---
name: flake-update
description: 'Safely update flake inputs: ensure a clean committed/pushed working tree, run nix flake update, then dry-build EVERY host before committing flake.lock. Use when the user asks to update the flake, refresh flake.lock, bump inputs, or upgrade nixpkgs/dependencies.'
---

# Flake Update

## When to Use
- When the user asks to "update the flake", "bump inputs", "refresh flake.lock", or "update nixpkgs"
- Before a planned fleet-wide input upgrade

## Procedure

### 1. Clean Working Tree (MANDATORY)

Never run `nix flake update` with uncommitted changes — mixing unrelated edits with a lockfile bump makes rollback painful.

```bash
git status
```

- If there are uncommitted changes: validate and commit them first (follow the **nix-flake-rebuild** skill: stage, `nixpkgs-fmt .`, `nix flake check`, dry-build affected hosts, commit).
- Then push everything to the remote:

```bash
git push
```

Only proceed when `git status` is clean and the branch is fully pushed.

### 2. Update Inputs

```bash
# All inputs
nix flake update

# OR a single input, if the user asked for one
nix flake update <input-name>
```

### 3. Flake Check

```bash
nix flake check
```

Fix any evaluation errors before building. Input bumps often surface deprecated/renamed NixOS and Home Manager options — check warnings and refer to release notes for replacements.

### 4. Dry-Build EVERY Host

An input update affects the whole fleet — dry-build every host, no exceptions. Generate the host list dynamically from the flake so new hosts are never missed:

```bash
for host in $(nix eval .#nixosConfigurations --apply 'attrs: builtins.concatStringsSep " " (builtins.attrNames attrs)' --raw); do
  echo "=== $host ==="
  nixos-rebuild dry-build --flake .#$host || break
done
```

If any host fails, do NOT commit. Either fix the breakage or roll back (see below).

### 5. Commit & Push Lockfile (only if ALL hosts pass)

```bash
git add flake.lock
git commit -m "flake: update inputs"
git push
```

## Rollback

Because step 1 guaranteed a clean, pushed tree, the previous lockfile is always recoverable:

```bash
git restore --source=HEAD~1 flake.lock
```

Or check out an older known-good lockfile from history.

## Notes
- This skill only **validates** the update. Actually applying it (`nixos-rebuild switch`) is a separate, per-host step.
- Review the `git diff flake.lock` before committing if the user wants to know which inputs moved.