From e0361ddd22682d888a9c4eb9272aa00b040be129 Mon Sep 17 00:00:00 2001
From: Mohamed Boudra <boudra.moha@gmail.com>
Date: Tue, 12 May 2026 12:35:05 +0700
Subject: [PATCH] ci: drop unused contents: write override in nix-build

GITHUB_TOKEN no longer pushes anything in this workflow. PR runs are
read-only, and main pushes go through the paseo-ai App token. The
workflow-level 'contents: read' is sufficient.

Addresses #365.
---
 .github/workflows/nix-build.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index 4b3ac6a8a..b86331434 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -38,8 +38,6 @@ permissions:
 jobs:
   build:
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
     steps:
       - uses: actions/create-github-app-token@v1
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'