nix flake lock: Fail if there is an unlocked input

Since the only purpose of `nix flake lock` is to write a new lock
file, it should be a fatal error if we can't write the lock file.

src/libflake/flake/flake.cc

@@ -672,6 +672,8 @@ LockedFlake lockFlake(
             if (lockFlags.writeLockFile) {
                 if (sourcePath || lockFlags.outputLockFilePath) {
                     if (auto unlockedInput = newLockFile.isUnlocked()) {
+                        if (lockFlags.failOnUnlocked)
+                            throw Error("cannot write lock file of flake '%s' because it has an unlocked input ('%s').\n", topRef, *unlockedInput);
                         if (state.fetchSettings.warnDirty)
                             warn("will not write lock file of flake '%s' because it has an unlocked input ('%s')", topRef, *unlockedInput);
                     } else {

src/libflake/flake/flake.hh

@@ -156,6 +156,11 @@ struct LockFlags
      */
     bool writeLockFile = true;
 
+    /**
+     * Throw an exception when the flake has an unlocked input.
+     */
+    bool failOnUnlocked = false;
+
     /**
      * Whether to use the registries to lookup indirect flake
      * references like 'nixpkgs'.

src/nix/flake.cc

@@ -162,6 +162,7 @@ struct CmdFlakeLock : FlakeCommand
         settings.tarballTtl = 0;
 
         lockFlags.writeLockFile = true;
+        lockFlags.failOnUnlocked = true;
         lockFlags.applyNixConfig = true;
 
         lockFlake();

tests/functional/flakes/unlocked-override.sh

@@ -30,3 +30,6 @@ git -C "$flake2Dir" add flake.nix
 echo 456 > "$flake1Dir"/x.nix
 
 [[ $(nix eval --json "$flake2Dir#x" --override-input flake1 "$TEST_ROOT/flake1") = 456 ]]
+
+expectStderr 1 nix flake lock "$flake2Dir" --override-input flake1 "$TEST_ROOT/flake1" |
+  grepQuiet "cannot write lock file.*because it has an unlocked input"