Don't write lock files if they have dirty inputs

src/libexpr/flake/flake.cc

@@ -405,13 +405,18 @@ ResolvedFlake resolveFlake(EvalState & state, const FlakeRef & topRef, HandleLoc
     if (!(lockFile == oldLockFile)) {
         if (allowedToWrite(handleLockFile)) {
             if (auto refData = std::get_if<FlakeRef::IsPath>(&topRef.data)) {
+                if (lockFile.isDirty())
+                    warn("will not write lock file of flake '%s' because it has a dirty input", topRef);
+                else {
                     lockFile.write(refData->path + (topRef.subdir == "" ? "" : "/" + topRef.subdir) + "/flake.lock");
 
                     // Hack: Make sure that flake.lock is visible to Git, so it ends up in the Nix store.
-                runProgram("git", true, { "-C", refData->path, "add",
+                    runProgram("git", true,
+                        { "-C", refData->path, "add",
                           "--force",
                           "--intent-to-add",
                           (topRef.subdir == "" ? "" : topRef.subdir + "/") + "flake.lock" });
+                }
             } else
                 warn("cannot write lock file of remote flake '%s'", topRef);
         } else if (handleLockFile != AllPure && handleLockFile != TopRefUsesRegistries)
@@ -624,8 +629,8 @@ const Registries EvalState::getFlakeRegistries()
 
 Fingerprint ResolvedFlake::getFingerprint() const
 {
-    // FIXME: as an optimization, if the flake contains a lockfile and
+    // FIXME: as an optimization, if the flake contains a lock file
-    // we haven't changed it, then it's sufficient to use
+    // and we haven't changed it, then it's sufficient to use
     // flake.sourceInfo.storePath for the fingerprint.
     return hashString(htSHA256,
         fmt("%s;%s", flake.sourceInfo.storePath, lockFile));

src/libexpr/flake/flakeref.hh

@@ -176,6 +176,12 @@ struct FlakeRef
     bool isImmutable() const;
 
     FlakeRef baseRef() const;
+
+    bool isDirty() const
+    {
+        return std::get_if<FlakeRef::IsPath>(&data)
+            && rev == Hash(rev->type);
+    }
 };
 
 std::ostream & operator << (std::ostream & str, const FlakeRef & flakeRef);

src/libexpr/flake/lockfile.cc

@@ -66,6 +66,17 @@ nlohmann::json FlakeInputs::toJson() const
     return json;
 }
 
+bool FlakeInputs::isDirty() const
+{
+    for (auto & i : flakeInputs)
+        if (i.second.ref.isDirty() || i.second.isDirty()) return true;
+
+    for (auto & i : nonFlakeInputs)
+        if (i.second.ref.isDirty()) return true;
+
+    return false;
+}
+
 nlohmann::json LockFile::toJson() const
 {
     auto json = FlakeInputs::toJson();

src/libexpr/flake/lockfile.hh

@@ -53,6 +53,10 @@ struct FlakeInputs
     FlakeInputs(const nlohmann::json & json);
 
     nlohmann::json toJson() const;
+
+    /* A lock file is dirty if it contains a dirty flakeref
+       (i.e. reference to a dirty working tree). */
+    bool isDirty() const;
 };
 
 /* Lock file information about a flake input. */