Automate flake pin bumps on new @machine0/cli releases

[barnaby]

What

• .github/workflows/update-pin.yml — bumps the @machine0/cli pin in flake.nix by running the existing ./update.sh, then gates the commit on nix build + --version/--help smoke test before pushing to main. Triggered three ways:
  • repository_dispatch (cli-published) fired by deploy-cli.yml in fdmtl/machine0 after npm publish (companion PR in fdmtl/machine0)
  • daily cron fallback (pins npm latest if a dispatch was missed)
  • manual workflow_dispatch with an optional version input (also the rollback path)
• .github/workflows/ci.yml — ubuntu + macos nix build matrix on push/PR; the bump pipeline gates on ubuntu only, so this catches darwin-only breakage.
• README — documents the automation and the rollback procedure.

Notes

• Uses cachix/install-nix-action (upstream Nix) — DeterminateSystems/nix-installer-action installs Determinate Nix by default and dropped upstream-Nix support on 2026-01-01.
• The update step retries 5× (60s apart) to ride out npm registry propagation, and a verify step asserts the pinned version matches the dispatched one.
• Prereqs before the dispatch path works: FLAKE_REPO_DISPATCH_TOKEN secret in fdmtl/machine0 (fine-grained PAT, Contents RW on this repo) and main allowing pushes from github-actions[bot].

Verification (after merge)

1. gh workflow run update-pin.yml with no input → expect no-op (pin already latest)
2. Manual run with version: 9.9.9 → expect 5 retries then red job, no commit
3. gh api repos/fdmtl/machine0-cli-nix/dispatches -f event_type=cli-published -f 'client_payload[version]=1.0.148' → workflow fires, no-ops
4. Next real CLI deploy → pin @machine0/cli@<new> commit lands on main

Note (post-greptile): update-pin.yml now checks out ref: main unconditionally, so every run — including workflow_dispatch from another branch — operates on and pushes to main. There is no "safe test on a branch" mode; use the no-op and 9.9.9 runs above for testing, and the version input for real rollbacks.

[barnaby]

The red CI here is a pre-existing breakage on main, caught by this PR's new smoke test — not a bug in the workflows.

@machine0/cli gained real runtime dependencies (open@^11, update-notifier@^7.3.1) somewhere between 1.0.140 and 1.0.148. The flake was authored against 1.0.129, which was genuinely dependency-free — so its fetch-and-wrap approach (copy bin dist package.json, no node_modules) worked then. The bump to 1.0.148 (#1) broke it silently: nix run github:fdmtl/machine0-cli-nix -- --version currently dies with ERR_MODULE_NOT_FOUND: Cannot find package 'open' from dist/cli.bundle.mjs. This PR's CI is the first thing that ever ran the packaged binary.

Two ways to fix, pick one:

1. Upstream (recommended): make bun run build in fdmtl/machine0 bundle open and update-notifier into cli.bundle.mjs (both are pure JS; today they're treated as externals). Restores the "single dependency-free bundle" contract, keeps this flake and update.sh trivial. Consider gating update-notifier off entirely for non-npm installs — nix users can't act on "run npm update".
2. Flake-side: switch to buildNpmPackage with a vendored package-lock.json + npmDepsHash, and extend update.sh to regenerate both on each bump. Works without touching upstream, but roughly triples the moving parts this repo exists to avoid.

Until one of these lands, the automation in this PR fails safe: update-pin.yml's smoke test will refuse to commit any bump (correct — every version ≥1.0.148 is broken under this packaging), and ci.yml stays red on main.

[barnaby]

Resolved in this PR (option 2, flake-side): switched to buildNpmPackage with a vendored package-lock.json + npmDepsHash; update.sh now regenerates both on every bump and the bump workflow commits them together. The published package.json's bun workspace:* devDependencies are stripped before npm parses it (mirrored in flake.nix postPatch and update.sh). CI is green on ubuntu + macos, smoke test now genuinely executes the packaged binary. Upstream bundling (option 1) is still a nice-to-have simplification — if it ever lands, the lockfile shrinks to nothing and this packaging keeps working unchanged.

[barnaby]

@greptileai review

[greptile-apps]

Greptile Summary

The PR automates @machine0/cli pin updates and validates generated Nix packages before updating main.

• Adds dispatch, scheduled, and manual pin-update paths with retry handling.
• Rebuilds and smoke-tests the package before each initial or post-rebase push.
• Adds Linux and macOS CI coverage and documents automated updates and rollback.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
.github/workflows/update-pin.yml	Adds the automated update workflow and fully addresses the previously reported branch targeting, action pinning, rebase validation, and retry-loop issues.
.github/workflows/ci.yml	Adds SHA-pinned Linux and macOS Nix build coverage.
update.sh	Extends pin generation to regenerate the runtime dependency lockfile and compute npmDepsHash.
flake.nix	Migrates packaging to buildNpmPackage so the CLI's external runtime dependencies are installed.
README.md	Documents automated pin updates, manual invocation, and rollback behavior.

Sequence Diagram

sequenceDiagram
    actor Trigger as Dispatch / Cron / Maintainer
    participant Workflow as update-pin workflow
    participant NPM as npm registry
    participant Nix as Nix build
    participant Main as main branch
    Trigger->>Workflow: Start update
    Workflow->>NPM: Resolve and fetch CLI version
    Workflow->>Workflow: Regenerate pins and lockfile
    Workflow->>Nix: Build and smoke-test
    alt No pin changes
        Workflow-->>Trigger: Exit successfully
    else Pin changed
        Workflow->>Main: Push validated commit
        alt main advanced
            Workflow->>Main: Rebase onto current main
            Workflow->>Nix: Rebuild and smoke-test rebased tree
            Workflow->>Main: Retry push
        end
    end

Loading

_{Reviews (4): Last reviewed commit: "Skip pointless rebase+rebuild after fina..." | Re-trigger Greptile}