flake.nix landed with the converter (#1) but flake.lock was never generated — the authoring session had no Nix.
Until it's committed, the nixpkgs input floats within the nixos-25.05 release branch, so nix flake check is reproducible in intent but not pinned in fact.
Fix
git clone https://github.com/bounded-systems/ci-workflows && cd ci-workflows
nix flake lock
git add flake.lock && git commit -m "flake: pin nixpkgs" && git push
Why it matters less than it looks
The flake is the local-reproducibility face of the test suite, not the enforcement path. CI never installs Nix — self-test.yml runs the same three scripts directly, and determinism is enforced by golden byte-equality (test/test_converter.py), the heredoc drift check (test/check_embed_sync.py), and the posture tests (test/test_scan_posture.py). Those hold regardless of which nixpkgs revision resolves.
So this is a correctness-of-the-story gap rather than a correctness-of-the-control gap: a repo that ships a flake claiming reproducibility should actually pin its inputs.
Done when
Second point matters: flake.nix has never been run. If runCommand/${self} needs adjusting, that surfaces on first use.
flake.nixlanded with the converter (#1) butflake.lockwas never generated — the authoring session had no Nix.Until it's committed, the
nixpkgsinput floats within thenixos-25.05release branch, sonix flake checkis reproducible in intent but not pinned in fact.Fix
Why it matters less than it looks
The flake is the local-reproducibility face of the test suite, not the enforcement path. CI never installs Nix —
self-test.ymlruns the same three scripts directly, and determinism is enforced by golden byte-equality (test/test_converter.py), the heredoc drift check (test/check_embed_sync.py), and the posture tests (test/test_scan_posture.py). Those hold regardless of which nixpkgs revision resolves.So this is a correctness-of-the-story gap rather than a correctness-of-the-control gap: a repo that ships a flake claiming reproducibility should actually pin its inputs.
Done when
flake.lockcommittednix flake checkverified passing against it on a real Nix machine (never actually executed — the flake is written but untested)Second point matters:
flake.nixhas never been run. IfrunCommand/${self}needs adjusting, that surfaces on first use.