lockFileMaintenance does not refresh Nix flake.lock files unless a string like "github:NixOS/nixpkgs/anything" is present in flake.nix

[rarkins]

Discussed in #29706

^{Originally posted by ipetkov June 16, 2024}

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Gitea Action, container: ghcr.io/renovatebot/renovate:37.406.2

Please tell us more about your question or problem

https://github.com/ipetkov/renovate-reproduction-flake-maintenance

Current behavior

When lockFileMaintenance and the nix manager are enabled, flake.lock files
are only refreshed if flake.nix contains a string like
"github:NixOS/nixpkgs/anything" (including the double quotes.
anything can be replaced with any alpha-numeric string of characters).

Expected behavior

I would expect that when lockFileMaintenance and the nix manager are
enabled, then flake.lock will always be refreshed, regardless of the
contents/inputs defined in flake.nix.

A workaround for this bug is to inject a dummy string to satisfy Renovate's
hard-coded regex:

echo '# Trick renovate into working: "github:NixOS/nixpkgs/nixpkgs-unstable"' >> flake.nix

Suggested Alternative

Rather than using a regex to detect inputs to nixpkgs in flake.nix, Renovate can parse flake.lock (which is a JSON file) and detect all git project/repo/commit combinations.

Logs (if relevant)

Logs

 INFO: Repository started (repository=ipetkov/ism)
       "renovateVersion": "37.406.2"
... snip ...
DEBUG: Using file match: (^|/)flake\.nix$ for manager nix (repository=ipetkov/ism)
... snip ...
DEBUG: Matched 1 file(s) for manager nix: flake.nix (repository=ipetkov/ism)
DEBUG: manager extract durations (ms) (repository=ipetkov/ism)
       "managers": {"nix": 1, "github-actions": 1, "cargo": 40}
... snip ...
DEBUG: Found 5 package file(s) (repository=ipetkov/ism)
 INFO: Dependency extraction complete (repository=ipetkov/ism, baseBranch=main)
       "stats": {
         "managers": {
           "cargo": {"fileCount": 4, "depCount": 61},
           "github-actions": {"fileCount": 1, "depCount": 2}
         },
         "total": {"fileCount": 5, "depCount": 63}
       }
... snip ...
DEBUG: packageFiles with updates (repository=ipetkov/ism, baseBranch=main)
       "config": {
         "cargo": [
... snip ...
         ],
       }
DEBUG: Updated 3 package files (repository=ipetkov/ism, branch=renovate/cargo-and-nix)
DEBUG: Updated 7 lock files (repository=ipetkov/ism, branch=renovate/cargo-and-nix)
       "updatedArtifacts": [
         "redacted/Cargo.lock",
... snip ...
       ]

Logs with workaround applied

 INFO: Repository started (repository=ipetkov/ism)
       "renovateVersion": "37.406.2"
... snip ...
DEBUG: Using file match: (^|/)flake\.nix$ for manager nix (repository=ipetkov/ism)
... snip ...
DEBUG: Matched 1 file(s) for manager nix: flake.nix (repository=ipetkov/ism)
... snip ...
DEBUG: manager extract durations (ms) (repository=ipetkov/ism)
       "managers": {"nix": 1, "github-actions": 1, "cargo": 40}
... snip ...
DEBUG: Found nix package files (repository=ipetkov/ism)
DEBUG: Found 6 package file(s) (repository=ipetkov/ism)
 INFO: Dependency extraction complete (repository=ipetkov/ism, baseBranch=main)
       "stats": {
         "managers": {
           "cargo": {"fileCount": 4, "depCount": 61},
           "github-actions": {"fileCount": 1, "depCount": 2},
           "nix": {"fileCount": 1, "depCount": 1}
         },
         "total": {"fileCount": 6, "depCount": 64}
       }
... snip ...
DEBUG: packageFiles with updates (repository=ipetkov/ism, baseBranch=main)
       "config": {
         "cargo": [
... snip ...
         ],
         "github-actions": [
... snip ...
         ],
         "nix": [
           {
             "deps": [
               {
                 "depName": "nixpkgs",
                 "currentValue": "nixpkgs-unstable",
                 "datasource": "git-refs",
                 "packageName": "https://github.com/NixOS/nixpkgs",
                 "versioning": "nixpkgs",
                 "updates": [],
                 "warnings": [],
                 "sourceUrl": "https://github.com/NixOS/nixpkgs",
                 "currentVersion": "nixpkgs-unstable",
                 "fixedVersion": "nixpkgs-unstable"
               }
             ],
             "packageFile": "flake.nix"
           }
         ]
       }
DEBUG: updateArtifacts for lockFileMaintenanceFiles (repository=ipetkov/ism, branch=renovate/lock-file-maintenance)
DEBUG: Setting CONTAINERBASE_CACHE_DIR to /tmp/renovate/cache/containerbase (repository=ipetkov/ism, branch=renovate/lock-file-maintenance)
DEBUG: Using containerbase dynamic installs (repository=ipetkov/ism, branch=renovate/lock-file-maintenance)
... snip ...
DEBUG: Executing command (repository=ipetkov/ism, branch=renovate/lock-file-maintenance)
       "command": "install-tool nix 2.23.0"
DEBUG: exec completed (repository=ipetkov/ism, branch=renovate/lock-file-maintenance)
       "durationMs": 106,
       "stdout": "[16:24:54.133] INFO (359): Installing tool nix@2.23.0...\ntool nix v2.23 is already installed\ntool is already linked: nix v2.23\n[16:24:54.149] INFO (359): Installed tool nix in 16ms.\n",
       "stderr": ""
DEBUG: Executing command (repository=ipetkov/ism, branch=renovate/lock-file-maintenance)
       "command": "nix     --extra-experimental-features nix-command     --extra-experimental-features flakes --extra-access-tokens github.com=**redacted** flake update"
... snip ...
DEBUG: Updated 5 lock files (repository=ipetkov/ism, branch=renovate/lock-file-maintenance)
       "updatedArtifacts": [
         "flake.lock",
         "redacted/Cargo.lock",
... snip ...
       ]

[SuperSandro2000]

That https://github.com/ipetkov/renovate-reproduction-flake-maintenance/blob/5a7358e0d19ec5665c3aadf787bfcbbd7dae5e45/flake.nix#L4 cannot be updated is expected because it depends on the settings of the flake registry.

[ipetkov]

cannot be updated is expected because it depends on the settings of the flake registry.

@SuperSandro2000 I'm not sure I understand what you are saying here?

The flake uses nixpkgs.follows to inherit from an input defined on the line above

If you check out the flake and run nix flake update the lock file will update even without having to add anything to the flake registry (I certainly don't have anything defined in mine).

Its just that it seems that renovate does not even attempt to invoke nix flake update unless it's heuristic of grep '"github:NixOS/nixpkgs/' matches, regardless of what the flake inputs look like

[SuperSandro2000]

The flake uses nixpkgs.follows to inherit from an input defined on the line above

Oh, yeah. I missread that as just being nixpkgs.url.

The rest will probably be fixed with #31921