Update dependencies and fix to make the CI "work"

.envrc

@@ -1,8 +1,8 @@
 #!/bin/sh
 
 # This locks subflakes to the latest commit of std
-(cd ./src/local && nix flake lock --override-input std git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD))
-(cd ./src/tests && nix flake lock --override-input std git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD))
+(cd ./src/local && nix flake lock --override-input std "git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)")
+(cd ./src/tests && nix flake lock --override-input std "git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)")
 
 # shellcheck disable=SC1090
 . "$(fetchurl "https://raw.githubusercontent.com/paisano-nix/direnv/main/lib" "sha256-IgQhKK7UHL1AfCUntJO2KCaIDJQotRnK2qC4Daxk+wI=")"

.git-blame-ignore-revs

@@ -0,0 +1 @@
+663321ed4f88c1af3127195c6b9a2130c22a11ab

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
   mac:
     uses: ./.github/workflows/std.yml
     with:
-      runs-on: macOS-13
+      runs-on: macOS-latest
     secrets: inherit
 
   linux:

.github/workflows/std.yml

@@ -23,7 +23,7 @@ jobs:
 
     runs-on: ${{ inputs.runs-on }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - uses: nixbuild/nix-quick-install-action@v32
       - name: Update subflake references
         run: ./.github/workflows/update-subflake.sh

.github/workflows/update-subflake.sh

@@ -2,5 +2,5 @@
 nix store add-path --name source .
 
 # This locks subflakes to the latest commit of std
-(cd ./src/local && nix flake lock --override-input std git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)&shallow=1)
-(cd ./src/tests && nix flake lock --override-input std git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)&shallow=1)
+(cd ./src/local && nix flake lock --override-input std "git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)&shallow=1")
+(cd ./src/tests && nix flake lock --override-input std "git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)&shallow=1")

Makefile

@@ -0,0 +1,71 @@
+root = $(shell git rev-parse --show-toplevel)
+SYSTEM := $(shell nix eval --impure --raw --expr 'builtins.currentSystem')
+LINUX := x86_64-linux
+DARWIN := aarch64-darwin
+
+.PHONY: fmt
+fmt:
+	treefmt
+
+update-sub-flake:
+	cd $(root)
+	cd src/local && nix flake update
+	cd src/tests && nix flake update
+
+ci-local: ci-checks ci-cli ci-shells ci-format
+	@echo "=== All CI checks passed ==="
+
+ci-all: ci-checks-all ci-cli-all ci-shells-all ci-format
+	@echo "=== All CI checks passed (all systems) ==="
+
+# Not in ci-local by default: dirties flake.lock files, requires committed HEAD.
+# Add to ci-local prereqs if full CI parity needed.
+ci-sync:
+	@echo "=== Syncing subflake locks ==="
+	./.github/workflows/update-subflake.sh
+
+ci-checks:
+	@echo "=== Running checks ==="
+	nix build .#checks.$(SYSTEM) --no-link
+
+ci-checks-all: ci-checks-linux ci-checks-darwin
+ci-checks-linux:
+	@echo "=== Running checks (linux) ==="
+	nix build .#checks.$(LINUX) --no-link
+ci-checks-darwin:
+	@echo "=== Running checks (darwin) ==="
+	nix build .#checks.$(DARWIN) --no-link
+
+ci-cli:
+	@echo "=== Building CLI ==="
+	nix build .#packages.$(SYSTEM).default
+
+ci-cli-all: ci-cli-linux ci-cli-darwin
+ci-cli-linux:
+	@echo "=== Building CLI (linux) ==="
+	nix build .#packages.$(LINUX).default
+ci-cli-darwin:
+	@echo "=== Building CLI (darwin) ==="
+	nix build .#packages.$(DARWIN).default
+
+ci-shells:
+	@echo "=== Building devshells ==="
+	nix build .#devShells.$(SYSTEM).default --no-link
+
+ci-shells-all: ci-shells-linux ci-shells-darwin
+ci-shells-linux:
+	@echo "=== Building devshells (linux) ==="
+	nix build .#devShells.$(LINUX).default --no-link
+ci-shells-darwin:
+	@echo "=== Building devshells (darwin) ==="
+	nix build .#devShells.$(DARWIN).default --no-link
+
+ci-format:
+	@echo "=== Checking formatting ==="
+	treefmt --fail-on-change
+
+.PHONY: update-sub-flake ci-local ci-all ci-sync
+.PHONY: ci-checks ci-checks-all ci-checks-linux ci-checks-darwin
+.PHONY: ci-cli ci-cli-all ci-cli-linux ci-cli-darwin
+.PHONY: ci-shells ci-shells-all ci-shells-linux ci-shells-darwin
+.PHONY: ci-format

flake.nix

@@ -17,7 +17,7 @@
   #
   #inputs.self.shallow = true;
   # override downstream with inputs.std.inputs.nixpkgs.follows = ...
-  inputs.nixpkgs.url = "github:nixos/nixpkgs/release-23.11";
+  inputs.nixpkgs.url = "github:nixos/nixpkgs/release-25.11";
   inputs.lib.url = "github:nix-community/nixpkgs.lib";
   inputs = {
     paisano.url = "github:paisano-nix/core/0.2.0";

src/local/configs.nix

@@ -18,7 +18,7 @@ in {
       global.excludes = ["src/std/templates/**"];
       formatter = {
         go = {
-          command = "gofmt";
+          command = "${nixpkgs.go}/bin/gofmt";
           options = ["-w"];
           includes = ["*.go"];
         };

src/local/flake.nix

@@ -1,7 +1,7 @@
 {
   inputs = {
     # injected (private) inputs
-    namaka.url = "github:nix-community/namaka/v0.2.0";
+    namaka.url = "github:nix-community/namaka/v0.2.1";
     namaka.inputs.haumea.follows = "std/haumea";
     namaka.inputs.nixpkgs.follows = "std/nixpkgs";