ci: take jq from flake.lock too, so no CI job resolves tools from the moving registry

.forgejo/workflows/ci.yml

@@ -69,7 +69,7 @@ jobs:
       - name: lint
         # jq isn't a project dependency elsewhere in this repo — same
         # nix-shell-for-one-tool shape the vale jobs below use.
-        run: nix shell nixpkgs#jq --command sh scripts/check-dashboard-descriptions.sh
+        run: nix shell --inputs-from . nixpkgs#jq --command sh scripts/check-dashboard-descriptions.sh
 
   shellcheck:
     name: shellcheck
@@ -79,7 +79,7 @@ jobs:
       - uses: actions/checkout@v3
       - name: lint
         # `nix develop` enters the whole devshell for this one tool, which pins
-        # shellcheck to flake.lock; the jq job takes its own from the registry.
+        # shellcheck to flake.lock, as the vale and jq jobs do with `--inputs-from .`.
         #
         # By shebang, not a `*.sh` glob — scripts/pre-push has no suffix.
         run: |

scripts/check-dashboard-descriptions.sh

@@ -21,8 +21,8 @@
 # Uses `jq` — the right tool for JSON, unlike its zero-dependency siblings
 # in this directory. This script does NOT nix-shell for it itself: the
 # caller declares that dependency (see `pre-push` and
-# `.forgejo/workflows/ci.yml`, the same `nix shell nixpkgs#jq --command sh
-# <this file>` shape the vale/shellcheck jobs already use for their own
+# `.forgejo/workflows/ci.yml`, the same `nix shell --inputs-from . nixpkgs#jq
+# --command sh <this file>` shape the vale/shellcheck jobs already use for their own
 # tools), so a leaf script never hides a nix invocation inside itself.
 #
 # Emits a CI error annotation per hit, exits 1 if any hit is found.

scripts/pre-push

@@ -34,7 +34,7 @@ fi
 echo "pre-push: running dashboard-description lint..." >&2
 # jq isn't a project dependency elsewhere in this repo, so the check script
 # assumes nothing about the caller's PATH — nix-shell it here instead.
-if ! nix shell nixpkgs#jq --command sh "$repo_root/scripts/check-dashboard-descriptions.sh"; then
+if ! nix shell --inputs-from . nixpkgs#jq --command sh "$repo_root/scripts/check-dashboard-descriptions.sh"; then
   echo "pre-push: dashboard-description lint FAILED — fix before pushing" >&2
   exit 1
 fi