Nix-Vibe/.github/skills/flake-update/SKILL.md

name, description

name	description
flake-update	Safely update flake inputs: ensure a clean committed/pushed working tree, run nix flake update, then dry-build EVERY host before committing flake.lock. Use when the user asks to update the flake, refresh flake.lock, bump inputs, or upgrade nixpkgs/dependencies.

Flake Update

When to Use

• When the user asks to "update the flake", "bump inputs", "refresh flake.lock", or "update nixpkgs"
• Before a planned fleet-wide input upgrade

Procedure

1. Clean Working Tree (MANDATORY)

Never run nix flake update with uncommitted changes — mixing unrelated edits with a lockfile bump makes rollback painful.

git status

• If there are uncommitted changes: validate and commit them first (follow the nix-flake-rebuild skill: stage, nixpkgs-fmt ., nix flake check, dry-build affected hosts, commit).
• Then push everything to the remote:

git push

Only proceed when git status is clean and the branch is fully pushed.

2. Update Inputs

# All inputs
nix flake update

# OR a single input, if the user asked for one
nix flake update <input-name>

3. Flake Check

nix flake check

Fix any evaluation errors before building. Input bumps often surface deprecated/renamed NixOS and Home Manager options — check warnings and refer to release notes for replacements.

4. Dry-Build EVERY Host

An input update affects the whole fleet — dry-build every host, no exceptions. Generate the host list dynamically from the flake so new hosts are never missed:

for host in $(nix eval .#nixosConfigurations --apply 'attrs: builtins.concatStringsSep " " (builtins.attrNames attrs)' --raw); do
  echo "=== $host ==="
  nixos-rebuild dry-build --flake .#$host || break
done

If any host fails, do NOT commit. Either fix the breakage or roll back (see below).

5. Commit & Push Lockfile (only if ALL hosts pass)

git add flake.lock
git commit -m "flake: update inputs"
git push

Rollback

Because step 1 guaranteed a clean, pushed tree, the previous lockfile is always recoverable:

git restore --source=HEAD~1 flake.lock

Or check out an older known-good lockfile from history.

Notes

• This skill only validates the update. Actually applying it (nixos-rebuild switch) is a separate, per-host step.
• Review the git diff flake.lock before committing if the user wants to know which inputs moved.