From e3d6fb59b5309345a14571c9fb72a2bceade08df Mon Sep 17 00:00:00 2001
From: gapul <92638132+gapul@users.noreply.github.com>
Date: Sun, 9 Aug 2026 19:20:38 +0900
Subject: [PATCH] fix(git-hooks): rebuild when only secrets change

sops-nix renders its files at activation, so a secrets-only merge leaves the repo and
the deployed file disagreeing until someone happens to run a rebuild.
---
 nix/home/git-hooks.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/nix/home/git-hooks.nix b/nix/home/git-hooks.nix
index ef93ccf7..18af1425 100644
--- a/nix/home/git-hooks.nix
+++ b/nix/home/git-hooks.nix
@@ -38,8 +38,11 @@ let
       exit 0
     fi
 
+    # secrets/ belongs here too: sops-nix renders those files at activation, so a secrets-only
+    # merge changes nothing on disk until a rebuild runs. That failure is completely silent —
+    # the repo says one thing and ~/.ssh/config says another.
     if ${git} diff ${range} --name-only 2>/dev/null \
-       | grep -qE '^(flake\.nix|flake\.lock|nix/|configs/|Justfile)'; then
+       | grep -qE '^(flake\.nix|flake\.lock|nix/|configs/|secrets/|Justfile)'; then
       echo "▶ dotfiles: nix/config changed (${label}) → running just rebuild"
       # rebuild targets the main tree's current state (= merged main).
       # just / nh / nix resolve by inheriting the PATH of the interactive shell that ran the pull.