Problem: released binary don't record commit hash (#1607)

* Problem: ci build might update flake lock file

Solution:
- make it fail

* don't allow dirty

* fix rev

flake.nix

@@ -81,6 +81,7 @@
           go = super.go_1_22;
           test-env = final.callPackage ./nix/testenv.nix { };
           cronos-matrix = final.callPackage ./nix/cronos-matrix.nix {
+            inherit rev;
             bundle-exe = final.pkgsBuildBuild.callPackage nix-bundle-exe { };
           };
           testground-image = final.callPackage ./nix/testground-image.nix { };

scripts/release.sh

@@ -28,7 +28,7 @@ build() {
         fi
     fi
     echo "building $FLAKE"
-    nix build -L "$FLAKE"
+    nix build --no-update-lock-file --no-allow-dirty -L "$FLAKE"
     cp result "cronos_${ref_name_clean:1}${network}_${name}.tar.gz"
 }