From da887fa2a4567ac99e7dc64646c12fb18ab735e3 Mon Sep 17 00:00:00 2001
From: Doreen <seider.doreen@gmail.com>
Date: Tue, 20 Oct 2026 12:41:42 +0200
Subject: [PATCH 1/3] ci: run flake-closure-diff on dev-kit's own flake changes

---
 .github/workflows/flake-closure-diff-self.yml | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .github/workflows/flake-closure-diff-self.yml

diff --git a/.github/workflows/flake-closure-diff-self.yml b/.github/workflows/flake-closure-diff-self.yml
new file mode 100644
index 0000000..a660363
--- /dev/null
+++ b/.github/workflows/flake-closure-diff-self.yml
@@ -0,0 +1,22 @@
+name: flake-closure-diff
+
+# dev-kit calling its own reusable workflow, the way a consumer calls it. The
+# reference is local, as in renovate-auto-approve-self: it always exercises the
+# version in the branch and needs no self-referencing SHA.
+#
+# The workflow itself is in the paths so a change to it is exercised before it
+# reaches consumers, not only on the next lock bump.
+on:
+  pull_request:
+    paths:
+      - flake.lock
+      - flake.nix
+      - .github/workflows/flake-closure-diff.yml
+      - .github/workflows/flake-closure-diff-self.yml
+
+permissions:
+  contents: read
+
+jobs:
+  closure-diff:
+    uses: ./.github/workflows/flake-closure-diff.yml

From dbcc27c3a8228a85dd44bd97f7ec28806cedc93a Mon Sep 17 00:00:00 2001
From: Doreen <seider.doreen@gmail.com>
Date: Tue, 20 Oct 2026 12:53:48 +0200
Subject: [PATCH 2/3] ci: word the empty closure diff summary for non-lock
 changes

---
 .github/workflows/flake-closure-diff.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/flake-closure-diff.yml b/.github/workflows/flake-closure-diff.yml
index 1460e46..9790699 100644
--- a/.github/workflows/flake-closure-diff.yml
+++ b/.github/workflows/flake-closure-diff.yml
@@ -114,7 +114,7 @@ jobs:
             echo "## Dev shell closure diff"
             echo
             if [ -z "$diff" ]; then
-              echo "No package-level change: the lock moved but the shell is identical."
+              echo "No package-level change in the dev shell."
             else
               echo '```'
               echo "$diff"

From 3bedf66f0e02adb01bac6e623ed60c78cab39919 Mon Sep 17 00:00:00 2001
From: Doreen <seider.doreen@gmail.com>
Date: Tue, 20 Oct 2026 13:14:30 +0200
Subject: [PATCH 3/3] ci: hard-code the flake-closure-diff runner

---
 .github/workflows/flake-closure-diff.yml | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/.github/workflows/flake-closure-diff.yml b/.github/workflows/flake-closure-diff.yml
index 9790699..25637e6 100644
--- a/.github/workflows/flake-closure-diff.yml
+++ b/.github/workflows/flake-closure-diff.yml
@@ -21,10 +21,6 @@ on:
           both sides are addressed as <path>#<attribute>.
         type: string
         default: devShells.x86_64-linux.default
-      runs-on:
-        description: Runner for the job.
-        type: string
-        default: ubuntu-24.04
     secrets:
       cachix-auth-token:
         required: false
@@ -37,7 +33,7 @@ permissions:
 jobs:
   closure-diff:
     name: Diff flake closures
-    runs-on: ${{ inputs.runs-on }}
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with: