fix(ci): add file locking to prevent rebase race conditions

.gitea/workflows/nix-update.yml

@@ -330,21 +330,59 @@ jobs:
             fi
           fi
 
+          LOCKFILE="/tmp/$USER/nix-update-git-lock"
+
+          trap 'rm -f "$LOCKFILE"; exit' EXIT INT TERM
+
+          if [ -f "$LOCKFILE" ]; then
+            echo "🔍 Found existing lock file, checking if stale..."
+            STALE_LOCK_PID=$(cat "$LOCKFILE" 2>/dev/null || echo "")
+            if [ -n "$STALE_LOCK_PID" ] && ! kill -0 "$STALE_LOCK_PID" 2>/dev/null; then
+              echo "🗑️ Stale lock detected (PID $STALE_LOCK_PID no longer running), removing..."
+              rm -f "$LOCKFILE"
+            fi
+          fi
+
+          (
+            flock -x 200 || exit 1
+
+            echo $$ > "$LOCKFILE"
+
+            MY_PID=$$
+            echo "🔒 Lock acquired by PID $MY_PID"
+
             echo "::group::Git Operations"
             echo "Current commit: $(git rev-parse HEAD)"
             echo "Pending commits: $(git rev-list --count origin/master..HEAD)"
 
+            git rebase --abort 2>/dev/null || true
+
+            if [ -n "$(git status --porcelain)" ]; then
               echo ""
-          echo "Pulling latest changes (rebase)..."
+              echo "⚠️ Unstaged changes detected, auto-committing..."
-          if git pull --rebase origin master; then
+              git add .
+              git commit -m "chore: auto-commit before rebase [skip ci]"
+              echo "✅ Unstaged changes committed"
+            fi
+
+            echo ""
+            echo "Pulling latest changes (autostash + rebase)..."
+            if git pull --autostash --rebase origin master; then
               echo "✅ Rebase successful"
             else
-            echo "⚠️ Rebase failed, attempting force push..."
+              echo "⚠️ Rebase failed, attempting merge (-Xtheirs)..."
+              git rebase --abort 2>/dev/null || true
+
+              if git merge -Xtheirs origin/master; then
+                echo "✅ Merge successful (-Xtheirs strategy)"
+              else
+                echo "⚠️ Merge failed, attempting force push..."
                 git reset --hard origin/master
                 git push --force-with-lease origin master
-            echo "✓ Force push completed"
+                echo "✅ Force push completed"
                 exit 0
               fi
+            fi
 
             echo ""
             echo "Pushing changes to master..."
@@ -352,8 +390,11 @@ jobs:
 
             echo ""
             echo "✅ Successfully pushed updates for: $PACKAGES"
+            echo "🔒 Lock released by PID $MY_PID"
             echo "::endgroup::"
 
+          ) 200>"$LOCKFILE"
+
       - name: Upload Build Logs
         if: failure()
         uses: actions/upload-artifact@v4