feat: gate updates behind vet supply-chain checksHEADmain

update now holds inputs and skills back by a cooldown, has Claude review
third-party diffs, and reports CVE changes before switching. Homebrew taps
are pinned through nix-homebrew, and npm/pnpm get install policies.

1 files changed, 48 insertions, 0 deletions

diff --git a/flake.nix b/flake.nix
index b23079e..d9004d0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -30,6 +30,28 @@
       url = "git+https://git.simenandre.no/skills";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+
+    nix-homebrew.url = "github:zhaofengli/nix-homebrew";
+
+    # Homebrew taps are pinned here so that tap updates land in flake.lock and
+    # go through vet like every other input. With homebrew-core pinned,
+    # nix-homebrew makes brew install from these instead of its JSON API.
+    homebrew-core = {
+      url = "github:homebrew/homebrew-core";
+      flake = false;
+    };
+    homebrew-cask = {
+      url = "github:homebrew/homebrew-cask";
+      flake = false;
+    };
+    homebrew-anomalyco = {
+      url = "github:anomalyco/homebrew-tap";
+      flake = false;
+    };
+    homebrew-simenandre = {
+      url = "github:simenandre/homebrew-tools";
+      flake = false;
+    };
   };
 
   outputs =
@@ -41,6 +63,11 @@
       config-nvim,
       dina,
       skills,
+      nix-homebrew,
+      homebrew-core,
+      homebrew-cask,
+      homebrew-anomalyco,
+      homebrew-simenandre,
     }:
     let
       # flakeAttr must match the darwinConfigurations attribute this machine is
@@ -67,6 +94,25 @@
           modules = [
             ./modules/darwin
             home-manager.darwinModules.home-manager
+            nix-homebrew.darwinModules.nix-homebrew
+            {
+              nix-homebrew = {
+                enable = true;
+                user = username;
+                autoMigrate = true;
+                mutableTaps = false;
+                taps = {
+                  "homebrew/homebrew-core" = homebrew-core;
+                  "homebrew/homebrew-cask" = homebrew-cask;
+                  "anomalyco/homebrew-tap" = homebrew-anomalyco;
+                  "simenandre/homebrew-tools" = homebrew-simenandre;
+                };
+                trust.taps = [
+                  "anomalyco/tap"
+                  "simenandre/tools"
+                ];
+              };
+            }
             {
               # Primary user for system defaults and homebrew
               system.primaryUser = username;
@@ -90,6 +136,8 @@
         };
     in
     {
+      packages.aarch64-darwin.vet = nixpkgs.legacyPackages.aarch64-darwin.callPackage ./pkgs/vet { };
+
       darwinConfigurations = {
         "makkie" = mkDarwin {
           username = "simenandre";