Add Nix flake for installation via nix run/profile install

[levonk]

What

Adds a flake.nix so prek can be installed and run directly from GitHub at the latest release:

nix run github:j178/prek
nix profile install github:j178/prek
nix run github:j178/prek/v0.4.5   # pin a specific release

Why

prek is already packaged in nixpkgs, but the nixpkgs unstable channel lags behind upstream releases (currently shipping 0.3.11 vs the latest 0.4.5). A flake in this repo gives users the current release directly from GitHub without waiting for nixpkgs to catch up, and provides:

• One-command install / run — nix run github:j178/prek with no clone or manual build steps.
• Pure / Hermetic builds — every input (the prebuilt binary, glibc/libiconv) is pinned in flake.lock. If it builds today, it builds in ten years.
• Reproducible — the exact same derivation always produces the exact same output bit-for-bit. No "works on my machine."
• Idempotent installs — running nix profile install twice is a no-op.
• Rollback-able — nix profile rollback restores the previous profile generation instantly.
• Cross-platform — same invocation on macOS (Apple Silicon & Intel) and Linux. The flake handles platform-specific linking.
• Atomic upgrades / downgrades — profiles are switched atomically. No half-upgraded state.
• Clean uninstall — nix profile remove leaves no residue.

Changes

• flake.nix: Nix flake wrapping the v0.4.5 prebuilt release tarball as packages.<system>.default and apps.<system>.default for x86_64/aarch64 linux+darwin. Uses autoPatchelfHook on Linux for glibc linking.
• flake.lock: pinned nixpkgs-unstable input.
• .gitignore: added /result and /result-* Nix build symlinks.
• README.md: extended the existing Nix install section (<!-- --8<-- [start: nix-install] -->) with flake-based install/run commands alongside the existing nixpkgs path. docs/installation.md picks this up automatically via its --8<-- "README.md:nix-install" include.

Testing

Verified locally on x86_64-darwin:

nix flake check --no-build   # passed
nix build .                  # passed
result/bin/prek --version    # prek 0.4.5 (bb3108283 2026-06-15)
nix run . -- --help          # passed

No source files in crates/ are touched — the diff is flake.nix, flake.lock, .gitignore, and a README snippet, so the existing test suite is unaffected.

mise run lint was not run locally (mise / the 1.96 toolchain aren't installed on the contributor's machine); since no .rs files are touched, cargo fmt / cargo clippy can't flag anything in this diff. Happy to run it if the maintainer prefers, otherwise upstream CI will cover it.

Notes

• The flake wraps the prebuilt release tarball (preferred path per the upstream release artifacts) rather than building from source, so it stays in sync with cargo-dist releases and avoids a full Rust toolchain in the closure.
• Only the 4 standard Nix systems are exposed (x86_64-linux, aarch64-linux, x86_64-darwin, aarch64-darwin). Upstream also ships musl/arm/armv7/riscv64/s390x tarballs, but those map to no stdenv system. A ponytail: comment in flake.nix documents the upgrade path.
• Per release, bump version and refresh the 4 SRI hashes in flake.nix (prefetch with nix-prefetch-url --type sha256 <asset-url>).
• Uses nixpkgs-unstable for broad platform support. Darwin builds use libiconv only; modern stdenv handles Security framework linking without the deprecated apple_sdk compatibility stub.
• No breaking changes to existing build paths. Additive only.

Scope

The PR scope is well-contained — additive only, no existing functionality affected.

Related

Closes: #2259

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.00%. Comparing base (74fb726) to head (458668b).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2260   +/-   ##
=======================================
  Coverage   93.00%   93.00%           
=======================================
  Files         127      127           
  Lines       27674    27674           
=======================================
+ Hits        25738    25739    +1     
+ Misses       1936     1935    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 458668bbf5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin to a ref that contains the flake

Per the Nix manual, github:<owner>/<repo>/<rev-or-ref> selects that tag/branch and a flake must be a tree with a root flake.nix; the current v0.4.5 tag predates this commit and does not contain flake.nix, so users following this pin example will get a “does not appear to be a flake” error instead of a pinned install. Please use a release tag that actually includes the flake, or pin to a commit/branch that has this file.

Useful? React with 👍 / 👎.