ci: check nix pins and repin the gemset after release

[ajmarkow]

Makes the flake easier to consume, and stops it silently serving a stale gem.

Overlay

The flake only exposed packages.<system>.default, so a consumer had to thread system through a module to reach it. overlays.default lets them apply the overlay once and then write a bare snippet_cli in environment.systemPackages or home.packages.

Maintainer metadata

meta.maintainers was empty. Filled in as an inline attrset rather than lib.maintainers.ajmarkow, because that attribute does not exist until an entry lands in nixpkgs' maintainer-list.nix — a separate PR. Comment notes to swap it if the package is ever upstreamed.

The pre-commit nixfmt hook also reformatted nix/default.nix (function args expanded, aligned = padding dropped). That churn is the hook's, not hand-made.

The gemset problem

nix/gemset.nix pins the published gem, so it lags lib/snippet_cli/version.rb until bundix reruns. While it lags, nix run github:ajmarkow/snippet_cli silently installs the previous release. Nothing caught that before.

gemset-check

Compares nix/gemset.nix and nix/Gemfile.lock to version.rb on every push and PR. Plain Ruby, no Nix, so it is fast.

A version RubyGems has not indexed yet is a release in flight rather than drift, so that case passes with a ::notice. Keying off RubyGems instead of a commit marker keeps this correct on pull_request events, where github.event.head_commit is null and a marker-based skip would never fire.

Verified against live RubyGems in all three states:

State	Result
Pins in sync	exit 0, silent
version.rb ahead, unpublished	exit 0 + ::notice "release in flight"
Pins behind a published version	exit 1 + ::error on both files

update-gemset

Runs after publish. Waits for RubyGems to index the new version, regenerates with bundix, then opens a PR on chore/repin-gemset-v<version> and enables auto-merge.

Two details worth knowing:

• bundle lock --update is scoped to --update snippet_cli. Unscoped, it bumped an unrelated transitive gem (bigdecimal 4.1.1 → 4.1.3) during testing.
• nix fmt nix/gemset.nix runs afterwards. bundix emits compact lists (["default"]) while the checked-in file is nixfmt style ([ "default" ]); without this the job would commit unformatted output and churn the file every release.

With both fixes a full regeneration produces zero drift.

It opens a PR rather than pushing, because the master ruleset requires a pull request and has no bypass actors.

Before merging

• Add a GEMSET_BOT_TOKEN secret — a fine-grained PAT scoped to this repo with Contents: read/write and Pull requests: read/write. GITHUB_TOKEN will not work: GitHub does not start check runs for PRs it opens, so the required contexts would never report and auto-merge would wait forever.

Merging without it is safe. gemset-check works standalone, and update-gemset only runs after publish, so the repin half simply stays inert.

Optional follow-ups

• Add nix pins match version.rb to the ruleset's required contexts. Until then gemset-check reports but cannot block a merge.
• delete_branch_on_merge is off, so chore/repin-gemset-v* branches will accumulate.

Release flow reminder

publish reads github.event.head_commit.message. Under the PR-only ruleset that is the squash commit, whose message comes from the PR title — so gem-release-ready must be in the release PR title.

🤖 Generated with Claude Code