feat: use nightly prebuilt when it matches HEAD exactly

When HEAD is not at a release tag, fetch the nightly release's commit
asset and only download the nightly binary when it equals the local HEAD
sha, so a downloaded binary always matches the checked-out source.
Otherwise fall back to building from source.

Author: willothy

README.md

@@ -78,7 +78,9 @@ which commit (these are not classified as semver bumps).
   the build step compiles from source, which needs a **Rust toolchain** (`cargo`).
 
 Prebuilt binaries are published for Linux (x86_64, aarch64) and macOS (x86_64,
-aarch64). Other platforms (and untagged/branch installs) build from source.
+aarch64), both for tagged releases and as a rolling `nightly` for `main`. Other
+platforms — and any checkout that doesn't exactly match a published build —
+compile from source.
 
 ## Installation
 
@@ -97,8 +99,10 @@ falling back to compiling from source (requires `cargo`).
 }
 ```
 
-Pin to a release tag (e.g. `version = "*"` or `tag = "v1.0.0"`) to get a prebuilt
-binary; tracking a branch always builds from source.
+Prebuilt binaries are used whenever they're guaranteed to match your checked-out
+source: at a release tag (e.g. `version = "*"` / `tag = "v1.0.0"`), or — when
+tracking `main` — if your commit is exactly the one the latest `nightly` build
+was produced from. Anything else builds from source.
 
 ### packer.nvim
 

doc/lockfile.txt

@@ -35,10 +35,11 @@ Supported lockfiles:
 
 - Neovim 0.10 or newer.
 - The native module (a hard dependency), implemented in Rust and loaded via
-  mlua. The build step |lockfile.download()| downloads a prebuilt binary when
-  HEAD is at a tagged release, otherwise it builds from source, which requires a
-  Rust toolchain (`cargo`). If the module is missing, commands report an error
-  with build instructions.
+  mlua. The build step |lockfile.download()| downloads a prebuilt binary that is
+  guaranteed to match the checked-out source — at a release tag, or the rolling
+  `nightly` build when your commit matches it exactly — and otherwise builds
+  from source, which requires a Rust toolchain (`cargo`). If the module is
+  missing, commands report an error with build instructions.
 
   Prebuilt binaries are published for Linux (x86_64, aarch64) and macOS
   (x86_64, aarch64); other platforms build from source.

lua/lockfile/download.lua

@@ -110,6 +110,20 @@ local function release_tag(root)
   return nil
 end
 
+--- The full commit sha at HEAD, or nil.
+---@param root string
+---@return string?
+local function head_sha(root)
+  local res = vim.system({ "git", "-C", root, "rev-parse", "HEAD" }):wait()
+  if res.code == 0 then
+    local sha = vim.trim(res.stdout or "")
+    if sha ~= "" then
+      return sha
+    end
+  end
+  return nil
+end
+
 --- Download `url` to `out` with curl. Returns ok, error message.
 ---@param url string
 ---@param out string
@@ -176,6 +190,29 @@ local function install_prebuilt(root, tag, triple)
   return true, nil
 end
 
+--- The commit sha the published `nightly` binaries were built from, fetched
+--- from the nightly release's `commit` asset, or nil if unavailable.
+---@return string?
+local function nightly_commit()
+  local url = ("https://github.com/%s/releases/download/nightly/commit"):format(REPO)
+  local tmp = vim.fn.tempname()
+  local ok = curl(url, tmp)
+  if not ok then
+    return nil
+  end
+  local fd = io.open(tmp, "r")
+  local sha
+  if fd then
+    sha = vim.trim(fd:read("*a") or "")
+    fd:close()
+  end
+  pcall(vim.uv.fs_unlink, tmp)
+  if sha and sha ~= "" then
+    return sha
+  end
+  return nil
+end
+
 --- Build the native module from source and copy it into place.
 ---@param root string?
 function M.build(root)
@@ -201,23 +238,44 @@ function M.build(root)
   vim.notify("lockfile.nvim: built native module from source.")
 end
 
---- Install the native module: prefer a prebuilt binary matching the installed
---- release tag, otherwise build from source.
+--- Install the native module. Prefers a prebuilt binary that is guaranteed to
+--- match the checked-out source:
+---   * at a release tag (v*): the matching release's binary;
+---   * otherwise: the `nightly` binary, but only when it was built from this
+---     exact commit (verified via the nightly `commit` asset).
+--- Falls back to building from source in every other case.
 function M.download_or_build()
   local root = plugin_root()
-  local tag = release_tag(root)
   local triple = target_triple()
 
-  if tag and triple then
-    local ok, err = install_prebuilt(root, tag, triple)
-    if ok then
-      vim.notify(("lockfile.nvim: installed prebuilt binary for %s (%s)."):format(triple, tag))
-      return
+  if triple then
+    local tag = release_tag(root)
+    if tag then
+      local ok, err = install_prebuilt(root, tag, triple)
+      if ok then
+        vim.notify(("lockfile.nvim: installed prebuilt binary for %s (%s)."):format(triple, tag))
+        return
+      end
+      vim.notify(
+        ("lockfile.nvim: prebuilt unavailable (%s); building from source."):format(err or "unknown"),
+        vim.log.levels.INFO
+      )
+    else
+      -- Not at a release tag: use the nightly binary only if it was built from
+      -- exactly this commit, so the binary always matches the source.
+      local head = head_sha(root)
+      if head and nightly_commit() == head then
+        local ok, err = install_prebuilt(root, "nightly", triple)
+        if ok then
+          vim.notify(("lockfile.nvim: installed nightly prebuilt for %s."):format(triple))
+          return
+        end
+        vim.notify(
+          ("lockfile.nvim: nightly prebuilt unavailable (%s); building from source."):format(err or "unknown"),
+          vim.log.levels.INFO
+        )
+      end
     end
-    vim.notify(
-      ("lockfile.nvim: prebuilt unavailable (%s); building from source."):format(err or "unknown"),
-      vim.log.levels.INFO
-    )
   end
 
   M.build(root)