Merge pull request #12028 from DeterminateSystems/fail-on-unlocked

nix flake lock: Fail if there is an unlocked input
NixOS · Dec 16, 2024 · 2baab64 · 2baab64
2 parents 3663480 + 8b9e0f8
commit 2baab64
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 0 deletions.
diff --git a/src/libflake/flake/flake.cc b/src/libflake/flake/flake.cc
@@ -672,6 +672,8 @@ LockedFlake lockFlake(
             if (lockFlags.writeLockFile) {
                 if (sourcePath || lockFlags.outputLockFilePath) {
                     if (auto unlockedInput = newLockFile.isUnlocked()) {
+                        if (lockFlags.failOnUnlocked)
+                            throw Error("cannot write lock file of flake '%s' because it has an unlocked input ('%s').\n", topRef, *unlockedInput);
                         if (state.fetchSettings.warnDirty)
                             warn("will not write lock file of flake '%s' because it has an unlocked input ('%s')", topRef, *unlockedInput);
                     } else {

diff --git a/src/libflake/flake/flake.hh b/src/libflake/flake/flake.hh
@@ -156,6 +156,11 @@ struct LockFlags
      */
     bool writeLockFile = true;
 
+    /**
+     * Throw an exception when the flake has an unlocked input.
+     */
+    bool failOnUnlocked = false;
+
     /**
      * Whether to use the registries to lookup indirect flake
      * references like 'nixpkgs'.

diff --git a/src/nix/flake.cc b/src/nix/flake.cc
@@ -162,6 +162,7 @@ struct CmdFlakeLock : FlakeCommand
         settings.tarballTtl = 0;
 
         lockFlags.writeLockFile = true;
+        lockFlags.failOnUnlocked = true;
         lockFlags.applyNixConfig = true;
 
         lockFlake();

diff --git a/tests/functional/flakes/unlocked-override.sh b/tests/functional/flakes/unlocked-override.sh
@@ -30,3 +30,6 @@ git -C "$flake2Dir" add flake.nix
 echo 456 > "$flake1Dir"/x.nix
 
 [[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 456 ]]
+
+expectStderr 1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" |
+  grepQuiet "cannot write lock file.*because it has an unlocked input"