input3
 ```
 
 ## Example adding options to nix command
 
-It's also possible to use specific options to the `nix` command in a space-separated list:
+It is also possible to use specific options to the nix command in a space separated list:
 
 ```yaml
 name: update-flake-lock
@@ -83,10 +76,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@v1
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@main
+        uses: DeterminateSystems/update-flake-lock@vX
         with:
           nix-options: --debug --log-format raw
 ```
@@ -106,11 +99,11 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@v1
       - name: Update flake.lock
         id: update
-        uses: DeterminateSystems/update-flake-lock@main
+        uses: DeterminateSystems/update-flake-lock@vX
         with:
           inputs: input1 input2 input3
       - name: Print PR number
@@ -135,11 +128,11 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@v1
       - name: Update flake.lock
         if: ${{ github.event_name != 'pull_request' }}
-        uses: DeterminateSystems/update-flake-lock@main
+        uses: DeterminateSystems/update-flake-lock@vX
         with:
           inputs: input1 input2 input3
           path-to-flake-dir: 'nix/' # in this example our flake doesn't sit at the root of the repository, it sits under 'nix/flake.nix'
@@ -162,29 +155,36 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@v1
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@main
+        uses: DeterminateSystems/update-flake-lock@vX
         with:
-          git-author-name: Jane Author
+          git-author-name: 'Jane Author'
-          git-author-email: github-actions[bot]@users.noreply.github.com
+          git-author-email: 'github-actions[bot]@users.noreply.github.com'
-          git-committer-name: John Committer
+          git-committer-name: 'John Committer'
-          git-committer-email: github-actions[bot]@users.noreply.github.com
+          git-committer-email: 'github-actions[bot]@users.noreply.github.com'
 ```
 
 ## Running GitHub Actions CI
 
-GitHub Actions doesn't run workflows when a branch is pushed by or a PR is opened by a GitHub Action.
+GitHub Actions will not run workflows when a branch is pushed by or a PR is opened by a GitHub Action. There are two ways to have GitHub Actions CI run on a PR submitted by this action.
-There are two ways to have GitHub Actions CI run on a PR submitted by this action.
 
 ### Without a Personal Authentication Token
 
-Without using a Personal Authentication Token, close and reopen the pull request manually to kick off CI.
+Without using a Personal Authentication Token, you can manually run the following to kick off a CI run:
+
+```
+git branch -D update_flake_lock_action
+git fetch origin
+git checkout update_flake_lock_action
+git commit --amend --no-edit
+git push origin update_flake_lock_action --force
+```
 
 ### With a Personal Authentication Token
 
-By providing a Personal Authentication Token, the PR is submitted in a way that bypasses this limitation (GitHub essentially thinks it's the owner of the PAT submitting the PR, and not an Action).
+By providing a Personal Authentication Token, the PR will be submitted in a way that bypasses this limitation (GitHub will essentially think it is the owner of the PAT submitting the PR, and not an Action).
 You can create a token by visiting https://github.com/settings/tokens and select at least the `repo` scope. For the new fine-grained tokens, you need to enable read and write access for "Contents" and "Pull Requests" permissions. Then, store this token in your repository secrets (i.e. `https://github.com/<USER>/<REPO>/settings/secrets/actions`) as `GH_TOKEN_FOR_UPDATES` and set up your workflow file like the following:
 
 ```yaml
@@ -200,34 +200,30 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@v1
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@main
+        uses: DeterminateSystems/update-flake-lock@vX
         with:
           token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
 ```
 
 ## With GPG commit signing
 
-It's possible for the bot to produce GPG-signed commits.
+It's possible for the bot to produce GPG signed commits. Associating a GPG public key to a github user account is not required but it is necessary if you want the signed commits to appear as verified in Github. This can be a compliance requirement in some cases.
-Associating a GPG public key to a GitHub user account isn't required but it *is* necessary if you want the signed commits to appear as verified in Github.
-This can be a compliance requirement in some cases.
 
-You can follow [GitHub's guide to creating and/or adding a new GPG key to an user account](https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-new-gpg-key-to-your-github-account).
+You can follow [Github's guide on creating and/or adding a new GPG key to an user account](https://docs.github.com/en/authentication/managing-commit-signature-verification/adding-a-new-gpg-key-to-your-github-account). Using a specific github user account for the bot can be a good security measure to dissociate this bot's actions and commits from your personal github account.
-Using a specific GitHub user account for the bot can be a good security measure to dissociate this bot's actions and commits from your personal GitHub account.
 
-For the bot to produce signed commits, you need to provide the GPG private keys to this action's input parameters. You can safely do that with [Github secrets as explained here](https://github.com/crazy-max/ghaction-import-gpg#prerequisites).
+For the bot to produce signed commits, you will have to provide the GPG private keys to this action's input parameters. You can safely do that with [Github secrets as explained here](https://github.com/crazy-max/ghaction-import-gpg#prerequisites).
 
 When using commit signing, the commit author name and email for the commits produced by this bot would correspond to the ones associated to the GPG Public Key.
 
 If you want to sign using a subkey, you must specify the subkey fingerprint using the `gpg-fingerprint` input parameter.
 
-Here's an example of how to using this action with commit signing:
+You can find an example of how to using this action with commit signing below:
 
 ```yaml
 name: update-flake-lock
-
 on:
   workflow_dispatch: # allows manual triggering
   schedule:
@@ -239,10 +235,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@v1
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@main
+        uses: DeterminateSystems/update-flake-lock@vX
         with:
           sign-commits: true
           gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
@@ -252,19 +248,18 @@ jobs:
 
 ## Custom PR Body
 
-By default, the generated PR body uses this template:
+By default the generated PR body is set to be the following template:
 
 ````handlebars
 Automated changes by the [update-flake-lock](https://github.com/DeterminateSystems/update-flake-lock) GitHub Action.
 
-````
+```
 {{ env.GIT_COMMIT_MESSAGE }}
-````
 ```
 
 ### Running GitHub Actions on this PR
 
-GitHub Actions doesn't run workflows on pull requests that are opened by a GitHub Action.
+GitHub Actions will not run workflows on pull requests which are opened by a GitHub Action.
 
 To run GitHub Actions workflows on this PR, run:
 
@@ -277,14 +272,12 @@ git push origin update_flake_lock_action --force
 ```
 ````
 
-You can customize it, however, using variable interpolation performed with [Handlebars].
+However you can customize it, with variable interpolation performed with [Handlebars](https://handlebarsjs.com/). This allows you to customize the template with the following variables:
-This enables you to customize the template with these variables:
+- env.GIT_AUTHOR_NAME
-
+- env.GIT_AUTHOR_EMAIL
-- `env.GIT_AUTHOR_NAME`
+- env.GIT_COMMITTER_NAME
-- `env.GIT_AUTHOR_EMAIL`
+- env.GIT_COMMITTER_EMAIL
-- `env.GIT_COMMITTER_NAME`
+- env.GIT_COMMIT_MESSAGE
-- `env.GIT_COMMITTER_EMAIL`
-- `env.GIT_COMMIT_MESSAGE`
 
 ## Add assignees or reviewers
 
@@ -304,10 +297,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Install Determinate Nix
+      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@v3
+        uses: DeterminateSystems/nix-installer-action@v1
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@main
+        uses: DeterminateSystems/update-flake-lock@vX
         with:
           pr-assignees: SomeGitHubUsername
           pr-reviewers: SomeOtherGitHubUsername,SomeThirdGitHubUsername
@@ -315,16 +308,8 @@ jobs:
 
 ## Contributing
 
-Feel free to send a PR or open an issue if you find that something functions unexpectedly!
+Feel free to send a PR or open an issue if you find something functions unexpectedly! Please make sure to test your changes and update any related documentation before submitting your PR.
-Please make sure to test your changes and update any related documentation before submitting your PR.
 
 ### How to test changes
 
-In order to more easily test your changes to this action, we have created a template repository that should point you in the right direction: https://github.com/DeterminateSystems/update-flake-lock-test-template.
+In order to more easily test your changes to this action, we have created a template repository that should point you in the right direction: https://github.com/DeterminateSystems/update-flake-lock-test-template. Please see the README in that repository for instructions on testing your changes.
-Please see the README in that repository for instructions on testing your changes.
-
-[det-nix]: https://docs.determinate.systems/determinate-nix
-[flakes]: https://zero-to-nix.com/concepts/flakes
-[handlebars]: https://handlebarsjs.com
-[inputs]: https://zero-to-nix.com/concepts/flakes/#inputs
-[lockfile]: https://zero-to-nix.com/concepts/flakes/#lockfile

action.yml

@@ -41,7 +41,15 @@ inputs:
 
       GitHub Actions will not run workflows on pull requests which are opened by a GitHub Action.
 
-      **To run GitHub Actions workflows on this PR, close and re-open this pull request.**
+      To run GitHub Actions workflows on this PR, run:
+
+      ```sh
+      git branch -D update_flake_lock_action
+      git fetch origin
+      git checkout update_flake_lock_action
+      git commit --amend --no-edit
+      git push origin update_flake_lock_action --force
+      ```
 
   pr-labels:
     description: "A comma or newline separated list of labels to set on the Pull Request to be created"
@@ -110,7 +118,7 @@ runs:
     - name: Import bot's GPG key for signing commits
       if: ${{ inputs.sign-commits == 'true' }}
       id: import-gpg
-      uses: crazy-max/ghaction-import-gpg@e89d40939c28e39f97cf32126055eeae86ba74ec # v6.3.0
+      uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
       with:
         gpg_private_key: ${{ inputs.gpg-private-key }}
         fingerprint: ${{ inputs.gpg-fingerprint }}

flake.lock

@@ -2,12 +2,12 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1746663147,
+        "lastModified": 1747327360,
-        "narHash": "sha256-Ua0drDHawlzNqJnclTJGf87dBmaO/tn7iZ+TCkTRpRc=",
+        "narHash": "sha256-LSmTbiq/nqZR9B2t4MRnWG7cb0KVNU70dB7RT4+wYK4=",
-        "rev": "dda3dcd3fe03e991015e9a74b22d35950f264a54",
+        "rev": "e06158e58f3adee28b139e9c2bcfcc41f8625b46",
-        "revCount": 796699,
+        "revCount": 801034,
         "type": "tarball",
-        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.796699%2Brev-dda3dcd3fe03e991015e9a74b22d35950f264a54/0196b263-02b0-7dec-8aca-c2506ed2485f/source.tar.gz"
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.801034%2Brev-e06158e58f3adee28b139e9c2bcfcc41f8625b46/0196dcb0-347d-72e4-9e49-72254d6d1366/source.tar.gz"
       },
       "original": {
         "type": "tarball",

package.json

@@ -35,13 +35,13 @@
     "@typescript-eslint/eslint-plugin": "^7.18.0",
     "@vercel/ncc": "^0.38.3",
     "eslint": "^8.57.1",
-    "eslint-import-resolver-typescript": "^3.10.1",
+    "eslint-import-resolver-typescript": "^3.6.3",
     "eslint-plugin-github": "^4.10.2",
     "eslint-plugin-import": "^2.31.0",
-    "eslint-plugin-prettier": "^5.4.0",
+    "eslint-plugin-prettier": "^5.2.1",
-    "prettier": "^3.5.3",
+    "prettier": "^3.3.3",
-    "tsup": "^8.4.0",
+    "tsup": "^8.3.5",
-    "typescript": "^5.8.3",
+    "typescript": "^5.6.3",
-    "vitest": "^3.1.3"
+    "vitest": "^1.6.0"
   }
 }

src/index.ts

@@ -54,7 +54,6 @@ class UpdateFlakeLockAction extends DetSysAction {
 
     const execOptions: actionsExec.ExecOptions = {
       cwd: this.pathToFlakeDir !== null ? this.pathToFlakeDir : undefined,
-      ignoreReturnCode: true,
     };
 
     const exitCode = await actionsExec.exec("nix", nixCommandArgs, execOptions);