ci(github): comment the Nix flake environment diff on flake.lock PRs#9
Merged
jcardozo-eth merged 2 commits intoJul 15, 2026
Merged
Conversation
On every pull request that changes flake.lock, build the pinned dev-shell environment at the PR head and at the merge base, diff the two realized closures with nix store diff-closures, and upsert a single PR comment with the package-level delta. Later pushes edit that same comment in place; an unchanged environment posts nothing. Runs least-privilege (contents: read, pull-requests: write) with the built-in token and no repository secrets, so it also annotates Dependabot flake.lock bumps that otherwise render as an opaque hash change.
Add a CI/CD paragraph describing the flake.lock environment diff comment: what a reviewer gets from it and why it matters for Dependabot's weekly lock bumps, which otherwise land as an opaque hash change.
1 task
jcardozo-eth
deleted the
ci/comment-pr-on-nix-flake-lock-environment-diff
branch
July 15, 2026 17:43
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #7
Summary
Adds a workflow that shows what a Nix flake update actually changes. On any PR that touches
flake.lock, it builds the pinned dev-shell environment before and after the update and posts one PR comment listing which packages changed and to which versions, instead of the opaque hash change. The comment updates itself on later pushes and stays silent when the environment is effectively unchanged.Verification
just checkis green and the workflow passesyamllint .. Live behaviour will be verified after merge on the open Dependabot PR #5: the comment appears with the expected deltas, a@dependabot rebaseupdates the same comment in place with no duplicate, and a PR not touchingflake.locktriggers no run.Checklist
just checkgreen