ci: pin nix run nixpkgs to the flake's nixpkgs

.github/workflows/ami-release-nix.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Set PostgreSQL versions
         id: set-versions
         run: |
-          VERSIONS=$(nix run nixpkgs#yq-go -- -o=json -I=0 '.postgres_major' ansible/vars.yml)
+          VERSIONS=$(nix run --inputs-from . nixpkgs#yq-go -- -o=json -I=0 '.postgres_major' ansible/vars.yml)
           echo "postgres_versions=$VERSIONS" >> "$GITHUB_OUTPUT"
 
   build:

.github/workflows/dockerhub-release-matrix.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Generate build matrix
         id: set-matrix
         run: |
-          nix run nixpkgs#nushell -- -c 'let versions = (open ansible/vars.yml | get postgres_major)
+          nix run --inputs-from . nixpkgs#nushell -- -c 'let versions = (open ansible/vars.yml | get postgres_major)
           let base_matrix = ($versions | each { |ver|
             let version = ($ver | str trim)
             let dockerfile = $"Dockerfile-($version)"
@@ -80,7 +80,7 @@ jobs:
 
       - id: args
         run: |
-          nix run nixpkgs#nushell -- -c '
+          nix run --inputs-from . nixpkgs#nushell -- -c '
             open ansible/vars.yml 
             | items { |key value| {name: $key, item: $value} } 
             | where { |it| ($it.item | describe) == "string" } 
@@ -112,7 +112,7 @@ jobs:
         id: image
         run: |
           if [[ "${{ matrix.arch }}" == "arm64" ]]; then
-            pg_version=$(nix run nixpkgs#nushell -- -c '
+            pg_version=$(nix run --inputs-from . nixpkgs#nushell -- -c '
               let version = "${{ matrix.postgres.version }}"
               let is_multigres = ($version | str starts-with "multigres-")
               let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version }
@@ -126,7 +126,7 @@ jobs:
             ')
             echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT
           else
-            pg_version=$(nix run nixpkgs#nushell -- -c '
+            pg_version=$(nix run --inputs-from . nixpkgs#nushell -- -c '
               let version = "${{ matrix.postgres.version }}"
               let is_multigres = ($version | str starts-with "multigres-")
               let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version }
@@ -170,7 +170,7 @@ jobs:
       - name: Get image tag
         id: get_version
         run: |
-          nix run nixpkgs#nushell -- -c '
+          nix run --inputs-from . nixpkgs#nushell -- -c '
             let version = "${{ matrix.version }}"
             let is_multigres = ($version | str starts-with "multigres-")
             let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version }
@@ -217,7 +217,7 @@ jobs:
       - name: Get Versions from Matrix Config
         id: get_versions
         run: |
-          nix run nixpkgs#nushell -- -c '
+          nix run --inputs-from . nixpkgs#nushell -- -c '
             # Parse the matrix configuration directly
             let matrix_config = (${{ toJson(needs.prepare.outputs.matrix_config) }} | from json)
 
@@ -237,7 +237,7 @@ jobs:
       - name: Combine Results
         id: combine
         run: |
-          nix run nixpkgs#nushell -- -c '
+          nix run --inputs-from . nixpkgs#nushell -- -c '
             # Get all results files and process them in one go
             let files = (ls **/results.txt | get name)
             echo $"Found files: ($files)"

.github/workflows/manual-docker-release.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Generate build matrix
         id: set-matrix
         run: |
-          nix run nixpkgs#nushell -- -c 'let versions = (open ansible/vars.yml | get postgres_major)
+          nix run --inputs-from . nixpkgs#nushell -- -c 'let versions = (open ansible/vars.yml | get postgres_major)
           let base_matrix = ($versions | each { |ver|
             let version = ($ver | str trim)
             let dockerfile = $"Dockerfile-($version)"
@@ -78,7 +78,7 @@ jobs:
 
       - id: args
         run: |
-          nix run nixpkgs#nushell -- -c '
+          nix run --inputs-from . nixpkgs#nushell -- -c '
             open ansible/vars.yml 
             | items { |key value| {name: $key, item: $value} } 
             | where { |it| ($it.item | describe) == "string" } 
@@ -110,7 +110,7 @@ jobs:
         id: image
         run: |
           if [[ "${{ matrix.arch }}" == "arm64" ]]; then
-            pg_version=$(nix run nixpkgs#nushell -- -c '
+            pg_version=$(nix run --inputs-from . nixpkgs#nushell -- -c '
               let version = "${{ matrix.postgres.version }}"
               let is_multigres = ($version | str starts-with "multigres-")
               let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version }
@@ -129,7 +129,7 @@ jobs:
             ')
             echo "pg_version=supabase/postgres:$pg_version" >> $GITHUB_OUTPUT
           else
-            pg_version=$(nix run nixpkgs#nushell -- -c '
+            pg_version=$(nix run --inputs-from . nixpkgs#nushell -- -c '
               let version = "${{ matrix.postgres.version }}"
               let is_multigres = ($version | str starts-with "multigres-")
               let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version }
@@ -178,7 +178,7 @@ jobs:
       - name: Get image tag
         id: get_version
         run: |
-          nix run nixpkgs#nushell -- -c '
+          nix run --inputs-from . nixpkgs#nushell -- -c '
             let version = "${{ matrix.version }}"
             let is_multigres = ($version | str starts-with "multigres-")
             let base_version = if $is_multigres { $version | str replace "multigres-" "" } else { $version }
@@ -225,7 +225,7 @@ jobs:
       - name: Get Versions from Matrix Config
         id: get_versions
         run: |
-          nix run nixpkgs#nushell -- -c '
+          nix run --inputs-from . nixpkgs#nushell -- -c '
             # Parse the matrix configuration directly
             let matrix_config = (${{ toJson(needs.prepare.outputs.matrix_config) }} | from json)
 
@@ -245,7 +245,7 @@ jobs:
       - name: Combine Results
         id: combine
         run: |
-          nix run nixpkgs#nushell -- -c '
+          nix run --inputs-from . nixpkgs#nushell -- -c '
             # Get all results files and process them in one go
             let files = (ls **/results.txt | get name)
             echo $"Found files: ($files)"

.github/workflows/publish-nix-pgupgrade-bin-flake-version.yml

@@ -34,7 +34,7 @@ jobs:
             echo "Error: git revision '$rev' not found"
             exit 1
           fi
-          VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major')
+          VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run --inputs-from . nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major')
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
 
   publish-staging:
@@ -70,7 +70,7 @@ jobs:
             file=ansible/vars.yml
           fi
 
-          VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
+          VERSION=$(git show "$rev:$file" | nix run --inputs-from . nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT"
 
@@ -146,7 +146,7 @@ jobs:
             file=ansible/vars.yml
           fi
 
-          VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
+          VERSION=$(git show "$rev:$file" | nix run --inputs-from . nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "major_version=$(echo $VERSION | cut -d'.' -f1)" >> "$GITHUB_OUTPUT"
 

.github/workflows/publish-nix-pgupgrade-scripts.yml

@@ -41,7 +41,7 @@ jobs:
             echo "Error: git revision '$rev' not found"
             exit 1
           fi
-          VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major')
+          VERSIONS=$(git show "$rev:ansible/vars.yml" | nix run --inputs-from . nixpkgs#yq-go -- -e -o=json -I=0 '.postgres_major')
           echo "postgres_versions=$VERSIONS" >> $GITHUB_OUTPUT
 
   publish-staging:
@@ -77,7 +77,7 @@ jobs:
             file=ansible/vars.yml
           fi
 
-          VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
+          VERSION=$(git show "$rev:$file" | nix run --inputs-from . nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Create a tarball containing pg_upgrade scripts
@@ -149,7 +149,7 @@ jobs:
             file=ansible/vars.yml
           fi
 
-          VERSION=$(git show "$rev:$file" | nix run nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
+          VERSION=$(git show "$rev:$file" | nix run --inputs-from . nixpkgs#yq-go -- -er '.postgres_release.postgres${{ matrix.postgres_version }}')
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Create a tarball containing pg_upgrade scripts

.github/workflows/qemu-image-build.yml

@@ -99,7 +99,7 @@ jobs:
       - name: Require non-numeric suffix for manual publish
         if: steps.stamp.outputs.cached != 'true' && inputs.publish && github.event_name == 'workflow_dispatch' && env.TARGET_ARCH == 'arm64'
         run: |
-          SUFFIX=$(nix run nixpkgs#yq -- -e ".postgres_release.postgres$POSTGRES_MAJOR_VERSION" ansible/postgres_release.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
+          SUFFIX=$(nix run --inputs-from . nixpkgs#yq -- -e ".postgres_release.postgres$POSTGRES_MAJOR_VERSION" ansible/postgres_release.yml | sed -E 's/[0-9\.]+(.*)$/\1/')
           if [[ -z $SUFFIX ]]; then
             echo "Version must include non-numeric characters if published manually."
             exit 1
@@ -129,7 +129,7 @@ jobs:
       - name: Grab release version
         id: process_release_version
         run: |
-          PG_VERSION=$(nix run nixpkgs#yq -- -er ".postgres_release.postgres$POSTGRES_MAJOR_VERSION" ansible/postgres_release.yml)
+          PG_VERSION=$(nix run --inputs-from . nixpkgs#yq -- -er ".postgres_release.postgres$POSTGRES_MAJOR_VERSION" ansible/postgres_release.yml)
           if [[ "$TARGET_ARCH" == amd64 ]]; then
             PG_VERSION="$PG_VERSION-amd64-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
           fi
@@ -161,7 +161,7 @@ jobs:
       - name: Compress disk image
         if: steps.stamp.outputs.cached != 'true' && inputs.publish
         run: |
-          nix run nixpkgs#zstd -- -T0 -o "$RUNNER_TEMP/packer-cloudimg.zst" packer-work-qemu-*/output-cloudimg/packer-cloudimg
+          nix run --inputs-from . nixpkgs#zstd -- -T0 -o "$RUNNER_TEMP/packer-cloudimg.zst" packer-work-qemu-*/output-cloudimg/packer-cloudimg
 
       - name: Upload disk image
         if: inputs.publish

.github/workflows/qemu-image-release.yml

@@ -58,7 +58,7 @@ jobs:
       - name: Build image
         run: |
           mkdir -p image-context/output-cloudimg
-          nix run nixpkgs#zstd -- -d -o image-context/output-cloudimg/packer-cloudimg "$RUNNER_TEMP/disk-image/packer-cloudimg.zst"
+          nix run --inputs-from . nixpkgs#zstd -- -d -o image-context/output-cloudimg/packer-cloudimg "$RUNNER_TEMP/disk-image/packer-cloudimg.zst"
           docker build --platform "linux/$TARGET_ARCH" -f Dockerfile-kubernetes -t "postgres:$IMAGE_TAG" image-context
 
       - name: configure aws credentials - staging

.github/workflows/testinfra-ami-build.yml

@@ -56,7 +56,7 @@ jobs:
           fi
 
           # plain assignments so set -e catches a failing substitution; an empty should_run would skip every AMI
-          versions=$(nix run nixpkgs#yq-go -- '.postgres_major[]' ansible/vars.yml)
+          versions=$(nix run --inputs-from . nixpkgs#yq-go -- '.postgres_major[]' ansible/vars.yml)
           include='[]'
           for version in $versions; do
             for target in amd64:x86_64-linux:blacksmith-2vcpu-ubuntu-2404 arm64:aarch64-linux:blacksmith-2vcpu-ubuntu-2404-arm; do