Function lockFlake

internal/lock/resolve.go:214–252

(ctx context.Context, ref flake.Ref, refresh bool)

}

func lockFlake(ctx context.Context, ref flake.Ref, refresh bool) (flake.Ref, error) {
	if ref.Locked() {
		return ref, nil
	}

	// Nix requires a NAR hash for GitHub flakes to be locked. A Devbox lock
	// file is a bit more lenient and only requires a revision so that we
	// don't need to download the nixpkgs source for cached packages. If the
	// search index is ever able to return the NAR hash then we can remove
	// this check. Skip this shortcut when refresh is requested — the caller
	// is asking us to re-query upstream for a newer rev.
	if !refresh && ref.Type == flake.TypeGitHub && (ref.Rev != "") {
		return ref, nil
	}

	var meta nix.FlakeMetadata
	var err error
	// For nixpkgs, we cache resolutions (currently flakeCacheTTL=30 days) to avoid downloading
	// new nixpkgs too often which is really slow and rarely changes anything.
	//
	// Ideally we can do something similar for all packages (flake and otherwise)
	// Specifically, if user adds python@3.12 (or python@latest that resolves to 3.12) and that
	// package is already installed, we should use it instead of using 3.12 from search service
	// (which may have different store path). This would allow all devbox projects to share packages
	// if the version resolution is the same.
	//
	// That said, the logic for caching resolved versions and non-locked flake references would not
	// be the same.
	if ref.IsNixpkgs() && !refresh {
		meta, err = nix.ResolveCachedFlake(ctx, ref)
	} else {
		meta, err = nix.ResolveFlake(ctx, ref, refresh)
	}

	if err != nil {
		return ref, err
	}
	return meta.Locked, nil
}