perf(nix): skip unchanged lock generation

[benvinegar]

Problem

Nix package CI spends about two minutes regenerating nix/bun.lock.nix on every code change, even when no dependency or Nix input changed.

Approach

• extend change detection with a conservative nix_lock_changed classification covering Bun locks/configuration, workspace manifests, flake inputs, and nix/*
• regenerate and verify nix/bun.lock.nix only when one of those inputs changes
• retain the host flake check, cross-system evaluation, explicit package build, and smoke test

For ordinary source changes, recent timings indicate this should reduce the Nix check from about 3:39 to roughly 1:30–1:40.

Validation

• exercised the change detector against docs-only, TypeScript-only, bun.lock, and workspace package.json commits in a temporary Git repository
• bash -n .github/scripts/detect-code-changes.sh
• parsed .github/workflows/nix.yml as YAML
• bun run format:check
• bun run lint
• bun run typecheck
• bun run deps:check

The first CI run showed that the host nix flake check realizes a bun2nix path required by the later all-system evaluation, so that step was restored. The updated Nix workflow run is the authoritative validation for the conditional lock path.

Stack

1. perf(test): make suite sharding configurable #1057 — test sharding
2. perf(ci): parallelize validation lanes #1058 — parallel CI validation lanes
3. perf(nix): skip unchanged lock generation #1059 — faster Nix validation (this PR; based on perf(ci): parallelize validation lanes #1058)

Merge in this order.

This PR description was generated by Pi using OpenAI GPT-5.6 Sol

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
hunk-web	Ignored	Preview	Sep 9, 2026 12:43am UTC

[greptile-apps]

Greptile Summary

This PR avoids regenerating the Nix representation of the Bun lockfile when a change cannot affect it and consolidates flake evaluation.

• Adds a dedicated nix_lock_changed output to the shared change detector.
• Uses that output to conditionally run generated-lock verification.
• Replaces duplicate host/all-system flake checks with one all-system evaluation while retaining package build and smoke validation.
• Adds an empty changeset for the CI-only change.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking recommendation to test the new path-sensitive CI gate.

Current lock-generation inputs are covered, and the consolidated flake command preserves evaluation, build, and smoke-test coverage; only regression protection for the new allowlist is missing.

Files Needing Attention: .github/scripts/detect-code-changes.sh

Important Files Changed

Filename	Overview
.github/scripts/detect-code-changes.sh	Adds lock-input path classification and a corresponding workflow output; current coverage is correct but the new gating logic lacks focused tests.
.github/workflows/nix.yml	Gates generated-lock verification and removes redundant host-only flake evaluation without losing current validation coverage.
.changeset/calm-nix-builds.md	Adds an empty changeset appropriate for a non-release CI optimization.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Diff[Changed paths] --> Detector[Change detector]
  Detector --> Code{Code changed?}
  Detector --> Lock{Nix lock input changed?}
  Code -->|No| Skip[Skip Nix package job]
  Code -->|Yes| Package[Nix package job]
  Lock -->|Yes| Verify[Regenerate and compare bun.lock.nix]
  Lock -->|No| Evaluate[Skip lock generation]
  Verify --> Evaluate[Evaluate all systems]
  Evaluate --> Build[Build and smoke-test package]

Loading

Prompt To Fix All With AI

### Issue 1
.github/scripts/detect-code-changes.sh:31-42
**Lock Gate Lacks Tests**

The new path allowlist decides whether CI runs the generated-lock consistency check, but no tests cover lock inputs, unrelated paths, or mixed-file diffs. A future path change or pattern regression could silently skip stale-lock detection, so focused positive and negative cases would provide useful regression protection.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: 9c521ae | Re-trigger Greptile}

[greptile-apps]

Lock Gate Lacks Tests

The new path allowlist decides whether CI runs the generated-lock consistency check, but no tests cover lock inputs, unrelated paths, or mixed-file diffs. A future path change or pattern regression could silently skip stale-lock detection, so focused positive and negative cases would provide useful regression protection.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/scripts/detect-code-changes.sh
Line: 31-42

Comment:
**Lock Gate Lacks Tests**

The new path allowlist decides whether CI runs the generated-lock consistency check, but no tests cover lock inputs, unrelated paths, or mixed-file diffs. A future path change or pattern regression could silently skip stale-lock detection, so focused positive and negative cases would provide useful regression protection.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[benvinegar]

Added integration coverage for every current lock input plus unrelated code, docs-only, and mixed-file diffs. The tests exercise the real detector in temporary Git repositories and assert both GitHub outputs.

Commit: 0ce58ba9

_{Responded by Pi using openai/gpt-5.6-sol.}

This comment was generated by Pi using GPT-5.6 Sol

[benvinegar]

Force-pushed for the stack rebase. The Nix change now only skips lock regeneration when its inputs are unchanged; the host flake check was restored after CI proved that it realizes a bun2nix path needed by cross-system evaluation.

This comment was generated by Pi using OpenAI GPT-5.6 Sol