Check whether flake.lock is in sync with inputs, offline

[roberth]

Is your feature request related to a problem? Please describe.

You'll generally want your lock file to be in a state where it doesn't require an update to become valid.
This can be checked without fetching anything, and such a check should be possible to perform with a fairly simple invocation.

It seems that nix flake lock --no-update-lock-file should do this, but it appears to fetch anyway.

• Add a hook to check that flake.lock is in sync cachix/git-hooks.nix#283

Describe the solution you'd like

A command or nix flake lock flag that checks whether any lock entries must be updated, but does not actually update them. Instead it reports what would be updated.

If --no-update-lock-file needs to keep its current behavior, I'd suggest nix flake lock --dry-run. It should report the entries that need an update. Exit status reflects whether anything was updated. Exit status 0 means no updates, for easy use in CI or pre-commit checks.

Describe alternatives you've considered

Use Hercules CI. It fails the job when the lock file requires an update.

CI is a bit late though.

Additional context

Priorities

Add 👍 to issues you find important.