Fixup support for Nix 2.23.0 and later

A caller of this action can lock this action to a specific commit. However because the action itself does not lock its dependent actions to a specific commit this opens the end-user up to possible supply-chain attacks if the dependent actions rewrite their tags.

This PR changes all third party actions to be explicitly locked.

Dependabot will still work and update these hashes for you


I also suggest installing https://github.com/ossf/scorecard in this repo. It will report about these kind of issues.

Note that you should in turn have to audit all the third party deps of the actions that your action depends on. In general this is all a bit of a mess and GitHub's security model is very meh

e.g. see https://github.com/ossf/scorecard/issues/2189

README.md

@@ -138,23 +138,6 @@ jobs:
           path-to-flake-dir: 'nix/' # in this example our flake doesn't sit at the root of the repository, it sits under 'nix/flake.nix'
 ```
 
-You can also run the update operation in multiple directories, provided that each directory is a valid flake:
-
-```yaml
-- name: Update flake.lock
-  uses: DeterminateSystems/update-flake-lock@vX
-  with:
-    flake-dirs: |
-      flake1
-      flake2
-      flake3
-```
-
-> **Warning**: If you choose multiple directories, `update-flake-lock` can only update all flake inputs,
-> meaning that you can't set the `inputs` parameter. This is due to limitations in input handling in
-> GitHub Actions, which only allows for strings, numbers, Booleans, and arrays but not objects, which
-> would be the much preferred data type for expressing per-directory inputs.
-
 ## Example using a different Git user
 
 If you want to change the author and / or committer of the flake.lock update commit, you can tweak the `git-{author,committer}-{name,email}` options:
@@ -202,7 +185,7 @@ git push origin update_flake_lock_action --force
 ### With a Personal Authentication Token
 
 By providing a Personal Authentication Token, the PR will be submitted in a way that bypasses this limitation (GitHub will essentially think it is the owner of the PAT submitting the PR, and not an Action).
-You can create a token by visiting https://github.com/settings/tokens and select at least the `repo` scope. Then, store this token in your repository secrets (i.e. `https://github.com/<USER>/<REPO>/settings/secrets/actions`) as `GH_TOKEN_FOR_UPDATES` and set up your workflow file like the following:
+You can create a token by visiting https://github.com/settings/tokens and select at least the `repo` scope. For the new fine-grained tokens, you need to enable read and write access for "Contents" and "Pull Requests" permissions. Then, store this token in your repository secrets (i.e. `https://github.com/<USER>/<REPO>/settings/secrets/actions`) as `GH_TOKEN_FOR_UPDATES` and set up your workflow file like the following:
 
 ```yaml
 name: update-flake-lock

action.yml

@@ -9,21 +9,10 @@ inputs:
     description: "GITHUB_TOKEN or a `repo` scoped Personal Access Token (PAT)"
     required: false
     default: ${{ github.token }}
-  commit-msg-template:
-    description: |
-      The commit message template to use. You can use these variables in your template:
-
-      * `{{ flake_dot_lock }}` is the path to the `flake.lock` file being updated
-      * `{{ flake_dot_lock_dir }}` is the `flake.lock` file's directory
-
-      If you set both this and `commit-msg`, the `commit-msg` setting is used (it does not support templating).
-    required: false
-    default: |
-      flake.lock: Updated in {{ flake_dot_lock_dir }}
   commit-msg:
-    description: |
-      The message provided with the commit.
+    description: "The message provided with the commit"
     required: false
+    default: "flake.lock: Update"
   base:
     description: "Sets the pull request base branch. Defaults to the branch checked out in the workflow."
     required: false
@@ -32,32 +21,12 @@ inputs:
     required: false
     default: "update_flake_lock_action"
   path-to-flake-dir:
-    description: |
-      The path of the directory containing `flake.nix` file within your repository.
-      Useful when `flake.nix` cannot reside at the root of your repository.
+    description: "The path of the directory containing `flake.nix` file within your repository. Useful when `flake.nix` cannot reside at the root of your repository."
     required: false
-  flake-dirs:
-    description: |
-      A space-separated list of directories containing `flake.nix` files within your repository.
-      Useful when you have multiple flakes in your repository.
-    required: false
-    default: ""
   pr-title:
     description: "The title of the PR to be created"
     required: false
     default: "flake.lock: Update"
-  pr-body-template:
-    description: |
-      The pull request body template to use. You can use these variables in your template:
-
-      * `{{ comma_separated_dirs }}` is the flake directories that were updated separated by comma
-      * `{{ space_separated_dirs }}` is the flake directories that were updated separated by space
-      * `{{ updated_dirs_list }}` is the flake directories that were updated as a Markdown list
-
-      If you set both this and `pr-body`, the `pr-body` setting is used (it does not support templating).
-    required: false
-    default: |
-      Just testing.
   pr-body:
     description: "The body of the PR to be created"
     required: false
@@ -146,7 +115,7 @@ runs:
     - name: Import bot's GPG key for signing commits
       if: ${{ inputs.sign-commits == 'true' }}
       id: import-gpg
-      uses: crazy-max/ghaction-import-gpg@v6
+      uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
       with:
         gpg_private_key: ${{ inputs.gpg-private-key }}
         fingerprint: ${{ inputs.gpg-fingerprint }}
@@ -177,7 +146,6 @@ runs:
         echo "GIT_COMMITTER_NAME=${{ inputs.git-committer-name }}" >> $GITHUB_ENV
         echo "GIT_COMMITTER_EMAIL=<${{ inputs.git-committer-email }}>" >> $GITHUB_ENV
     - name: Run update-flake-lock
-      id: update-flake-lock
       shell: bash
       run: node "$GITHUB_ACTION_PATH/dist/index.js"
       env:
@@ -186,7 +154,6 @@ runs:
         INPUT_BASE: ${{ inputs.base }}
         INPUT_BRANCH: ${{ inputs.branch }}
         INPUT_COMMIT-MSG: ${{ inputs.commit-msg }}
-        INPUT_COMMIT-MSG-TEMPLATE: ${{ inputs.commit-msg-template }}
         INPUT_GIT-AUTHOR-EMAIL: ${{ inputs.git-author-email }}
         INPUT_GIT-AUTHOR-NAME: ${{ inputs.git-author-name }}
         INPUT_GIT-COMMITTER-EMAIL: ${{ inputs.git-committer-email }}
@@ -197,10 +164,8 @@ runs:
         INPUT_INPUTS: ${{ inputs.inputs }}
         INPUT_NIX-OPTIONS: ${{ inputs.nix-options }}
         INPUT_PATH-TO-FLAKE-DIR: ${{ inputs.path-to-flake-dir }}
-        INPUT_FLAKE-DIRS: ${{ inputs.flake-dirs }}
         INPUT_PR-ASSIGNEES: ${{ inputs.pr-assignees }}
         INPUT_PR-BODY: ${{ inputs.pr-body }}
-        INPUT_PR-BODY-TEMPLATE: ${{ inputs.pr-body-template }}
         INPUT_PR-LABELS: ${{ inputs.pr-labels }}
         INPUT_PR-REVIEWERS: ${{ inputs.pr-reviewers }}
         INPUT_PR-TITLE: ${{ inputs.pr-title }}
@@ -213,7 +178,7 @@ runs:
       uses: DamianReeves/write-file-action@v1.3
       with:
         path: pr_body.template
-        contents: ${{ steps.update-flake-lock.outputs.pr-body }}
+        contents: ${{ inputs.pr-body }}
       env: {}
     - name: Set additional env variables (GIT_COMMIT_MESSAGE)
       shell: bash
@@ -225,7 +190,7 @@ runs:
         echo "$DELIMITER" >> $GITHUB_ENV
         echo "GIT_COMMIT_MESSAGE is: ${COMMIT_MESSAGE}"
     - name: Interpolate PR Body
-      uses: pedrolamas/handlebars-action@v2.4.0
+      uses: pedrolamas/handlebars-action@2995d7eadacbc8f2f6ab8431a01d84a5fa3b8bb4 # v2.4.0
       with:
         files: "pr_body.template"
         output-filename: "pr_body.txt"
@@ -242,7 +207,7 @@ runs:
       run: rm -f pr_body.txt pr_body.template
     - name: Create PR
       id: create-pr
-      uses: peter-evans/create-pull-request@v6
+      uses: peter-evans/create-pull-request@6d6857d36972b65feb161a90e484f2984215f83e # v6.0.5
       with:
         base: ${{ inputs.base }}
         branch: ${{ inputs.branch }}

package.json

@@ -12,7 +12,6 @@
     "lint": "eslint src/**/*.ts --ignore-pattern *.test.ts",
     "package": "ncc build",
     "test": "vitest --watch false",
-    "test-dev": "vitest",
     "all": "pnpm run format && pnpm run lint && pnpm run build && pnpm run package"
   },
   "repository": {
@@ -29,8 +28,7 @@
   "dependencies": {
     "@actions/core": "^1.10.1",
     "@actions/exec": "^1.1.1",
-    "detsys-ts": "github:DeterminateSystems/detsys-ts",
-    "handlebars": "^4.7.8"
+    "detsys-ts": "github:DeterminateSystems/detsys-ts"
   },
   "devDependencies": {
     "@trivago/prettier-plugin-sort-imports": "^4.3.0",

pnpm-lock.yaml

@@ -13,10 +13,7 @@ dependencies:
     version: 1.1.1
   detsys-ts:
     specifier: github:DeterminateSystems/detsys-ts
-    version: github.com/DeterminateSystems/detsys-ts/fe64ba33b4bdeec0991bb65ae00420bf68b9954c
-  handlebars:
-    specifier: ^4.7.8
-    version: 4.7.8
+    version: github.com/DeterminateSystems/detsys-ts/bc45b6c0a6318ae30192c4bf23a73dc879bdb632
 
 devDependencies:
   '@trivago/prettier-plugin-sort-imports':
@@ -24,7 +21,7 @@ devDependencies:
     version: 4.3.0(prettier@3.2.5)
   '@typescript-eslint/eslint-plugin':
     specifier: ^7.11.0
-    version: 7.11.0(@typescript-eslint/parser@7.11.0)(eslint@8.57.0)(typescript@5.4.5)
+    version: 7.11.0(@typescript-eslint/parser@7.12.0)(eslint@8.57.0)(typescript@5.4.5)
   '@vercel/ncc':
     specifier: ^0.38.1
     version: 0.38.1
@@ -33,13 +30,13 @@ devDependencies:
     version: 8.57.0
   eslint-import-resolver-typescript:
     specifier: ^3.6.1
-    version: 3.6.1(@typescript-eslint/parser@7.11.0)(eslint-plugin-import@2.29.1)(eslint@8.57.0)
+    version: 3.6.1(@typescript-eslint/parser@7.12.0)(eslint-plugin-import@2.29.1)(eslint@8.57.0)
   eslint-plugin-github:
     specifier: ^4.10.2
     version: 4.10.2(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0)(typescript@5.4.5)
   eslint-plugin-import:
     specifier: ^2.29.1
-    version: 2.29.1(@typescript-eslint/parser@7.11.0)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0)
+    version: 2.29.1(@typescript-eslint/parser@7.12.0)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0)
   eslint-plugin-prettier:
     specifier: ^5.1.3
     version: 5.1.3(eslint-config-prettier@9.1.0)(eslint@8.57.0)(prettier@3.2.5)
@@ -1148,6 +1145,33 @@ packages:
       - supports-color
     dev: true
 
+  /@typescript-eslint/eslint-plugin@7.11.0(@typescript-eslint/parser@7.12.0)(eslint@8.57.0)(typescript@5.4.5):
+    resolution: {integrity: sha512-P+qEahbgeHW4JQ/87FuItjBj8O3MYv5gELDzr8QaQ7fsll1gSMTYb6j87MYyxwf3DtD7uGFB9ShwgmCJB5KmaQ==}
+    engines: {node: ^18.18.0 || >=20.0.0}
+    peerDependencies:
+      '@typescript-eslint/parser': ^7.0.0
+      eslint: ^8.56.0
+      typescript: '*'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+    dependencies:
+      '@eslint-community/regexpp': 4.10.0
+      '@typescript-eslint/parser': 7.12.0(eslint@8.57.0)(typescript@5.4.5)
+      '@typescript-eslint/scope-manager': 7.11.0
+      '@typescript-eslint/type-utils': 7.11.0(eslint@8.57.0)(typescript@5.4.5)
+      '@typescript-eslint/utils': 7.11.0(eslint@8.57.0)(typescript@5.4.5)
+      '@typescript-eslint/visitor-keys': 7.11.0
+      eslint: 8.57.0
+      graphemer: 1.4.0
+      ignore: 5.3.1
+      natural-compare: 1.4.0
+      ts-api-utils: 1.3.0(typescript@5.4.5)
+      typescript: 5.4.5
+    transitivePeerDependencies:
+      - supports-color
+    dev: true
+
   /@typescript-eslint/parser@7.11.0(eslint@8.57.0)(typescript@5.4.5):
     resolution: {integrity: sha512-yimw99teuaXVWsBcPO1Ais02kwJ1jmNA1KxE7ng0aT7ndr1pT1wqj0OJnsYVGKKlc4QJai86l/025L6z8CljOg==}
     engines: {node: ^18.18.0 || >=20.0.0}
@@ -1169,6 +1193,27 @@ packages:
       - supports-color
     dev: true
 
+  /@typescript-eslint/parser@7.12.0(eslint@8.57.0)(typescript@5.4.5):
+    resolution: {integrity: sha512-dm/J2UDY3oV3TKius2OUZIFHsomQmpHtsV0FTh1WO8EKgHLQ1QCADUqscPgTpU+ih1e21FQSRjXckHn3txn6kQ==}
+    engines: {node: ^18.18.0 || >=20.0.0}
+    peerDependencies:
+      eslint: ^8.56.0
+      typescript: '*'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+    dependencies:
+      '@typescript-eslint/scope-manager': 7.12.0
+      '@typescript-eslint/types': 7.12.0
+      '@typescript-eslint/typescript-estree': 7.12.0(typescript@5.4.5)
+      '@typescript-eslint/visitor-keys': 7.12.0
+      debug: 4.3.5
+      eslint: 8.57.0
+      typescript: 5.4.5
+    transitivePeerDependencies:
+      - supports-color
+    dev: true
+
   /@typescript-eslint/scope-manager@7.11.0:
     resolution: {integrity: sha512-27tGdVEiutD4POirLZX4YzT180vevUURJl4wJGmm6TrQoiYwuxTIY98PBp6L2oN+JQxzE0URvYlzJaBHIekXAw==}
     engines: {node: ^18.18.0 || >=20.0.0}
@@ -1177,6 +1222,14 @@ packages:
       '@typescript-eslint/visitor-keys': 7.11.0
     dev: true
 
+  /@typescript-eslint/scope-manager@7.12.0:
+    resolution: {integrity: sha512-itF1pTnN6F3unPak+kutH9raIkL3lhH1YRPGgt7QQOh43DQKVJXmWkpb+vpc/TiDHs6RSd9CTbDsc/Y+Ygq7kg==}
+    engines: {node: ^18.18.0 || >=20.0.0}
+    dependencies:
+      '@typescript-eslint/types': 7.12.0
+      '@typescript-eslint/visitor-keys': 7.12.0
+    dev: true
+
   /@typescript-eslint/type-utils@7.11.0(eslint@8.57.0)(typescript@5.4.5):
     resolution: {integrity: sha512-WmppUEgYy+y1NTseNMJ6mCFxt03/7jTOy08bcg7bxJJdsM4nuhnchyBbE8vryveaJUf62noH7LodPSo5Z0WUCg==}
     engines: {node: ^18.18.0 || >=20.0.0}
@@ -1202,6 +1255,11 @@ packages:
     engines: {node: ^18.18.0 || >=20.0.0}
     dev: true
 
+  /@typescript-eslint/types@7.12.0:
+    resolution: {integrity: sha512-o+0Te6eWp2ppKY3mLCU+YA9pVJxhUJE15FV7kxuD9jgwIAa+w/ycGJBMrYDTpVGUM/tgpa9SeMOugSabWFq7bg==}
+    engines: {node: ^18.18.0 || >=20.0.0}
+    dev: true
+
   /@typescript-eslint/typescript-estree@7.11.0(typescript@5.4.5):
     resolution: {integrity: sha512-cxkhZ2C/iyi3/6U9EPc5y+a6csqHItndvN/CzbNXTNrsC3/ASoYQZEt9uMaEp+xFNjasqQyszp5TumAVKKvJeQ==}
     engines: {node: ^18.18.0 || >=20.0.0}
@@ -1224,6 +1282,28 @@ packages:
       - supports-color
     dev: true
 
+  /@typescript-eslint/typescript-estree@7.12.0(typescript@5.4.5):
+    resolution: {integrity: sha512-5bwqLsWBULv1h6pn7cMW5dXX/Y2amRqLaKqsASVwbBHMZSnHqE/HN4vT4fE0aFsiwxYvr98kqOWh1a8ZKXalCQ==}
+    engines: {node: ^18.18.0 || >=20.0.0}
+    peerDependencies:
+      typescript: '*'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+    dependencies:
+      '@typescript-eslint/types': 7.12.0
+      '@typescript-eslint/visitor-keys': 7.12.0
+      debug: 4.3.5
+      globby: 11.1.0
+      is-glob: 4.0.3
+      minimatch: 9.0.4
+      semver: 7.6.2
+      ts-api-utils: 1.3.0(typescript@5.4.5)
+      typescript: 5.4.5
+    transitivePeerDependencies:
+      - supports-color
+    dev: true
+
   /@typescript-eslint/utils@7.11.0(eslint@8.57.0)(typescript@5.4.5):
     resolution: {integrity: sha512-xlAWwPleNRHwF37AhrZurOxA1wyXowW4PqVXZVUNCLjB48CqdPJoJWkrpH2nij9Q3Lb7rtWindtoXwxjxlKKCA==}
     engines: {node: ^18.18.0 || >=20.0.0}
@@ -1248,6 +1328,14 @@ packages:
       eslint-visitor-keys: 3.4.3
     dev: true
 
+  /@typescript-eslint/visitor-keys@7.12.0:
+    resolution: {integrity: sha512-uZk7DevrQLL3vSnfFl5bj4sL75qC9D6EdjemIdbtkuUmIheWpuiiylSY01JxJE7+zGrOWDZrp1WxOuDntvKrHQ==}
+    engines: {node: ^18.18.0 || >=20.0.0}
+    dependencies:
+      '@typescript-eslint/types': 7.12.0
+      eslint-visitor-keys: 3.4.3
+    dev: true
+
   /@ungap/structured-clone@1.2.0:
     resolution: {integrity: sha512-zuVdFrMJiuCDQUMCzQaD6KL28MjnqqN8XnAqiEq9PNm/hCPTSGfrXCOfwj1ow4LFb/tNymJPwsNbVePc1xFqrQ==}
     dev: true
@@ -2045,7 +2133,7 @@ packages:
       - supports-color
     dev: true
 
-  /eslint-import-resolver-typescript@3.6.1(@typescript-eslint/parser@7.11.0)(eslint-plugin-import@2.29.1)(eslint@8.57.0):
+  /eslint-import-resolver-typescript@3.6.1(@typescript-eslint/parser@7.12.0)(eslint-plugin-import@2.29.1)(eslint@8.57.0):
     resolution: {integrity: sha512-xgdptdoi5W3niYeuQxKmzVDTATvLYqhpwmykwsh7f6HIOStGWEIL9iqZgQDF9u9OEzrRwR8no5q2VT+bjAujTg==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
@@ -2055,8 +2143,8 @@ packages:
       debug: 4.3.5
       enhanced-resolve: 5.16.1
       eslint: 8.57.0
-      eslint-module-utils: 2.8.1(@typescript-eslint/parser@7.11.0)(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0)
-      eslint-plugin-import: 2.29.1(@typescript-eslint/parser@7.11.0)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0)
+      eslint-module-utils: 2.8.1(@typescript-eslint/parser@7.12.0)(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0)
+      eslint-plugin-import: 2.29.1(@typescript-eslint/parser@7.12.0)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0)
       fast-glob: 3.3.2
       get-tsconfig: 4.7.5
       is-core-module: 2.13.1
@@ -2093,7 +2181,37 @@ packages:
       debug: 3.2.7
       eslint: 8.57.0
       eslint-import-resolver-node: 0.3.9
-      eslint-import-resolver-typescript: 3.6.1(@typescript-eslint/parser@7.11.0)(eslint-plugin-import@2.29.1)(eslint@8.57.0)
+      eslint-import-resolver-typescript: 3.6.1(@typescript-eslint/parser@7.12.0)(eslint-plugin-import@2.29.1)(eslint@8.57.0)
+    transitivePeerDependencies:
+      - supports-color
+    dev: true
+
+  /eslint-module-utils@2.8.1(@typescript-eslint/parser@7.12.0)(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0):
+    resolution: {integrity: sha512-rXDXR3h7cs7dy9RNpUlQf80nX31XWJEyGq1tRMo+6GsO5VmTe4UTwtmonAD4ZkAsrfMVDA2wlGJ3790Ys+D49Q==}
+    engines: {node: '>=4'}
+    peerDependencies:
+      '@typescript-eslint/parser': '*'
+      eslint: '*'
+      eslint-import-resolver-node: '*'
+      eslint-import-resolver-typescript: '*'
+      eslint-import-resolver-webpack: '*'
+    peerDependenciesMeta:
+      '@typescript-eslint/parser':
+        optional: true
+      eslint:
+        optional: true
+      eslint-import-resolver-node:
+        optional: true
+      eslint-import-resolver-typescript:
+        optional: true
+      eslint-import-resolver-webpack:
+        optional: true
+    dependencies:
+      '@typescript-eslint/parser': 7.12.0(eslint@8.57.0)(typescript@5.4.5)
+      debug: 3.2.7
+      eslint: 8.57.0
+      eslint-import-resolver-node: 0.3.9
+      eslint-import-resolver-typescript: 3.6.1(@typescript-eslint/parser@7.12.0)(eslint-plugin-import@2.29.1)(eslint@8.57.0)
     transitivePeerDependencies:
       - supports-color
     dev: true
@@ -2205,6 +2323,41 @@ packages:
       - supports-color
     dev: true
 
+  /eslint-plugin-import@2.29.1(@typescript-eslint/parser@7.12.0)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0):
+    resolution: {integrity: sha512-BbPC0cuExzhiMo4Ff1BTVwHpjjv28C5R+btTOGaCRC7UEz801up0JadwkeSk5Ued6TG34uaczuVuH6qyy5YUxw==}
+    engines: {node: '>=4'}
+    peerDependencies:
+      '@typescript-eslint/parser': '*'
+      eslint: ^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0 || ^8
+    peerDependenciesMeta:
+      '@typescript-eslint/parser':
+        optional: true
+    dependencies:
+      '@typescript-eslint/parser': 7.12.0(eslint@8.57.0)(typescript@5.4.5)
+      array-includes: 3.1.8
+      array.prototype.findlastindex: 1.2.5
+      array.prototype.flat: 1.3.2
+      array.prototype.flatmap: 1.3.2
+      debug: 3.2.7
+      doctrine: 2.1.0
+      eslint: 8.57.0
+      eslint-import-resolver-node: 0.3.9
+      eslint-module-utils: 2.8.1(@typescript-eslint/parser@7.12.0)(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.6.1)(eslint@8.57.0)
+      hasown: 2.0.2
+      is-core-module: 2.13.1
+      is-glob: 4.0.3
+      minimatch: 3.1.2
+      object.fromentries: 2.0.8
+      object.groupby: 1.0.3
+      object.values: 1.2.0
+      semver: 6.3.1
+      tsconfig-paths: 3.15.0
+    transitivePeerDependencies:
+      - eslint-import-resolver-typescript
+      - eslint-import-resolver-webpack
+      - supports-color
+    dev: true
+
   /eslint-plugin-jsx-a11y@6.8.0(eslint@8.57.0):
     resolution: {integrity: sha512-Hdh937BS3KdwwbBaKd5+PLCOmYY6U4f2h9Z2ktwtNKvIdIEu137rjYbcb9ApSbVJfWxANNuiKTD/9tOKjK9qOA==}
     engines: {node: '>=4.0'}
@@ -2658,8 +2811,8 @@ packages:
       get-intrinsic: 1.2.4
     dev: true
 
-  /got@14.3.0:
-    resolution: {integrity: sha512-vZkrXdq5BtPWTXqvjXSpl6zky3zpHaOVfSug/RfFHu3YrtSsvYzopVMDqrh2do77WnGoCSSRCHW25zXOSAQ9zw==}
+  /got@14.4.0:
+    resolution: {integrity: sha512-baa2HMfREJ9UQSXOPwWe0DNK+FT8Okcxe9kmTJvaetv2q/MUxq0qFzEnfSbxo+wj45/QioGcH5ZhuT9VBIPJ5Q==}
     engines: {node: '>=20'}
     dependencies:
       '@sindresorhus/is': 6.3.1
@@ -2683,19 +2836,6 @@ packages:
     resolution: {integrity: sha512-EtKwoO6kxCL9WO5xipiHTZlSzBm7WLT627TqC/uVRd0HKmq8NXyebnNYxDoBi7wt8eTWrUrKXCOVaFq9x1kgag==}
     dev: true
 
-  /handlebars@4.7.8:
-    resolution: {integrity: sha512-vafaFqs8MZkRrSX7sFVUdo3ap/eNiLnb4IakshzvP56X5Nr1iGKAIqdX6tMlm6HcNRIkr6AxO5jFEoJzzpT8aQ==}
-    engines: {node: '>=0.4.7'}
-    hasBin: true
-    dependencies:
-      minimist: 1.2.8
-      neo-async: 2.6.2
-      source-map: 0.6.1
-      wordwrap: 1.0.0
-    optionalDependencies:
-      uglify-js: 3.17.4
-    dev: false
-
   /has-bigints@1.0.2:
     resolution: {integrity: sha512-tSvCKtBr9lkF0Ex0aQiP9N+OpV4zi2r/Nee5VkRDbaqv35RLYMzbwQfFSZZH0kR+Rd6302UJZ2p/bJCEoR3VoQ==}
     dev: true
@@ -3245,6 +3385,7 @@ packages:
 
   /minimist@1.2.8:
     resolution: {integrity: sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==}
+    dev: true
 
   /minipass@7.1.2:
     resolution: {integrity: sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==}
@@ -3286,10 +3427,6 @@ packages:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
     dev: true
 
-  /neo-async@2.6.2:
-    resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==}
-    dev: false
-
   /node-fetch@2.7.0:
     resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
     engines: {node: 4.x || >=6.0.0}
@@ -3821,11 +3958,6 @@ packages:
     engines: {node: '>=0.10.0'}
     dev: true
 
-  /source-map@0.6.1:
-    resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==}
-    engines: {node: '>=0.10.0'}
-    dev: false
-
   /source-map@0.8.0-beta.0:
     resolution: {integrity: sha512-2ymg6oRBpebeZi9UUNsgQ89bhx01TcTkmNTGnNO88imTmbSgy4nfujrgVEFKWpMTEGA11EDkTt7mqObTPdigIA==}
     engines: {node: '>= 8'}
@@ -4124,6 +4256,11 @@ packages:
     engines: {node: '>=10'}
     dev: true
 
+  /type-fest@4.19.0:
+    resolution: {integrity: sha512-CN2l+hWACRiejlnr68vY0/7734Kzu+9+TOslUXbSCQ1ruY9XIHDBSceVXCcHm/oXrdzhtLMMdJEKfemf1yXiZQ==}
+    engines: {node: '>=16'}
+    dev: false
+
   /typed-array-buffer@1.0.2:
     resolution: {integrity: sha512-gEymJYKZtKXzzBzM4jqa9w6Q1Jjm7x2d+sh19AdsD4wqnMPDYyvwpsIc2Q/835kHuo3BEQ7CjelGhfTsoBb2MQ==}
     engines: {node: '>= 0.4'}
@@ -4178,14 +4315,6 @@ packages:
     resolution: {integrity: sha512-Y7HYmWaFwPUmkoQCUIAYpKqkOf+SbVj/2fJJZ4RJMCfZp0rTGwRbzQD+HghfnhKOjL9E01okqz+ncJskGYfBNw==}
     dev: true
 
-  /uglify-js@3.17.4:
-    resolution: {integrity: sha512-T9q82TJI9e/C1TAxYvfb16xO120tMVFZrGA3f9/P4424DNu6ypK103y0GPFVa17yotwSyZW5iYXgjYHkGrJW/g==}
-    engines: {node: '>=0.8.0'}
-    hasBin: true
-    requiresBuild: true
-    dev: false
-    optional: true
-
   /unbox-primitive@1.0.2:
     resolution: {integrity: sha512-61pPlCD9h51VoreyJ0BReideM3MDKMKnh6+V9L08331ipq6Q8OFXZYiqP6n/tbHx4s5I9uRhcye6BrbkizkBDw==}
     dependencies:
@@ -4439,10 +4568,6 @@ packages:
     engines: {node: '>=0.10.0'}
     dev: true
 
-  /wordwrap@1.0.0:
-    resolution: {integrity: sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==}
-    dev: false
-
   /wrap-ansi@7.0.0:
     resolution: {integrity: sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==}
     engines: {node: '>=10'}
@@ -4494,15 +4619,16 @@ packages:
     engines: {node: '>=12.20'}
     dev: true
 
-  github.com/DeterminateSystems/detsys-ts/fe64ba33b4bdeec0991bb65ae00420bf68b9954c:
-    resolution: {tarball: https://codeload.github.com/DeterminateSystems/detsys-ts/tar.gz/fe64ba33b4bdeec0991bb65ae00420bf68b9954c}
+  github.com/DeterminateSystems/detsys-ts/bc45b6c0a6318ae30192c4bf23a73dc879bdb632:
+    resolution: {tarball: https://codeload.github.com/DeterminateSystems/detsys-ts/tar.gz/bc45b6c0a6318ae30192c4bf23a73dc879bdb632}
     name: detsys-ts
     version: 1.0.0
     dependencies:
       '@actions/cache': 3.2.4
       '@actions/core': 1.10.1
       '@actions/exec': 1.1.1
-      got: 14.3.0
+      got: 14.4.0
+      type-fest: 4.19.0
     transitivePeerDependencies:
       - encoding
     dev: false

src/index.ts

@@ -1,26 +1,15 @@
 import { makeNixCommandArgs } from "./nix.js";
-import { renderCommitMessage, renderPullRequestBody } from "./template.js";
 import * as actionsCore from "@actions/core";
 import * as actionsExec from "@actions/exec";
 import { DetSysAction, inputs } from "detsys-ts";
-import * as fs from "fs";
-
-const DEFAULT_FLAKE_DIR = ".";
-
-const PR_BODY_OUTPUT_KEY = "pr-body";
 
 const EVENT_EXECUTION_FAILURE = "execution_failure";
 
 class UpdateFlakeLockAction extends DetSysAction {
   private commitMessage: string;
-  private commitMessageTemplate: string;
-  private prBody: string;
-  private prBodyTemplate: string;
   private nixOptions: string[];
   private flakeInputs: string[];
   private pathToFlakeDir: string | null;
-  private flakeDirsInput: string[] | null;
-  private flakeDirs: string[];
 
   constructor() {
     super({
@@ -30,55 +19,19 @@ class UpdateFlakeLockAction extends DetSysAction {
     });
 
     this.commitMessage = inputs.getString("commit-msg");
-    this.commitMessageTemplate = inputs.getString("commit-msg-template");
-    this.prBody = inputs.getString("pr-body");
-    this.prBodyTemplate = inputs.getString("pr-body-template");
     this.flakeInputs = inputs.getArrayOfStrings("inputs", "space");
     this.nixOptions = inputs.getArrayOfStrings("nix-options", "space");
     this.pathToFlakeDir = inputs.getStringOrNull("path-to-flake-dir");
-    this.flakeDirsInput = inputs.getArrayOfStringsOrNull("flake-dirs", "space");
-
-    this.validateInputs();
-
-    if (this.flakeDirsInput !== null && this.flakeDirsInput.length > 0) {
-      this.flakeDirs = this.flakeDirsInput;
-    } else {
-      this.flakeDirs = [this.pathToFlakeDir ?? DEFAULT_FLAKE_DIR];
-    }
   }
 
   async main(): Promise<void> {
-    for (const directory of this.flakeDirs) {
-      await this.updateFlakeInDirectory(directory);
-    }
-
-    const prBody =
-      this.prBody !== ""
-        ? this.prBody
-        : renderPullRequestBody(this.prBodyTemplate, this.flakeDirs);
-
-    actionsCore.setOutput(PR_BODY_OUTPUT_KEY, prBody);
+    await this.update();
   }
 
   // No post phase
   async post(): Promise<void> {}
 
-  private async updateFlakeInDirectory(flakeDir: string): Promise<void> {
-    this.ensureDirectoryExists(flakeDir);
-    this.ensureDirectoryIsFlake(flakeDir);
-
-    actionsCore.debug(`Running flake lock update in directory \`${flakeDir}\``);
-
-    const flakeDotLock = `${flakeDir}/flake.lock`;
-    const commitMessage =
-      this.commitMessage !== ""
-        ? this.commitMessage
-        : renderCommitMessage(
-            this.commitMessageTemplate,
-            flakeDir,
-            flakeDotLock,
-          );
-
+  async update(): Promise<void> {
     // Nix command of this form:
     // nix ${maybe nix options} flake ${"update" or "lock"} ${maybe --update-input flags} --commit-lock-file --commit-lockfile-summary ${commit message}
     // Example commands:
@@ -87,12 +40,11 @@ class UpdateFlakeLockAction extends DetSysAction {
     const nixCommandArgs: string[] = makeNixCommandArgs(
       this.nixOptions,
       this.flakeInputs,
-      commitMessage,
+      this.commitMessage,
     );
 
     actionsCore.debug(
       JSON.stringify({
-        directory: flakeDir,
         options: this.nixOptions,
         inputs: this.flakeInputs,
         message: this.commitMessage,
@@ -101,7 +53,7 @@ class UpdateFlakeLockAction extends DetSysAction {
     );
 
     const execOptions: actionsExec.ExecOptions = {
-      cwd: flakeDir,
+      cwd: this.pathToFlakeDir !== null ? this.pathToFlakeDir : undefined,
     };
 
     const exitCode = await actionsExec.exec("nix", nixCommandArgs, execOptions);
@@ -110,69 +62,9 @@ class UpdateFlakeLockAction extends DetSysAction {
       this.recordEvent(EVENT_EXECUTION_FAILURE, {
         exitCode,
       });
-      actionsCore.setFailed(
-        `non-zero exit code of ${exitCode} detected while updating directory \`${flakeDir}\``,
-      );
+      actionsCore.setFailed(`non-zero exit code of ${exitCode} detected`);
     } else {
-      actionsCore.info(
-        `flake.lock file in \`${flakeDir}\` was successfully updated`,
-      );
-    }
-  }
-
-  private validateInputs(): void {
-    // Ensure that either `path-to-flake-dir` or `flake-dirs` is set to a meaningful value but not both
-    if (
-      this.flakeDirsInput !== null &&
-      this.flakeDirsInput.length > 0 &&
-      this.pathToFlakeDir !== null &&
-      this.pathToFlakeDir !== ""
-    ) {
-      throw new Error(
-        "Both `path-to-flake-dir` and `flake-dirs` are set, whereas only one can be",
-      );
-    }
-
-    // Ensure that `flake-dirs` isn't an empty array if set
-    if (this.flakeDirsInput !== null && this.flakeDirsInput.length === 0) {
-      throw new Error(
-        "The `flake-dirs` input is set to an empty array; it must contain at least one directory",
-      );
-    }
-
-    // Ensure that both `flake-dirs` and `inputs` aren't set at the same time
-    if (
-      this.flakeDirsInput !== null &&
-      this.flakeDirsInput.length > 0 &&
-      this.flakeInputs.length > 0
-    ) {
-      throw new Error(
-        `You've set both \`flake-dirs\` and \`inputs\` but you can only set one`,
-      );
-    }
-  }
-
-  private ensureDirectoryExists(flakeDir: string): void {
-    actionsCore.debug(`Checking that flake directory \`${flakeDir}\` exists`);
-
-    // Ensure the directory exists
-    fs.access(flakeDir, fs.constants.F_OK, (err) => {
-      if (err !== null) {
-        throw new Error(`Directory \`${flakeDir}\` doesn't exist`);
-      } else {
-        actionsCore.debug(`Flake directory \`${flakeDir}\` exists`);
-      }
-    });
-  }
-
-  private ensureDirectoryIsFlake(flakeDir: string): void {
-    const flakeDotNix = `${flakeDir}/flake.nix`;
-    if (!fs.existsSync(flakeDotNix)) {
-      throw new Error(
-        `Directory \`${flakeDir}\` is not a valid flake as it doesn't contain a \`flake.nix\``,
-      );
-    } else {
-      actionsCore.debug(`Directory \`${flakeDir}\` is a valid flake`);
+      actionsCore.info(`flake.lock file was successfully updated`);
     }
   }
 }

src/nix.test.ts

@@ -1,16 +1,16 @@
 import { makeNixCommandArgs } from "./nix.js";
 import { expect, test } from "vitest";
 
-test("Nix command arguments", () => {
-  type TestCase = {
+type TestCase = {
   inputs: {
     nixOptions: string[];
     flakeInputs: string[];
     commitMessage: string;
   };
   expected: string[];
-  };
+};
 
+test("Nix command arguments", () => {
   const testCases: TestCase[] = [
     {
       inputs: {
@@ -24,7 +24,8 @@ test("Nix command arguments", () => {
         "flake",
         "update",
         "--commit-lock-file",
-        "--commit-lockfile-summary",
+        "--option",
+        "commit-lockfile-summary",
         "just testing",
       ],
     },
@@ -42,7 +43,8 @@ test("Nix command arguments", () => {
         "--update-input",
         "rust-overlay",
         "--commit-lock-file",
-        "--commit-lockfile-summary",
+        "--option",
+        "commit-lockfile-summary",
         "just testing",
       ],
     },
@@ -57,7 +59,8 @@ test("Nix command arguments", () => {
         "flake",
         "update",
         "--commit-lock-file",
-        "--commit-lockfile-summary",
+        "--option",
+        "commit-lockfile-summary",
         "just testing",
       ],
     },

src/nix.ts

@@ -9,10 +9,23 @@ export function makeNixCommandArgs(
     input,
   ]);
 
+  // NOTE(cole-h): In Nix versions 2.23.0 and later, `commit-lockfile-summary` became an alias to
+  // the setting `commit-lock-file-summary` (https://github.com/NixOS/nix/pull/10691), and Nix does
+  // not treat aliases the same as their "real" setting by requiring setting aliases to be
+  // configured via `--option <alias name> <option value>`
+  // (https://github.com/NixOS/nix/issues/10989).
+  // So, we go the long way so that we can support versions both before and after Nix 2.23.0.
+  const lockfileSummaryFlags = [
+    "--option",
+    "commit-lockfile-summary",
+    commitMessage,
+  ];
+
   const updateLockMechanism = flakeInputFlags.length === 0 ? "update" : "lock";
 
   return nixOptions
     .concat(["flake", updateLockMechanism])
     .concat(flakeInputFlags)
-    .concat(["--commit-lock-file", "--commit-lockfile-summary", commitMessage]);
+    .concat(["--commit-lock-file"])
+    .concat(lockfileSummaryFlags);
 }

src/template.test.ts

@@ -1,75 +0,0 @@
-import { renderCommitMessage, renderPullRequestBody } from "./template.js";
-import { template } from "handlebars";
-import { Test, describe, expect, test } from "vitest";
-
-describe("templating", () => {
-  test("commit message", () => {
-    type TestCase = {
-      template: string;
-      flakeDotLockDir: string;
-      flakeDotLock: string;
-      expected: string;
-    };
-
-    const testCases: TestCase[] = [
-      {
-        template: "Updating flake.lock in dir {{ flake_dot_lock_dir }}",
-        flakeDotLockDir: ".",
-        flakeDotLock: "./flake.lock",
-        expected: "Updating flake.lock in dir .",
-      },
-      {
-        template:
-          "Here I go doing some updating of my pristine flake.lock at {{ flake_dot_lock }}",
-        flakeDotLockDir: "subflake",
-        flakeDotLock: "subflake/flake.lock",
-        expected:
-          "Here I go doing some updating of my pristine flake.lock at subflake/flake.lock",
-      },
-      {
-        template: "This variable doesn't exist: {{ foo }}",
-        flakeDotLockDir: ".",
-        flakeDotLock: "./flake.lock",
-        expected: "This variable doesn't exist: ",
-      },
-    ];
-
-    testCases.forEach(
-      ({ template, flakeDotLockDir, flakeDotLock, expected }) => {
-        expect(
-          renderCommitMessage(template, flakeDotLockDir, flakeDotLock),
-        ).toEqual(expected);
-      },
-    );
-  });
-
-  test("pull request body", () => {
-    type TestCase = {
-      template: string;
-      dirs: string[];
-      expected: string;
-    };
-
-    const testCases: TestCase[] = [
-      {
-        template: "Updated inputs: {{ comma_separated_dirs }}",
-        dirs: ["."],
-        expected: "Updated inputs: .",
-      },
-      {
-        template: "Updated inputs: {{ space_separated_dirs }}",
-        dirs: ["subflake", "subflake2"],
-        expected: "Updated inputs: subflake subflake2",
-      },
-      {
-        template: "Updated inputs:\n{{ updated_dirs_list }}",
-        dirs: ["flake1", "flake2"],
-        expected: `Updated inputs:\n* flake1\n* flake2`,
-      },
-    ];
-
-    testCases.forEach(({ template, dirs, expected }) => {
-      expect(renderPullRequestBody(template, dirs)).toEqual(expected);
-    });
-  });
-});

src/template.ts

@@ -1,39 +0,0 @@
-import Handlebars from "handlebars";
-
-export function renderPullRequestBody(
-  template: string,
-  dirs: string[],
-): string {
-  const commaSeparated = dirs.join(", ");
-  const spaceSeparated = dirs.join(" ");
-  const dirsList = dirs.map((d: string) => `* ${d}`).join("\n");
-
-  const tpl = Handlebars.compile(template);
-
-  return tpl({
-    // eslint-disable-next-line camelcase
-    comma_separated_dirs: commaSeparated,
-    // eslint-disable-next-line camelcase
-    space_separated_dirs: spaceSeparated,
-    // eslint-disable-next-line camelcase
-    updated_dirs_list: dirsList,
-  });
-}
-
-export function renderCommitMessage(
-  template: string,
-  flakeDotLockDir: string,
-  flakeDotLock: string,
-): string {
-  return render(template, {
-    // eslint-disable-next-line camelcase
-    flake_dot_lock_dir: flakeDotLockDir,
-    // eslint-disable-next-line camelcase
-    flake_dot_lock: flakeDotLock,
-  });
-}
-
-function render(template: string, inputs: Record<string, string>): string {
-  const tpl = Handlebars.compile(template);
-  return tpl(inputs);
-}