chore(deps): update dependency arnarg/nixidy to v0.21.0 #29

Merged

martin merged 1 commit from renovate/arnarg-nixidy-0.x into main

2026-06-19 16:38:34 +00:00

clank-bot commented

2026-06-19 14:32:31 +00:00

Collaborator

This PR contains the following updates:

Package	Update	Change
arnarg/nixidy	minor	`v0.20.0` → `v0.21.0`

Release Notes

arnarg/nixidy (arnarg/nixidy)

`v0.21.0`

Compare Source

New Features

Object Transforms: declarative rule engine for Kubernetes objects - @sini #100

A new objectTransforms option (environment-wide and per-application) lets you match and modify rendered objects across your entire environment. Each rule selects objects with match and applies exactly one of:

rewrite: an eval-time function resource -> resource that transforms (or drops by returning null) objects while nixidy is evaluating.
postProcess: an activation-time stdin → stdout filter that runs when the environment is applied, after the object has been rendered to its file. Supports a bare command string or a full form with runtimeInputs and a function resolved per matched object.

{
  nixidy.objectTransforms = [
    # Add a managed-by label to every object in the environment.
    {
      rewrite =
        resource:
        resource
        // {
          metadata = resource.metadata // {
            labels = (resource.metadata.labels or { }) // {
              "app.kubernetes.io/managed-by" = "nixidy";
            };
          };
        };
    }

    # Drop every HorizontalPodAutoscaler.
    {
      match.kind = "HorizontalPodAutoscaler";
      rewrite = _: null;
    }

    # Encrypt secrets at activation time
    {
      match.kind = "SopsSecret";
      postProcess = {
        runtimeInputs = [ pkgs.sops ];
        command =
          { resource, ... }:
          "sops --encrypt --input-type yaml --output-type yaml /dev/stdin";
      };
    }
  ];
}

postProcess commands run outside the Nix sandbox (so they can reach secrets, hardware keys, etc.). For visibility, nixidy switch prints every command it is about to run and, when attached to a terminal, pauses for confirmation. Two environment variables tune the behaviour:

NIXIDY_POST_PROCESS_APPROVE=1: skips the prompt for trusted interactive use
NIXIDY_SKIP_POST_PROCESS=1: reuses the already-rendered target files without running anything

See the new Object Transforms documentation for full details.

devenv support in the CLI - #94

The nixidy CLI now supports devenv as an alternative build backend. When a devenv.nix file is detected (and neither flake.nix nor default.nix is present), the CLI automatically uses devenv. Pass --devenv on any command to force it:

nixidy build --devenv dev

Set up devenv with nixidy:

devenv init
devenv inputs add nixidy github:arnarg/nixidy/latest

Then create devenv.nix:

{
  inputs,
  pkgs,
  ...
}: {
  outputs = {
    nixidyEnvs = inputs.nixidy.lib.mkEnvs {
      inherit pkgs;

      envs = {
        dev.modules = [ ./env/dev.nix ];
      };
    };
  };

  packages = [
    inputs.nixidy.packages.${pkgs.stdenv.system}.default
  ];
}

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [arnarg/nixidy](https://github.com/arnarg/nixidy) | minor | `v0.20.0` → `v0.21.0` | --- ### Release Notes <details> <summary>arnarg/nixidy (arnarg/nixidy)</summary> ### [`v0.21.0`](https://github.com/arnarg/nixidy/releases/tag/v0.21.0) [Compare Source](https://github.com/arnarg/nixidy/compare/v0.20.0...v0.21.0) #### New Features ##### Object Transforms: declarative rule engine for Kubernetes objects - [@sini](https://github.com/sini) [#100](https://github.com/arnarg/nixidy/issues/100) A new `objectTransforms` option (environment-wide and per-application) lets you match and modify rendered objects across your entire environment. Each rule selects objects with `match` and applies exactly one of: - **`rewrite`**: an eval-time function `resource -> resource` that transforms (or drops by returning `null`) objects while nixidy is evaluating. - **`postProcess`**: an activation-time stdin → stdout filter that runs when the environment is applied, after the object has been rendered to its file. Supports a bare command string or a full form with `runtimeInputs` and a function resolved per matched object. ```nix { nixidy.objectTransforms = [ # Add a managed-by label to every object in the environment. { rewrite = resource: resource // { metadata = resource.metadata // { labels = (resource.metadata.labels or { }) // { "app.kubernetes.io/managed-by" = "nixidy"; }; }; }; } # Drop every HorizontalPodAutoscaler. { match.kind = "HorizontalPodAutoscaler"; rewrite = _: null; } # Encrypt secrets at activation time { match.kind = "SopsSecret"; postProcess = { runtimeInputs = [ pkgs.sops ]; command = { resource, ... }: "sops --encrypt --input-type yaml --output-type yaml /dev/stdin"; }; } ]; } ``` `postProcess` commands run outside the Nix sandbox (so they can reach secrets, hardware keys, etc.). For visibility, `nixidy switch` prints every command it is about to run and, when attached to a terminal, pauses for confirmation. Two environment variables tune the behaviour: - `NIXIDY_POST_PROCESS_APPROVE=1`: skips the prompt for trusted interactive use - `NIXIDY_SKIP_POST_PROCESS=1`: reuses the already-rendered target files without running anything See the new [Object Transforms](https://nixidy.dev/user_guide/object_transforms/) documentation for full details. ##### devenv support in the CLI - [#94](https://github.com/arnarg/nixidy/issues/94) The nixidy CLI now supports [devenv](https://devenv.sh/) as an alternative build backend. When a `devenv.nix` file is detected (and neither `flake.nix` nor `default.nix` is present), the CLI automatically uses devenv. Pass `--devenv` on any command to force it: ``` nixidy build --devenv dev ``` Set up devenv with nixidy: ```sh devenv init devenv inputs add nixidy github:arnarg/nixidy/latest ``` Then create `devenv.nix`: ```nix { inputs, pkgs, ... }: { outputs = { nixidyEnvs = inputs.nixidy.lib.mkEnvs { inherit pkgs; envs = { dev.modules = [ ./env/dev.nix ]; }; }; }; packages = [ inputs.nixidy.packages.${pkgs.stdenv.system}.default ]; } ``` </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).

clank-bot added 1 commit

2026-06-19 14:32:31 +00:00