From 9fa09a11da5496d42572c765514acc2ff44f9c64 Mon Sep 17 00:00:00 2001 From: zimbatm Date: Tue, 13 Oct 2026 18:28:05 +0000 Subject: [PATCH] ci: declare the write the docs job needs The job pushes the built book to gh-pages. It relied on the repository's default GITHUB_TOKEN permission being write, and that default is now read across the organization, so the push fails with Permission to numtide/devshell.git denied to github-actions[bot] Declaring contents: write on the job is the fix the read-only default is meant to force: the one job that writes says so, and nothing else in this workflow gets a write token. Assisted-by: Claude Code (claude-opus-5) Change-Id: I399a10e0d3c472d8232f8db91547b267189f3900 --- .github/workflows/nix.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml index a3ac988..a1345cc 100644 --- a/.github/workflows/nix.yml +++ b/.github/workflows/nix.yml @@ -10,6 +10,8 @@ on: jobs: docs: runs-on: ubuntu-latest + permissions: + contents: write steps: - uses: actions/checkout@v6 - uses: NixOS/nix-installer-action@main