fix: don't run the lefthook hook setup if in a git worktree

.envrc

@@ -1,11 +1,8 @@
 #!/bin/sh
 
-# first time
-if [[ ! -d $(nix store add-path --name source --dry-run .) ]]; then
-  nix store add-path --name source .
-  (cd ./src/local && nix flake lock --update-input std)
-  (cd ./src/tests && nix flake lock --update-input std)
-fi
+# This locks subflakes to the latest commit of std
+(cd ./src/local && nix flake lock --override-input std "git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)")
+(cd ./src/tests && nix flake lock --override-input std "git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)")
 
 # shellcheck disable=SC1090
 . "$(fetchurl "https://raw.githubusercontent.com/paisano-nix/direnv/main/lib" "sha256-IgQhKK7UHL1AfCUntJO2KCaIDJQotRnK2qC4Daxk+wI=")"

.git-blame-ignore-revs

@@ -0,0 +1 @@
+663321ed4f88c1af3127195c6b9a2130c22a11ab

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
   mac:
     uses: ./.github/workflows/std.yml
     with:
-      runs-on: macOS-13
+      runs-on: macOS-latest
     secrets: inherit
 
   linux:

.github/workflows/gh-pages.yaml

@@ -13,7 +13,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
 
-      - uses: nixbuild/nix-quick-install-action@v25
+      - uses: nixbuild/nix-quick-install-action@v32
 
       - name: Update subflake references
         run: ./.github/workflows/update-subflake.sh

.github/workflows/std.yml

@@ -23,8 +23,8 @@ jobs:
 
     runs-on: ${{ inputs.runs-on }}
     steps:
-      - uses: actions/checkout@v3
-      - uses: nixbuild/nix-quick-install-action@v25
+      - uses: actions/checkout@v6
+      - uses: nixbuild/nix-quick-install-action@v32
       - name: Update subflake references
         run: ./.github/workflows/update-subflake.sh
       # - uses: DeterminateSystems/magic-nix-cache-action@main
@@ -40,7 +40,7 @@ jobs:
     name: ${{ matrix.target.jobName }}
     runs-on: ${{ inputs.runs-on }}
     steps:
-      - uses: nixbuild/nix-quick-install-action@v25
+      - uses: nixbuild/nix-quick-install-action@v32
       # - uses: DeterminateSystems/magic-nix-cache-action@main
       - uses: divnix/std-action/run@main
 
@@ -53,7 +53,7 @@ jobs:
     name: ${{ matrix.target.jobName }}
     runs-on: ${{ inputs.runs-on }}
     steps:
-      - uses: nixbuild/nix-quick-install-action@v25
+      - uses: nixbuild/nix-quick-install-action@v32
       # - uses: DeterminateSystems/magic-nix-cache-action@main
       - uses: divnix/std-action/run@main
 
@@ -66,7 +66,7 @@ jobs:
     name: ${{ matrix.target.jobName }}
     runs-on: ${{ inputs.runs-on }}
     steps:
-      - uses: nixbuild/nix-quick-install-action@v25
+      - uses: nixbuild/nix-quick-install-action@v32
       - uses: actions/checkout@v3
       - name: Update subflake references
         run: ./.github/workflows/update-subflake.sh

.github/workflows/update-subflake.sh

@@ -1,12 +1,6 @@
 # create the store path of
 nix store add-path --name source .
 
-# update the subflake lockfile to the (now existing) store path
-# set lastModified to 1 because unknown issues in the GH action environment
-(cd ./src/local && nix flake lock --update-input std && (
-  jq '.nodes.std.locked.lastModified = 1' flake.lock > flake.lock.new && rm flake.lock && mv flake.lock.new flake.lock
-) && git add -f flake.lock)
-(cd ./src/tests && nix flake lock --update-input std && (
-  jq '.nodes.std.locked.lastModified = 1' flake.lock > flake.lock.new && rm flake.lock && mv flake.lock.new flake.lock
-) &&git add -f flake.lock)
-# continue normally ...
+# This locks subflakes to the latest commit of std
+(cd ./src/local && nix flake lock --override-input std "git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)&shallow=1")
+(cd ./src/tests && nix flake lock --override-input std "git+file://$(pwd)/../..?rev=$(git -C ../.. rev-parse HEAD)&shallow=1")

MERGED_PR

@@ -0,0 +1,5 @@
+A list of the PRs that I merged from divnix/std in this repo
+
+- [refactor: change subflake locking to an absolute git locking strategy for compatibility with nix 2.18](https://github.com/divnix/std/pull/418)
+- [Fix prettier](https://github.com/divnix/std/pull/419)
+- [Pass down $@ to the copy function in the container's publish command](https://github.com/divnix/std/pull/421)

Makefile

@@ -0,0 +1,71 @@
+root = $(shell git rev-parse --show-toplevel)
+SYSTEM := $(shell nix eval --impure --raw --expr 'builtins.currentSystem')
+LINUX := x86_64-linux
+DARWIN := aarch64-darwin
+
+.PHONY: fmt
+fmt:
+	treefmt
+
+update-sub-flake:
+	cd $(root)
+	cd src/local && nix flake update
+	cd src/tests && nix flake update
+
+ci-local: ci-checks ci-cli ci-shells ci-format
+	@echo "=== All CI checks passed ==="
+
+ci-all: ci-checks-all ci-cli-all ci-shells-all ci-format
+	@echo "=== All CI checks passed (all systems) ==="
+
+# Not in ci-local by default: dirties flake.lock files, requires committed HEAD.
+# Add to ci-local prereqs if full CI parity needed.
+ci-sync:
+	@echo "=== Syncing subflake locks ==="
+	./.github/workflows/update-subflake.sh
+
+ci-checks:
+	@echo "=== Running checks ==="
+	nix build .#checks.$(SYSTEM) --no-link
+
+ci-checks-all: ci-checks-linux ci-checks-darwin
+ci-checks-linux:
+	@echo "=== Running checks (linux) ==="
+	nix build .#checks.$(LINUX) --no-link
+ci-checks-darwin:
+	@echo "=== Running checks (darwin) ==="
+	nix build .#checks.$(DARWIN) --no-link
+
+ci-cli:
+	@echo "=== Building CLI ==="
+	nix build .#packages.$(SYSTEM).default
+
+ci-cli-all: ci-cli-linux ci-cli-darwin
+ci-cli-linux:
+	@echo "=== Building CLI (linux) ==="
+	nix build .#packages.$(LINUX).default
+ci-cli-darwin:
+	@echo "=== Building CLI (darwin) ==="
+	nix build .#packages.$(DARWIN).default
+
+ci-shells:
+	@echo "=== Building devshells ==="
+	nix build .#devShells.$(SYSTEM).default --no-link
+
+ci-shells-all: ci-shells-linux ci-shells-darwin
+ci-shells-linux:
+	@echo "=== Building devshells (linux) ==="
+	nix build .#devShells.$(LINUX).default --no-link
+ci-shells-darwin:
+	@echo "=== Building devshells (darwin) ==="
+	nix build .#devShells.$(DARWIN).default --no-link
+
+ci-format:
+	@echo "=== Checking formatting ==="
+	treefmt --fail-on-change
+
+.PHONY: update-sub-flake ci-local ci-all ci-sync
+.PHONY: ci-checks ci-checks-all ci-checks-linux ci-checks-darwin
+.PHONY: ci-cli ci-cli-all ci-cli-linux ci-cli-darwin
+.PHONY: ci-shells ci-shells-all ci-shells-linux ci-shells-darwin
+.PHONY: ci-format

flake.nix

@@ -4,8 +4,20 @@
 # SPDX-License-Identifier: Unlicense
 {
   description = "The Nix Flakes framework for perfectionists with deadlines";
+  # 2026-02-26 @mayeu: I don't understand what it is, and why it's there
+  # but it doesn't work for me:
+  #
+  #     ➜ nix --version
+  #     ➜ direnv allow
+  #     error: flake 'self' attribute 'shallow' is not supported
+  #     direnv: The follwing command just failed:
+  #     direnv: nix build --no-update-lock-file --no-write-lock-file --no-warn-dirty --accept-flake-config --no-link --keep-outputs --build-poll-interval 0 --builders-use-substitutes --print-out-paths --profile /Users/m/code-des-autres/std/.data/local/shells/default/enter-action git+file:///Users/m/code-des-autres/std#__std.actions.aarch64-darwin.local.shells.default.enter
+  #     Rerun with --show-trace (y/N): y
+  #     error: flake 'self' attribute 'shallow' is not supported.
+  #
+  #inputs.self.shallow = true;
   # override downstream with inputs.std.inputs.nixpkgs.follows = ...
-  inputs.nixpkgs.url = "github:nixos/nixpkgs/release-23.11";
+  inputs.nixpkgs.url = "github:nixos/nixpkgs/release-25.11";
   inputs.lib.url = "github:nix-community/nixpkgs.lib";
   inputs = {
     paisano.url = "github:paisano-nix/core/0.2.0";
@@ -70,7 +82,7 @@
       inherit (fwlib') blockTypes actions dataWith flakeModule grow growOn findTargets;
     };
   in
-    assert inputs.nixpkgs.lib.assertMsg ((builtins.compareVersions builtins.nixVersion "2.13") >= 0) "The truth is: you'll need a newer nix version to use Standard (minimum: v2.13).";
+    assert inputs.nixpkgs.lib.assertMsg ((builtins.compareVersions builtins.nixVersion "2.23") >= 0) "The truth is: you'll need a newer nix version to use Standard (minimum: v2.23).";
       (import ./dogfood.nix (inputs
         // {
           std = std // {inherit (inputs.self) narHash;};

src/data/configs/lefthook.nix

@@ -19,6 +19,7 @@ in {
         treefmt = {
           run = "${lib.getExe nixpkgs.treefmt} --fail-on-change {staged_files}";
           skip = ["merge" "rebase"];
+          interactive = true;
         };
       };
     };

src/data/configs/mdbook.nix

@@ -6,7 +6,6 @@ in {
   packages = [
     nixpkgs.alejandra
     nixpkgs.nodePackages.prettier
-    nixpkgs.nodePackages.prettier-plugin-toml
     nixpkgs.shfmt
     mdbook-paisano-preprocessor
   ];

src/data/configs/treefmt.nix

@@ -5,7 +5,6 @@ in {
   packages = [
     nixpkgs.alejandra
     nixpkgs.nodePackages.prettier
-    nixpkgs.nodePackages.prettier-plugin-toml
     nixpkgs.shfmt
   ];
 
@@ -17,7 +16,6 @@ in {
       };
       prettier = {
         command = lib.getExe nixpkgs.nodePackages.prettier;
-        options = ["--plugin" "${nixpkgs.nodePackages.prettier-plugin-toml}/lib/node_modules/prettier-plugin-toml/lib/index.js" "--write"];
         includes = [
           "*.css"
           "*.html"

src/lib/cfg/lefthook.md

@@ -11,3 +11,62 @@
 ```nix
 {{#include ../../src/lib/cfg/lefthook.nix}}
 ```
+
+#### Explanation of the `in { ... }` block
+
+This `in { ... }` block is a **Nixago configuration record**, it tells the
+Nixago block type how to generate and manage the `lefthook.yml` file.
+
+`data = {};` is The actual lefthook config content. It's empty here because this
+is just the template/scaffold, the real config data gets merged in by consumers
+(e.g. in `src/local/configs.nix` or wherever this is used). Nixago deep-merges
+`data` from the caller.
+
+`hook.extra` is a Nixago hook hat runs whenever the generated `lefthook.yml` is
+materialized. It receives the final merged `config` (the full lefthook YAML
+content as a Nix attrset) and produces extra shell commands. Here's the pipeline
+step by step:
+
+```nix
+hook.extra = config:
+  let
+    commands = lib.pipe config [
+      # 1. Strip non-stage keys (colors, extends, etc.)
+      #    e.g. { pre-commit = {...}; commit-msg = {...}; colors = true; }
+      #    becomes { pre-commit = {...}; commit-msg = {...}; }
+      toStagesConfig
+
+      # 2. Extract just the attribute names → ["pre-commit" "commit-msg"]
+      lib.attrNames
+
+      # 3. For each stage, create a symlink command:
+      #    ln -sf "/nix/store/...-lefthook-pre-commit" ".git/hooks/pre-commit"
+      #    The target is a Nix-built script (mkScript) that runs:
+      #      lefthook run "pre-commit" "$@"
+      #    (unless $LEFTHOOK == "0", which disables it)
+      (lib.map (stage: ''ln -sf "${mkScript stage}" ".git/hooks/${stage}"''))
+
+      # 4. Prepend "mkdir -p .git/hooks" IF there are any stages
+      #    ["mkdir -p .git/hooks" "ln -sf ..." "ln -sf ..."]
+      (stages:
+        lib.optional (stages != []) "mkdir -p .git/hooks"
+        ++ stages)
+
+      # 5. Join into a single newline-separated shell script string
+      (lib.concatStringsSep "\n")
+    ];
+  in ''
+    # Only install hooks in the main repo, not in worktrees.
+    # In worktrees, .git is a file pointing to the main repo's .git dir,
+    # so mkdir -p .git/hooks would fail.
+    if test "$(git rev-parse --git-dir)" = "$(git rev-parse --git-common-dir)"; then
+      ${commands}
+    fi
+  '';
+```
+
+When you run the Nixago hook (e.g. via `direnv allow` or `std` commands), it:
+
+1. Writes `lefthook.yml` to your project root
+2. Runs this `hook.extra` script, which symlinks Nix-built wrapper scripts into
+   `.git/hooks/` (only in the main repo, not in worktrees)

src/lib/cfg/lefthook.nix

@@ -21,9 +21,10 @@ in {
   format = "yaml";
   output = "lefthook.yml";
   packages = [nixpkgs.lefthook];
-  # Add an extra hook for adding required stages whenever the file changes
-  hook.extra = config:
-    lib.pipe config [
+  # Add an extra hook for adding required stages whenever the file changes.
+  # Skip hook installation in git worktrees where .git is a file, not a directory.
+  hook.extra = config: let
+    commands = lib.pipe config [
       toStagesConfig
       lib.attrNames
       (lib.map (stage: ''ln -sf "${mkScript stage}" ".git/hooks/${stage}"''))
@@ -32,4 +33,9 @@ in {
         ++ stages)
       (lib.concatStringsSep "\n")
     ];
+  in ''
+    if test "$(${lib.getExe nixpkgs.git} rev-parse --git-dir 2>/dev/null)" = "$(${lib.getExe nixpkgs.git} rev-parse --git-common-dir 2>/dev/null)"; then
+      ${commands}
+    fi
+  '';
 }

src/local/configs.nix

@@ -18,7 +18,7 @@ in {
       global.excludes = ["src/std/templates/**"];
       formatter = {
         go = {
-          command = "gofmt";
+          command = "${nixpkgs.go}/bin/gofmt";
           options = ["-w"];
           includes = ["*.go"];
         };