Awesome

The Nix Flake Checker Action

This repo houses a Github Action from Determinate Systems that performs health checks on your repos' flake.lock files. Specifically, it wraps the Nix Flake Checker tool, which verifies that your root Nixpkgs inputs:

Have been updated within the last 30 days
Have the NixOS GitHub org as their owner
Are from a supported Git branch

Here's an example configuration that uses flake-checker-action as part of a broader Actions workflow involving Nix.

on:
  pull_request:
  push:
    branches: [main]

jobs:
  build:
    name: Build Nix targets
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v3
      - name: Check Nix flake inputs
        uses: DeterminateSystems/flake-checker-action@v4 # This action
      - name: Install Nix
        uses: DeterminateSystems/nix-installer-action@v3
      - name: Build default package
        run: nix build

Configuration

The Nix Flake Checker Action has a number of configuration parameters that you can set in the with block:

Parameter	Description	Default
`condition`	An optional Common Expression Language (CEL) condition expressing your flake policy. Supersedes all `check-*` parameters.
`flake-lock-path`	The path to the `flake.lock` file you want to check.	`flake.lock`
`check-outdated`	Whether to check that the root Nixpkgs input is less than 30 days old.	`true`
`check-owner`	Whether to check that the root Nixpkgs input has the `NixOS` GitHub org as its owner.	`true`
`check-supported`	Whether to check that the root Nixpkgs input has a supported Git ref. Currently supported refs: `nixos-22.11`, `nixos-22.11-small`, `nixos-23.05`, `nixos-23.05-small`, `nixos-unstable`, `nixos-unstable-small`, `nixpkgs-22.11-darwin`, `nixpkgs-23.05-darwin`, `nixpkgs-unstable`.	`true`
`nixpkgs-keys`	The names of the Nixpkgs inputs you want to check. By default the checker only checks the `nixpkgs` but you can specify multiple names as a comma-separated list, such as `nixpkgs,nixpkgs-macos,nixpkgs-unstable`.	`nixpkgs`
`ignore-missing-flake-lock`	Whether to ignore a missing `flake.lock` file, where the path to the file is the value of `flake-lock-path` parameter. If set to `false` (the default is `true`), the Action throws an error and the job fails if the lockfile is missing.	`true`
`fail-mode`	Fail with an exit code of 1 if any issues are encountered.	`false`
`send-statistics`	Anonymously report the number of issues detected by the flake checker. This reporting helps measure the effectiveness of the flake checker. Set to `false` to disable.	`true`

Here's an example non-default configuration:

- name: Check Nix flake inputs
  uses: DeterminateSystems/flake-checker-action@v2
  with:
    flake-lock-path: ./nix/flake.lock
    check-owner: false
    ignore-missing-flake-lock: false
    fail-mode: true