Correct permissions for GitHub workflow (#8)

The documentation was missing some important bits. See DeterminateSystems/update-flake-lock#88
sellout · Oct 22, 2023 · 862ab74 · 862ab74
2 parents 5a5786c + a103dd5
commit 862ab74
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 3 deletions.
diff --git a/.github/settings.yml b/.github/settings.yml
diff --git a/.github/workflows/update-nix-lockfile.yml b/.github/workflows/update-nix-lockfile.yml
diff --git a/base/.config/project/github.nix b/base/.config/project/github.nix
@@ -75,13 +75,19 @@
           };
         };
       };
+
+      actions.permissions.workflow.can_approve_pull_request_reviews = true;
     };
 
     workflow."update-nix-lockfile.yml".text = lib.generators.toYAML {} {
       name = "Create PR to update Nix flake inputs";
       on = {
-        workflow_dispatch = null;
         schedule = [{cron = "0 0 * * 0";}]; # runs weekly on Sunday at 00:00Z
+        workflow_dispatch = null;
+      };
+      permissions = {
+        contents = "write"; # to make a new branch for the PR
+        pull-requests = "write"; # to open the PR
       };
       jobs.lockfile = {
         runs-on = "ubuntu-latest";