feat(ci): add gha workflow to update the flake lockfile

[cameronraysmith]

• reveal root cause of
  • flake-parts is an undeclared input to the top-level and all language template flakes #96 (comment)
• add gha workflow to submit a PR to update the flake lockfile
  • PR will allow other workflows to check that the flake inputs from the lockfile can be safely updated without breaking functionality

[cameronraysmith]

You can see the (currently) expected CI failure here

https://github.com/cameronraysmith/kickstart.nix/actions/runs/13485402825/job/37675910664

[cameronraysmith]

I primarily did this to check that the lockfile was not previously updatable without access to flake registries.
No worries if you don't want to merge third-party PRs on actions workflows or if you don't want this thing making noise in your PRs. I sometimes find it useful just as a notifier when nixpkgs and, in this case, flake-parts receive updates.

In any case, rebasing this branch after #97 and #100, this workflow now succeeds as expected and successfully submitted this PR on my fork to merge the updated lockfile https://github.com/cameronraysmith/kickstart.nix/pull/4/files

https://github.com/cameronraysmith/kickstart.nix/actions/runs/13512065709/job/37754033555

The force-push following this note will remove the actions push targeting my PR branch, which you wouldn't want to retain in the upstream. It will also have workfow dispatch enabled to support manually triggering the lockfile update.

[hbjydev]

Hiya,

It needs some tweaking, but we'd rather do this via Renovate like we do for our other projects. Current config is here:
https://github.com/ALT-F4-LLC/kickstart.nix/blob/main/.github/renovate.json

I appreciate the PR, and I hope this doesn't discourage you from further contributions to Kickstart.nix, but I'm going to decline this one for now.

If you want to take a look at our Renovate setup and find improvements there, feel free though!

[cameronraysmith]

Renovate is a reasonable way to manage the lockfile, but do you think it's working since you've never received/merged a PR

https://github.com/ALT-F4-LLC/kickstart.nix/pulls?q=is%3Apr+author%3Aapp%2Frenovate+%28flake+OR+lock%29

over the course of 9 months

d40103f?

Moreover, you'd have to pass a custom command to address #98 (comment). But I would certainly recommend verifying renovate is working as expected over adding another github actions workflow to maintain. As I said, I only added it to test #97 and #100 on my fork and illustrate that flake.lock was previously not updatable in an environment that doesn't have access to a flake registry that includes a compatible entry for flake-parts.

It may be that the difference between #98 (comment) and #98 (comment) will allow renovate to successfully update the flake.lock going forward; although, it'd be somewhat surprising if it had been failing silently before these updates.

[cameronraysmith]

Originally posted by @hbjydev in #98 (comment)

we'd rather do this via Renovate like we do for our other projects. Current config is here: https://github.com/ALT-F4-LLC/kickstart.nix/blob/main/.github/renovate.json

renovatebot/renovate#29721
renovatebot/renovate#29706

This is one of the reasons most nix repos in the wild use both renovate and a separate gha workflow to update the flake lockfile, but should become irrelevant if renovate eventually resolves the problems like 29721 and possibly others that are related to unreliable updates of flake lockfiles.