diff options
| author | Simen A. W. Olsen <hello@simenandre.no> | 2026-10-27 11:50:21 +0100 |
|---|---|---|
| committer | Simen A. W. Olsen <hello@simenandre.no> | 2026-10-27 11:50:21 +0100 |
| commit | 305a0e61f839de12f5aebaee6e1469e138c86fd7 (patch) | |
| tree | c3c7ff3dd1180a785e02a848ad3e4655d68cea20 /modules/home/zsh.nix | |
| parent | 163c2dee18ab2b197fe1fcf00cf32214b804fda6 (diff) | |
| download | dotfiles-305a0e61f839de12f5aebaee6e1469e138c86fd7.tar.gz dotfiles-305a0e61f839de12f5aebaee6e1469e138c86fd7.zip | |
update now holds inputs and skills back by a cooldown, has Claude review
third-party diffs, and reports CVE changes before switching. Homebrew taps
are pinned through nix-homebrew, and npm/pnpm get install policies.
Diffstat (limited to 'modules/home/zsh.nix')
| -rw-r--r-- | modules/home/zsh.nix | 28 |
1 files changed, 22 insertions, 6 deletions
diff --git a/modules/home/zsh.nix b/modules/home/zsh.nix index 3cef29d..88873d8 100644 --- a/modules/home/zsh.nix +++ b/modules/home/zsh.nix @@ -1,4 +1,4 @@ -{ pkgs, lib, flakeAttr, ... }: +{ config, pkgs, lib, flakeAttr, ... }: let # Pinned to commits, not branch names: a branch ref keeps moving while the @@ -40,6 +40,9 @@ in export XDG_CACHE_HOME=''${XDG_CACHE_HOME:-$HOME/.cache} export ZDOTDIR=''${ZDOTDIR:-$XDG_CONFIG_HOME/zsh} + # home.sessionVariables (GOPRIVATE, SKILLS_MANAGED_BY, ...) + . "${config.home.profileDirectory}/etc/profile.d/hm-session-vars.sh" + # Ensure path arrays do not contain duplicates. typeset -gU path fpath @@ -120,13 +123,26 @@ in alias tailscale='/Applications/Tailscale.app/Contents/MacOS/Tailscale' alias rebuild='sudo darwin-rebuild switch --flake ~/ghq/simenandre.no/dotfiles#${flakeAttr}' function update() { - local flake=~/ghq/simenandre.no/dotfiles - nix flake update --flake "$flake" || return + local flake=~/ghq/simenandre.no/dotfiles out + out=$(mktemp -d) + # vet holds inputs back by a cooldown and has Claude review third-party + # changes; see pkgs/vet. + (cd "$flake" && vet lock && vet check --report "$out/report") || { + echo 'update: stopped by vet, nothing was switched' + return 1 + } + (cd "$out" && darwin-rebuild build --flake "$flake#${flakeAttr}") || return + nvd diff /run/current-system "$out/result" + (cd "$flake" && vet cves /run/current-system "$out/result" --report "$out/cves") || + { echo 'update: CVE scan failed'; : >"$out/cves"; } + read -q '?update: switch to this system? [y/N] ' || { echo; return 1; } + echo sudo darwin-rebuild switch --flake "$flake#${flakeAttr}" || return - # Commit only after a switch succeeds, and only flake.lock, so unrelated + # Commit only after a switch succeeds, and only the locks, so unrelated # work in the tree stays uncommitted. - git -C "$flake" diff --quiet HEAD -- flake.lock && return 0 - git -C "$flake" commit -m 'chore(flake): update inputs' -- flake.lock || return + git -C "$flake" diff --quiet HEAD -- flake.lock skills.lock && return 0 + printf 'chore(flake): update inputs\n\n%s\n\n%s\n' "$(<"$out/report")" "$(<"$out/cves")" | + git -C "$flake" commit -F - -- flake.lock skills.lock || return git -C "$flake" push || echo 'update: lock committed but push failed' } alias nix-gc='sudo nix-collect-garbage --delete-older-than 14d && nix-collect-garbage --delete-older-than 14d && nix store gc' |