Files
NBandClaude Opus 5.5 69bc44c454 Install OpenBot with Nix, and stop self-updates from the Nix store (#2766)
* Install OpenBot with Nix, and stop self-updates from the Nix store

Add a flake that installs the release AppImage on Linux and the app ZIP on
Apple silicon. On Linux, an FHS environment starts the Electron binary
directly, so the Chromium sandbox stays on. The release workflow opens a PR
that updates nix/sources.json from the release SHA256SUMS.txt.

A copy in /nix/store does not update itself. Settings shows that Nix
installs its updates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Keep the write token away from dependency code in the Nix sources job

The checkout no longer saves its credentials. The script runs in a step
with no token. The token step runs outside the checkout and makes the
branch and the commit with the GitHub API, so Git configuration and hooks
that dependency code can write never see the token.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-22 12:18:30 +02:00

28 lines
569 B
JSON

{
"nodes": {
"nixpkgs": {
"locked": {
"lastModified": 1792506237,
"narHash": "sha256-Q/8KLB6jNfpaUN1HAedE/u/Et9feE/zYSsutBLKrCFk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "5adc50831c259f87faeb09ddf930d43597197473",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"root": {
"inputs": {
"nixpkgs": "nixpkgs"
}
}
},
"root": "root",
"version": 7
}