From 69fd6d58e73fea4cb7901a82d3386bc6f4fbce5c Mon Sep 17 00:00:00 2001
From: randogoth <kflux@posteo.de>
Date: Wed, 7 Oct 2026 13:34:00 +0300
Subject: [PATCH] feat: clear the Forgejo-injected GITHUB_TOKEN before devbox
 run check

---
 .forgejo/workflows/macos.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.forgejo/workflows/macos.yml b/.forgejo/workflows/macos.yml
index b0824e3..7aad994 100644
--- a/.forgejo/workflows/macos.yml
+++ b/.forgejo/workflows/macos.yml
@@ -11,4 +11,12 @@ jobs:
     runs-on: macos-arm64
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v4
+      # Forgejo auto-injects GITHUB_TOKEN (GH Actions compatibility), scoped
+      # to this Forgejo instance. Nix auto-detects that env var and assumes
+      # it's a github.com credential, so it sends it to api.github.com when
+      # fetching nixpkgs tarballs for devbox - which rejects it with 401.
+      # Clearing it here falls back to unauthenticated (fine for public
+      # nixpkgs fetches, same as this succeeds locally with no token set).
       - run: devbox run check
+        env:
+          GITHUB_TOKEN: ""