name: macOS

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  check:
    runs-on: macos-arm64
    steps:
      - uses: https://code.forgejo.org/actions/checkout@v4
        with:
          path: carrier
      # Cargo.toml depends on fumi-core via a relative sibling path
      # (../fumi/core), matching how it's checked out locally. Fetched as
      # its own sibling checkout here so that path resolves the same way.
      - uses: https://code.forgejo.org/actions/checkout@v4
        with:
          repository: randogoth/fumi
          ref: main
          path: fumi
      # Forgejo auto-injects GITHUB_TOKEN (GH Actions compatibility), scoped
      # to this Forgejo instance. Nix auto-detects that env var and assumes
      # it's a github.com credential, so it sends it to api.github.com when
      # fetching nixpkgs tarballs for devbox - which rejects it with 401.
      # Clearing it here falls back to unauthenticated (fine for public
      # nixpkgs fetches, same as this succeeds locally with no token set).
      - run: devbox run check
        working-directory: carrier
        env:
          GITHUB_TOKEN: ""