name: macOS

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  check:
    runs-on: macos-arm64
    steps:
      - uses: https://code.forgejo.org/actions/checkout@v4
      # Forgejo auto-injects GITHUB_TOKEN (GH Actions compatibility), scoped
      # to this Forgejo instance. Nix auto-detects that env var and assumes
      # it's a github.com credential, so it sends it to api.github.com when
      # fetching nixpkgs tarballs for devbox - which rejects it with 401.
      # Clearing it here falls back to unauthenticated (fine for public
      # nixpkgs fetches, same as this succeeds locally with no token set).
      - run: devbox run check
        env:
          GITHUB_TOKEN: ""