[kleinbem]

This flake had no lock updater. Adds kleinbem/actions' reusable maintain-flake (v1.6.0): nightly nix flake update, nix flake check --no-build, then a lock PR with auto-merge that this repo's checks decide on.

Needs APP_ID/APP_PRIVATE_KEY from kleinbem/nix#112 (merged, waiting for the tofu apply); until then the run fails at the token step.

Tests:

• actionlint passes on the generated caller.
• First live run: the next schedule, or a manual dispatch.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added a maintenance task that runs automatically each day at 02:45 UTC and can also be started manually. This provides both a predictable daily run and an on-demand option, while leaving the application's available features and behaviour unchanged. No user-facing functionality is added or removed as part of this release.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

A new workflow runs on manual dispatch or daily at 02:45 UTC. It calls a reusable flake maintenance workflow pinned to a commit and passes two application secrets.

Changes: Flake maintenance

Layer / File(s)	Summary
Configure flake maintenance .github/workflows/maintain.yaml	Adds manual and daily triggers, an empty workflow-level permissions set, and a call to the pinned reusable workflow with APP_ID and APP_PRIVATE_KEY secrets.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Other

Possibly related PRs

• kleinbem-dev/cadre#18: Configures updates for pinned GitHub Actions dependencies, including the reusable workflow used here.

Merge Risk: Minimal · up to d74ad

This adds a nightly flake lockfile update workflow. It will fail at the token step until the APP_ID and APP_PRIVATE_KEY secrets are provisioned, which the author has documented. No merge-blocking risk was identified.

Architecture risk: Low · up to 3e69d

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/maintain.yaml: Adds the Maintain Flake workflow with manual and scheduled triggers, an empty workflow-level permissions set, and a job that calls the pinned reusable workflow while passing the two application secrets.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title describes the nightly flake.lock PR and the shared workflow.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Central YAML; Path: .coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: 305b1da4-d8ec-47b8-9282-6481cd33e57d

Commits

Reviewing files that changed from the base of the PR and between 3e69dc9 and d74ad44.

Files selected for processing: 1

• .github/workflows/maintain.yaml

Files skipped from review as they are similar to previous changes: 1

• .github/workflows/maintain.yaml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.