DeterminateSystems/flake-checker-action

A GitHub Action that performs health checks for your Nix flake.lock files

TypeScript

87

237 commits

updated Sep 16, 2026

See the code

README

The Nix Flake Checker Action

This repo houses a Github Action from Determinate Systems that performs health checks on your repos' flake.lock files. Specifically, it wraps the Nix Flake Checker tool, which verifies that your root Nixpkgs inputs:

  • Have been updated within the last 30 days
  • Have the NixOS GitHub org as their owner
  • Are from a supported Git branch

Here's an example configuration that uses flake-checker-action as part of a broader Actions workflow involving Nix.

on:
  pull_request:
  push:
    branches: [main]

jobs:
  build:
    name: Build Nix targets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Check Nix flake inputs
        uses: DeterminateSystems/flake-checker-action@main # This action
      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@v3
      - name: Build default package
        run: nix build

Configuration

The Nix Flake Checker Action has a number of configuration parameters that you can set in the with block:

ParameterDescriptionDefault
conditionAn optional Common Expression Language (CEL) condition expressing your flake policy. Supersedes all check-* parameters.
flake-lock-pathThe path to the flake.lock file you want to check.flake.lock
check-outdatedWhether to check that the root Nixpkgs input is less than 30 days old.true
check-ownerWhether to check that the root Nixpkgs input has the NixOS GitHub org as its owner.true
check-supportedWhether to check that the root Nixpkgs input has a supported Git ref. Currently supported refs: nixos-22.11, nixos-22.11-small, nixos-23.05, nixos-23.05-small, nixos-unstable, nixos-unstable-small, nixpkgs-22.11-darwin, nixpkgs-23.05-darwin, nixpkgs-unstable.true
nixpkgs-keysThe names of the Nixpkgs inputs you want to check. By default the checker only checks the nixpkgs but you can specify multiple names as a comma-separated list, such as nixpkgs,nixpkgs-macos,nixpkgs-unstable.nixpkgs
ignore-missing-flake-lockWhether to ignore a missing flake.lock file, where the path to the file is the value of flake-lock-path parameter. If set to false (the default is true), the Action throws an error and the job fails if the lockfile is missing.true
fail-modeFail with an exit code of 1 if any issues are encountered.false
send-statisticsAnonymously report the number of issues detected by the flake checker. This reporting helps measure the effectiveness of the flake checker. Set to false to disable.true

Here's an example non-default configuration:

- name: Check Nix flake inputs
  uses: DeterminateSystems/flake-checker-action@v2
  with:
    flake-lock-path: ./nix/flake.lock
    check-owner: false
    ignore-missing-flake-lock: false
    fail-mode: true
code-quality
dependency-management
flakes
nix
nixos

Contributors

lucperkins

113 commits

grahamc

109 commits

cole-h

12 commits

DeterminateSystems/flake-checker-action

A GitHub Action that performs health checks for your Nix flake.lock files

TypeScript

87

237 commits

updated Sep 16, 2026

See the code

README

The Nix Flake Checker Action

This repo houses a Github Action from Determinate Systems that performs health checks on your repos' flake.lock files. Specifically, it wraps the Nix Flake Checker tool, which verifies that your root Nixpkgs inputs:

  • Have been updated within the last 30 days
  • Have the NixOS GitHub org as their owner
  • Are from a supported Git branch

Here's an example configuration that uses flake-checker-action as part of a broader Actions workflow involving Nix.

on:
  pull_request:
  push:
    branches: [main]

jobs:
  build:
    name: Build Nix targets
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - name: Check Nix flake inputs
        uses: DeterminateSystems/flake-checker-action@main # This action
      - name: Install Nix
        uses: DeterminateSystems/determinate-nix-action@v3
      - name: Build default package
        run: nix build

Configuration

The Nix Flake Checker Action has a number of configuration parameters that you can set in the with block:

ParameterDescriptionDefault
conditionAn optional Common Expression Language (CEL) condition expressing your flake policy. Supersedes all check-* parameters.
flake-lock-pathThe path to the flake.lock file you want to check.flake.lock
check-outdatedWhether to check that the root Nixpkgs input is less than 30 days old.true
check-ownerWhether to check that the root Nixpkgs input has the NixOS GitHub org as its owner.true
check-supportedWhether to check that the root Nixpkgs input has a supported Git ref. Currently supported refs: nixos-22.11, nixos-22.11-small, nixos-23.05, nixos-23.05-small, nixos-unstable, nixos-unstable-small, nixpkgs-22.11-darwin, nixpkgs-23.05-darwin, nixpkgs-unstable.true
nixpkgs-keysThe names of the Nixpkgs inputs you want to check. By default the checker only checks the nixpkgs but you can specify multiple names as a comma-separated list, such as nixpkgs,nixpkgs-macos,nixpkgs-unstable.nixpkgs
ignore-missing-flake-lockWhether to ignore a missing flake.lock file, where the path to the file is the value of flake-lock-path parameter. If set to false (the default is true), the Action throws an error and the job fails if the lockfile is missing.true
fail-modeFail with an exit code of 1 if any issues are encountered.false
send-statisticsAnonymously report the number of issues detected by the flake checker. This reporting helps measure the effectiveness of the flake checker. Set to false to disable.true

Here's an example non-default configuration:

- name: Check Nix flake inputs
  uses: DeterminateSystems/flake-checker-action@v2
  with:
    flake-lock-path: ./nix/flake.lock
    check-owner: false
    ignore-missing-flake-lock: false
    fail-mode: true
code-quality
dependency-management
flakes
nix
nixos

Contributors

lucperkins

113 commits

grahamc

109 commits

cole-h

12 commits

Languages

TypeScript

51.9%

JavaScript

33.4%

Nix

14.7%