machine0-cli-nix

A small, standalone Nix flake that packages the machine0 CLI (@machine0/cli) — no npm required on your machine.

The flake fetches the prebuilt bundle straight from the public npm registry and runs it with a pinned Node.js. No build step and no dependency resolution — the published tarball is a self-contained bundle with no runtime dependencies, so this is an unpack-and-wrap.

./update.sh asserts that on every bump: if a release ever reintroduces runtime dependencies it refuses to pin, because this packaging has no node_modules and those imports would fail at runtime rather than at build time. (That regression really shipped — see flake.nix for the history.)

Use it

Run it once without installing:

nix run github:fdmtl/machine0-cli-nix -- --help

Install it into your profile:

nix profile install github:fdmtl/machine0-cli-nix
machine0 --version

Import into another flake

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    machine0-cli.url = "github:fdmtl/machine0-cli-nix";
  };

  outputs = { self, nixpkgs, machine0-cli, ... }:
    let system = "aarch64-darwin"; in {
      # e.g. drop it into a devShell:
      devShells.${system}.default = nixpkgs.legacyPackages.${system}.mkShell {
        packages = [ machine0-cli.packages.${system}.default ];
      };
    };
}

The repo is public, so github:fdmtl/machine0-cli-nix works without any token.

Updating the pinned version

The flake pins an exact published version and its tarball hash.

Updates are automated. .github/workflows/update-pin.yml bumps the pin, build-tests the result, and commits to main. It runs on:

• a repository_dispatch fired by the CLI publish workflow in fdmtl/machine0 (minutes after each npm publish),
• a daily cron fallback that pins whatever npm's latest resolves to,
• manual workflow_dispatch (with an optional version input).

Rollback: run the workflow manually with the previous good version as the version input. If npm's latest still points at the bad release, deprecate or re-tag it on npm first, or the daily cron will bump forward again.

The manual escape hatch still works locally:

./update.sh            # pin to the latest version on npm
./update.sh 1.0.130    # pin to a specific version

Then review the diff, commit, and push.