Bumping flake inputs, bisecting input repo for relevant changelog entries

nomeata · February 20, 2023, 7:11am

I’m tempted to create a tool like this, but before I do, I thought I’d check if someone has built it before:

It takes a flakeified repository (e.g. the NixOS configuration of one of my servers), and checks if the nixpkgs input (or any other input) is out of date.
If so, it updates it, and evaluates the outputs, to see if the bump actually mattered. If it doesn’t, do nothing.
Only if it did matter, creates a PR for the bump (or update an existing PR if the previous did not yet go through)

Using a PR means CI checks run; together with a suitable mergify configuration this can be done completely unattended.
Include the changelog from upstream in the PR.

(And don’t forget to munge URLs and PR references so that Github doesn’t spam upstream with “this commit was mentioned…)
Because nixpkgs has lots of commits, and most commits probably don’t affect my build product, the changelog is pruned:

Repeatedly bisect the input git history and evaluate the flake outputs to identify exactly those commits that actually affected me, and only mention those in the build log.

The setup builds on what I have used a lot with niv and https://github.com/knl/niv-updater-action, e.g. in https://github.com/dfinity/motoko/pull/3751, but it doesn’t do steps 3 and 5.

So I wonder: Does a tool that does this upstream-git-log-pruning-by-evaluation thing in step 5 already exist?

nomeata · February 20, 2023, 5:03pm

Thinking more about it, it seems there is a very general git tool lurking in there, that takes a git commit range and a command to run, and returns those commits who affect the output of the command:

git multi-sect abcdef..fedccba -c 'nix-instantiate …'

Very much like git-bisect, but not just bad/good, but any output.

I have not found such a tool so far, so I guess I’ll have to do some yak-shaving first … but hopefully creating a useful tool in the process.

imincik · February 20, 2023, 6:53pm

I use create-pull-request GitHub action to update my Flake inputs. For example here.

nomeata · February 21, 2023, 7:25am

Right, that’s one building block, thanks for the example!

Wouldn’t it be nice to now also have a PR description that lists relevant upstream commits, as convenient links

imincik · February 21, 2023, 8:27am

Yes, let us know if you have some improvements.

nomeata · February 22, 2023, 4:34pm

Almost done with a proof of concept, but now I am hitting the “problem” that NixOS derivations include the nixpkgs commit and other metadata, for example for /etc/issue, and then of course every commit affects the output. I need to find a way to (at least temporarily) disable that behaviour.

Ok, found a work-around:

$ git diff
diff --git a/flake.nix b/flake.nix
index 1892ef8..e4605cf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,7 +8,11 @@
       system = "x86_64-linux";
       specialArgs = attrs;
       modules =
-        [ agenix.nixosModules.default
+        [ (nixpkgs.lib.mkForce {
+            system.nixos.revision = "hidden";
+            system.nixos.versionSuffix = ".hidden";
+          })
+          agenix.nixosModules.default
           ./configuration.nix
         ];
     };

Is there a way to reference a rev of a local git repo without nix including the sourceInfo in the flake output? (One workaround might be to use https://github.com/NixOS/nixpkgs/archive/$REV.tar.gz, but that’s sloooow and wasteful.)

nomeata · February 22, 2023, 5:33pm

First proof of concept seems to work: Here I am being told that among the 15 new commits on the release branch, only two actually affected my particular flake output – and using bisection, it only looked at 6 of them to find that out:

$ ./git-multisect.py -C ~/build/nixpkgs -f 2fb7d74 -t release-22.11 ' --hide-stderr \
    -c 'nix path-info --derivation ~/projekte/nixos/richard#nixosConfigurations.richard.config.system.build.toplevel --no-update-lock-file --override-input nixpkgs ~/"build/nixpkgs?rev=$REV"
Found 15 commits
15 total, 0 relevant, 0 irrelevant, (0 of which were skipped), 15 unknown
Inspecing 2fb7d749c084890192b2cd08ba264e5e4a14df1b ...
Inspecing f27a4e2f6a3a23b843ca1c736e6043fb8b99acc1 ...
15 total, 0 relevant, 0 irrelevant, (0 of which were skipped), 15 unknown
Inspecing de5448dab588ad41aef40f8c7c0c230981656698 ...
15 total, 0 relevant, 7 irrelevant, (6 of which were skipped), 8 unknown
15 total, 0 relevant, 7 irrelevant, (6 of which were skipped), 8 unknown
Inspecing d1c7e63a43e0c3aebef3d4306a8a09f4db0256e4 ...
15 total, 0 relevant, 11 irrelevant, (9 of which were skipped), 4 unknown
15 total, 0 relevant, 11 irrelevant, (9 of which were skipped), 4 unknown
Inspecing a0995268af8ba0336a81344a3bf6a50d6d6481b2 ...
15 total, 0 relevant, 11 irrelevant, (9 of which were skipped), 4 unknown
Inspecing e6d5772f3515b8518d50122471381feae7cbae36 ...
15 total, 0 relevant, 12 irrelevant, (9 of which were skipped), 3 unknown
15 total, 1 relevant, 12 irrelevant, (9 of which were skipped), 2 unknown
15 total, 1 relevant, 12 irrelevant, (9 of which were skipped), 2 unknown
Inspecing 89d036176100a626956d3333508cdea39d84aba8 ...
15 total, 1 relevant, 13 irrelevant, (9 of which were skipped), 1 unknown
15 total, 2 relevant, 13 irrelevant, (9 of which were skipped), 0 unknown

a0995268af8 linux_{5_15,6_1}: revert patch to fix Equinix Metal bonded networking with `ice` driver (#216955)
f27a4e2f6a3 Merge pull request #217008 from NixOS/backport-202245-to-release-22.11

nomeata · February 23, 2023, 9:48am

Allright, here is the tool, in case someone wants to play around with it:

For the particular use case of finding out what affects a NixOS configuration the issue with the embedded revision needs a better solution for this to be really convenient…

nomeata · February 23, 2023, 7:54pm

I found that with documentation.nixos.enable = false; the system configuration becomes much less sensitive to changes to the nixpkgs repo (with that option on, it pulls in nixos documentation, which depends on the full nixos/ directory, so even changes to the implementation of unused nix modules would change the system configuration derivation):

$ git-multisect.py \
	-C ~/build/nixpkgs \
	-f $(nix flake metadata ~/nixos --json|jq -r ".locks.nodes[.locks.nodes[.locks.root].inputs.nixpkgs].locked.rev") \
	-t release-22.11 \
	-c 'nix path-info --derivation '\
	   '~/nixos#nixosConfigurations.richard.config.system.build.toplevel '\
	   '--no-update-lock-file '\
	   '--override-input nixpkgs ~/"build/nixpkgs?rev=$REV"' \
	--hide-stderr --log-option=--pretty=medium
Found 39 commits
[39 total, 0 relevant, 0 irrelevant, 0 skipped, 39 unknown] inspecing 2fb7d74 ...
[39 total, 0 relevant, 0 irrelevant, 0 skipped, 39 unknown] inspecing 569163e ...
[39 total, 0 relevant, 0 irrelevant, 0 skipped, 39 unknown] inspecing 5642ce8 ...
[39 total, 0 relevant, 0 irrelevant, 0 skipped, 39 unknown] inspecing e0c8cf8 ...
[39 total, 0 relevant, 1 irrelevant, 8 skipped, 30 unknown] inspecing 89d0361 ...
[39 total, 0 relevant, 1 irrelevant, 8 skipped, 30 unknown] inspecing d1c7e63 ...
[39 total, 0 relevant, 2 irrelevant, 9 skipped, 28 unknown] inspecing e6d5772 ...
[39 total, 0 relevant, 3 irrelevant, 9 skipped, 27 unknown] inspecing a099526 ...
[39 total, 1 relevant, 4 irrelevant, 9 skipped, 25 unknown] inspecing 854312a ...
[39 total, 1 relevant, 5 irrelevant, 10 skipped, 23 unknown] inspecing 95043dc ...
[39 total, 1 relevant, 6 irrelevant, 10 skipped, 22 unknown] inspecing 0cf4274 ...
[39 total, 2 relevant, 8 irrelevant, 29 skipped, 0 unknown] done

commit a0995268af8ba0336a81344a3bf6a50d6d6481b2
Author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Date:   Sat Feb 18 10:45:11 2023 -0800

    linux_{5_15,6_1}: revert patch to fix Equinix Metal bonded networking with `ice` driver (#216955)
…
commit 0cf4274b5d06325bd16dbf879a30981bc283e58a
Merge: 95043dc713d 532f3aa6052
Author: Pierre Bourdon <delroth@gmail.com>
Date:   Sun Feb 19 23:37:48 2023 +0900

    Merge pull request #217121 from NixOS/backport-216463-to-release-22.11

    [Backport release-22.11] sudo: 1.9.12p2 -> 1.9.13

nomeata · July 15, 2023, 10:36am

I still didn’t get around of packaging this properly, but today, before updating my nixos configuration, I tried to use it again.

I first had to temporarily change my nixos configuration to

Include a module to set

        (nixpkgs.lib.mkForce {
           system.nixos.revision = "hidden";
           system.nixos.versionSuffix = ".hidden";
           documentation.nixos.enable = false;
        })

so that the revision isn’t part of the derivation, and that we don’t build the nixos documentation, which itself depends on a large part of the nixpkgs source tree.

Remove (my adapted version of) the flake.nix module, as it includes the path of the nixpkgs sources in /etc/nixpkgs/channels, which of course defeats the purpose.

There were 279 commits between my state and the latest release-23.05, and the tool had to evaluate 74 of them to find out that only 16 actually affected my system configuration:

Full log

Found 279 commits
[  0 relevant,   0 irrelevant,   0 skipped, 279 unknown] 🔎   0/279 0f7f5ca ...
[  0 relevant,   0 irrelevant,   0 skipped, 279 unknown] 🔎 279/279 61b277b ...
[  0 relevant,   0 irrelevant,   0 skipped, 279 unknown] 🔎 139/279 8a8d78c ...
[  0 relevant,   0 irrelevant,   0 skipped, 279 unknown] 🔎  69/279 9ac1280 ...
[  0 relevant,   0 irrelevant,   0 skipped, 279 unknown] 🔎  34/279 cdfdc7a ...
[  0 relevant,   0 irrelevant,   0 skipped, 279 unknown] 🔎  17/279 199f37e ...
[  0 relevant,   1 irrelevant,  16 skipped, 262 unknown] 🔎  25/279 44be25f ...
[  0 relevant,   2 irrelevant,  23 skipped, 254 unknown] 🔎  29/279 8c11bac ...
[  0 relevant,   3 irrelevant,  27 skipped, 249 unknown] 🔎  27/279 4b2b21e ...
[  0 relevant,   4 irrelevant,  28 skipped, 247 unknown] 🔎  28/279 456af4e ...
[  1 relevant,   5 irrelevant,  28 skipped, 245 unknown] 🔎  51/279 d2bb180 ...
[  1 relevant,   5 irrelevant,  28 skipped, 245 unknown] 🔎  42/279 ab59484 ...
[  1 relevant,   6 irrelevant,  36 skipped, 236 unknown] 🔎  38/279 887b93a ...
[  1 relevant,   7 irrelevant,  39 skipped, 232 unknown] 🔎  40/279 28e673c ...
[  1 relevant,   8 irrelevant,  40 skipped, 230 unknown] 🔎  41/279 375ecfd ...
[  2 relevant,   9 irrelevant,  40 skipped, 228 unknown] 🔎  60/279 7098a46 ...
[  2 relevant,   9 irrelevant,  40 skipped, 228 unknown] 🔎  55/279 8d3dea2 ...
[  2 relevant,  10 irrelevant,  43 skipped, 224 unknown] 🔎  57/279 3a70dd9 ...
[  2 relevant,  11 irrelevant,  44 skipped, 222 unknown] 🔎  58/279 542ccc3 ...
[  2 relevant,  12 irrelevant,  44 skipped, 221 unknown] 🔎  59/279 4105591 ...
[  3 relevant,  13 irrelevant,  44 skipped, 219 unknown] 🔎  64/279 4ecab32 ...
[  3 relevant,  14 irrelevant,  47 skipped, 215 unknown] 🔎  66/279 7d97289 ...
[  3 relevant,  15 irrelevant,  48 skipped, 213 unknown] 🔎  67/279 d863cec ...
[  3 relevant,  16 irrelevant,  48 skipped, 212 unknown] 🔎  68/279 ee5714f ...
[  4 relevant,  17 irrelevant,  48 skipped, 210 unknown] 🔎 104/279 0744b0f ...
[  4 relevant,  17 irrelevant,  48 skipped, 210 unknown] 🔎  86/279 0bff98d ...
[  4 relevant,  18 irrelevant,  64 skipped, 193 unknown] 🔎  95/279 5d37ab2 ...
[  4 relevant,  19 irrelevant,  72 skipped, 184 unknown] 🔎  99/279 f3b728a ...
[  4 relevant,  20 irrelevant,  76 skipped, 179 unknown] 🔎  97/279 dd5ea4a ...
[  4 relevant,  21 irrelevant,  77 skipped, 177 unknown] 🔎  96/279 e26d017 ...
[  5 relevant,  22 irrelevant,  77 skipped, 175 unknown] 🔎 121/279 d5760df ...
[  5 relevant,  23 irrelevant,  93 skipped, 158 unknown] 🔎 130/279 6546ccd ...
[  5 relevant,  24 irrelevant, 101 skipped, 149 unknown] 🔎 134/279 1e13eca ...
[  5 relevant,  25 irrelevant, 104 skipped, 145 unknown] 🔎 136/279 ff92c8e ...
[  5 relevant,  26 irrelevant, 106 skipped, 142 unknown] 🔎 135/279 c14e00a ...
[  6 relevant,  27 irrelevant, 106 skipped, 140 unknown] 🔎 209/279 a06ee91 ...
[  6 relevant,  27 irrelevant, 106 skipped, 140 unknown] 🔎 174/279 122b4ef ...
[  6 relevant,  27 irrelevant, 106 skipped, 140 unknown] 🔎 156/279 237c40f ...
[  6 relevant,  28 irrelevant, 123 skipped, 122 unknown] 🔎 147/279 4e1d559 ...
[  6 relevant,  29 irrelevant, 130 skipped, 114 unknown] 🔎 151/279 9208e34 ...
[  6 relevant,  30 irrelevant, 133 skipped, 110 unknown] 🔎 153/279 67fd90b ...
[  6 relevant,  31 irrelevant, 134 skipped, 108 unknown] 🔎 154/279 e90fc43 ...
[  7 relevant,  32 irrelevant, 135 skipped, 105 unknown] 🔎 191/279 a0eedf4 ...
[  7 relevant,  33 irrelevant, 152 skipped,  87 unknown] 🔎 182/279 fb47e77 ...
[  7 relevant,  33 irrelevant, 152 skipped,  87 unknown] 🔎 178/279 38e8868 ...
[  7 relevant,  33 irrelevant, 152 skipped,  87 unknown] 🔎 176/279 4be6954 ...
[  7 relevant,  34 irrelevant, 153 skipped,  85 unknown] 🔎 177/279 736fad0 ...
[  8 relevant,  35 irrelevant, 153 skipped,  83 unknown] 🔎 180/279 5d9f7a2 ...
[  8 relevant,  36 irrelevant, 154 skipped,  81 unknown] 🔎 181/279 248a0d1 ...
[  9 relevant,  37 irrelevant, 154 skipped,  79 unknown] 🔎 186/279 5c4b536 ...
[  9 relevant,  38 irrelevant, 158 skipped,  74 unknown] 🔎 184/279 e2e153c ...
[  9 relevant,  39 irrelevant, 159 skipped,  72 unknown] 🔎 185/279 a0ebfbd ...
[ 10 relevant,  40 irrelevant, 159 skipped,  70 unknown] 🔎 244/279 0898bf7 ...
[ 10 relevant,  40 irrelevant, 159 skipped,  70 unknown] 🔎 226/279 72bd1f3 ...
[ 10 relevant,  40 irrelevant, 159 skipped,  70 unknown] 🔎 217/279 9b0feb8 ...
[ 10 relevant,  40 irrelevant, 159 skipped,  70 unknown] 🔎 213/279 13532d8 ...
[ 10 relevant,  41 irrelevant, 162 skipped,  66 unknown] 🔎 211/279 1b84ba0 ...
[ 10 relevant,  42 irrelevant, 163 skipped,  64 unknown] 🔎 212/279 a28cf89 ...
[ 11 relevant,  43 irrelevant, 163 skipped,  62 unknown] 🔎 221/279 0094922 ...
[ 11 relevant,  44 irrelevant, 167 skipped,  57 unknown] 🔎 219/279 cff4709 ...
[ 11 relevant,  44 irrelevant, 167 skipped,  57 unknown] 🔎 218/279 d3bb401 ...
[ 12 relevant,  45 irrelevant, 167 skipped,  55 unknown] 🔎 220/279 067a81a ...
[ 13 relevant,  46 irrelevant, 167 skipped,  53 unknown] 🔎 235/279 c83225c ...
[ 13 relevant,  47 irrelevant, 175 skipped,  44 unknown] 🔎 239/279 03a3f8c ...
[ 13 relevant,  48 irrelevant, 179 skipped,  39 unknown] 🔎 237/279 63e752b ...
[ 13 relevant,  49 irrelevant, 180 skipped,  37 unknown] 🔎 236/279 5f6396e ...
[ 14 relevant,  50 irrelevant, 180 skipped,  35 unknown] 🔎 261/279 c702c94 ...
[ 14 relevant,  50 irrelevant, 180 skipped,  35 unknown] 🔎 252/279 8022f0a ...
[ 14 relevant,  51 irrelevant, 188 skipped,  26 unknown] 🔎 248/279 32b94c2 ...
[ 14 relevant,  52 irrelevant, 191 skipped,  22 unknown] 🔎 246/279 a83842a ...
[ 14 relevant,  53 irrelevant, 192 skipped,  20 unknown] 🔎 245/279 5d3e4f9 ...
[ 15 relevant,  54 irrelevant, 192 skipped,  18 unknown] 🔎 270/279 09014d2 ...
[ 15 relevant,  55 irrelevant, 200 skipped,   9 unknown] 🔎 274/279 962e762 ...
[ 15 relevant,  56 irrelevant, 204 skipped,   4 unknown] 🔎 272/279 183031f ...
[ 15 relevant,  57 irrelevant, 205 skipped,   2 unknown] 🔎 273/279 78c0359 ...
[ 16 relevant,  58 irrelevant, 205 skipped,   0 unknown] done

commit 8c11bacbe0b6c9a9556920468d28b0d27eb79e63
Merge: 456af4e1746 b0738abee59
Author: Nick Cao <nickcao@nichi.co>
Date:   Tue May 30 20:00:20 2023 -0600

    Merge pull request #234992 from NixOS/backport-234780-to-release-23.05

    [Backport release-23.05] libreoffice-still: 7.4.6.2 -> 7.4.7.2, libreoffice-fresh 7.5.2.2 -> 7.5.4.1
commit ab5948439b732adbd7651f61cc639e4869f13804
Author: Bernardo Meurer <bernardo@meurer.org>
Date:   Tue May 30 10:09:44 2023 -0400

    linux: 6.3.4 -> 6.3.5

    (cherry picked from commit 775eba57583bbe97c22f0a61932c95768358be88)
commit 41055915ba6e8a726c8405723bb8161bd28290d9
Merge: 542ccc3f668 d6247c820e8
Author: maxine <35892750+maxeaubrey@users.noreply.github.com>
Date:   Wed May 31 14:47:05 2023 +0200

    Merge pull request #235174 from NixOS/backport-234924-to-release-23.05

    [Backport release-23.05] webkitgtk: 2.40.1 → 2.40.2
commit ee5714f55209b42990643b78a66b51331a5b3490
Merge: d863cecef71 ce4afe9b5a6
Author: Nick Cao <nickcao@nichi.co>
Date:   Wed May 31 20:45:53 2023 -0600

    Merge pull request #235253 from NixOS/backport-235169-to-release-23.05

    [Backport release-23.05] chromium: 113.0.5672.126 -> 114.0.5735.90
commit dd5ea4aa63eafe67a8f394856095f867a001a5ca
Merge: e26d017ba57 b2b6dffaacc
Author: Kerstin <kerstin@erictapen.name>
Date:   Fri Jun 2 19:45:12 2023 +0200

    Merge pull request #235597 from NixOS/backport-235548-to-release-23.05

    [Backport release-23.05] imagemagick: 7.1.1-10 -> 7.1.1-11
commit ff92c8e9949124cc2822be17122f6ad74a55fb4f
Merge: c14e00a27cd 9ed2f8c3c8e
Author: Martin Weinelt <hexa@darmstadt.ccc.de>
Date:   Tue Jun 6 01:47:47 2023 +0200

    Merge pull request #236155 from NixOS/backport-236108-to-release-23.05

    [Backport release-23.05] firefox-unwrapped: 113.0.2 -> 114.0
commit e90fc434a584c9d2a209b435c3c66cacf9f3f919
Merge: 67fd90bae4a 52b453c3ac2
Author: Nick Cao <nickcao@nichi.co>
Date:   Tue Jun 6 20:39:51 2023 -0600

    Merge pull request #236324 from NixOS/backport-236262-to-release-23.05

    [Backport release-23.05] chromium: 114.0.5735.90 -> 114.0.5735.106
commit 736fad09031bb69ce291c69d8c755fc12200b79a
Author: Ali Caglayan <alizter@gmail.com>
Date:   Tue May 23 12:50:44 2023 +0200

    dune_3: 3.7.1 -> 3.8.1

    Signed-off-by: Ali Caglayan <alizter@gmail.com>
    (cherry picked from commit eaa13f34501529446de00aa1630a81674e59a276)
commit fb47e775ced069d965b4c1313e9b0b5266897490
Merge: 248a0d15f15 861559d3407
Author: Vladimír Čunát <v@cunat.cz>
Date:   Thu Jun 8 13:19:13 2023 +0200

    Merge #236630: firefox-bin-unwrapped: patch new glxtest/vaapitest binaries

    ...into release-23.05
commit 5c4b536bc7e94fec9ea542ffde996646a77f33e5
Merge: a0ebfbdae04 c77160a2935
Author: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date:   Thu Jun 8 15:12:27 2023 +0300

    Merge pull request #236430 from lorenzleutgeb/backport-nix-to-23.05

    [23.05] nixVersions: 2.15.0 -> 2.15.1, nixVersions: add 2.16.1, nixVersions.minver: init
commit 13532d86195eb0c973ec328fb90f60d263eb2eb4
Merge: a28cf891f24 34e65e5b37c
Author: Martin Weinelt <hexa@darmstadt.ccc.de>
Date:   Sat Jun 10 08:25:03 2023 +0200

    Merge pull request #236874 from NixOS/backport-236856-to-release-23.05

    [Backport release-23.05] firefox-{,bin-}unwrapped: 114.0 -> 114.0.1
commit d3bb401dcfc5a46ce51cdfb5762e70cc75d082d2 (upstream/nixos-23.05)
Merge: 9b0feb8e43d f06138781a4
Author: Vladimír Čunát <v@cunat.cz>
Date:   Sat Jun 10 23:11:22 2023 +0200

    Merge #235957: staging-next-23.05 - iteration 1

    ...into release-23.05
commit 0094922551f03ed1456e6b735fd8127cc5f84ed9
Author: Vladimír Čunát <v@cunat.cz>
Date:   Sun Jun 11 10:33:42 2023 +0200

    cairo: update outdated patch link

    Minimalist part picked from PR #236764
commit 5f6396e85487aa59c801da5f7c87ac20098b2fa8
Merge: c83225c5539 8cc0d8bf449
Author: Mario Rodas <marsam@users.noreply.github.com>
Date:   Sun Jun 11 18:42:09 2023 -0500

    Merge pull request #236489 from NixOS/backport-236358-to-release-23.05

    [Backport release-23.05] go_1_19: 1.19.9 -> 1.19.10
commit a83842a466eeab786fa3a4fe4b4c661faceb5eb6
Merge: 5d3e4f99aaf 948b43c6703
Author: Robert Hensing <robert@roberthensing.nl>
Date:   Mon Jun 12 13:33:23 2023 +0200

    Merge pull request #237329 from NixOS/backport-237218-to-release-23.05

    [Backport release-23.05] nixos-generate-config: Fix generated hostPlatform.system
commit 962e7627382d431df6d69e01541a30727096375f
Merge: 78c0359b1ee 8af0eac1c82
Author: Maximilian Bosch <maximilian@mbosch.me>
Date:   Tue Jun 13 13:04:34 2023 +0200

    Merge pull request #237528 from Ma27/backport-linux-kernels

    [23.05] Backport Linux kernel updates (2023-06-06 & 2023-06-09)

It wasn’t particularly fast (took 11 minutes). And while most commits are fairly straight forward single changes, this isn’t true for PRs that merge from staging-next such as this one.

Possible further next steps:

Define a new output of my flake, say change-sentinel, which is my NixOS configuration with the changes mentioned above applied. Then I wouldn’t have to change my config to run this check.

Furthermore, this could be an idiom that can be recognized by a general “show me all changes” tool. It wouldn’t even be specific to NixOS configurations, as it would only care about the flake.lock file to see which imports have changed, and the change-sentinel output.
Create a github bot that comments PRs that bump the dependency (like those created by flake-update-lock) with the out of this tool.
Maybe extend git-multisect to recognize merge conflicts, and then also trace the commits on the branch? But there the risk that some fail to evaluate is higher. And maybe it’s too much detail.