@@ -121,26 +121,31 @@ jobs:
121
121
needs :changes
122
122
if :needs.changes.outputs.gomod == 'true'
123
123
runs-on :${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
124
- permissions :
125
- # Give the default GITHUB_TOKEN write permission to commit and push the changed files back to the repository.
126
- contents :write
127
124
steps :
128
125
-name :Checkout
129
126
uses :actions/checkout@v4
130
127
with :
131
128
fetch-depth :1
129
+ token :${{ secrets.CDRCI_GITHUB_TOKEN }}
132
130
133
131
-name :Setup Go
134
132
uses :./.github/actions/setup-go
135
133
136
134
-name :Update Nix Flake SRI Hash
137
135
run :./scripts/update-flake.sh
138
136
137
+ # auto update flake for dependabot
139
138
-uses :stefanzweifel/git-auto-commit-action@v5
139
+ if :github.actor == 'dependabot[bot]'
140
140
with :
141
141
# Allows dependabot to still rebase!
142
142
commit_message :" [dependabot skip] Update Nix Flake SRI Hash"
143
143
144
+ # check for other PRs
145
+ -name :Ensure No Changes
146
+ if :github.actor != 'dependabot[bot]'
147
+ run :git diff --exit-code
148
+
144
149
lint :
145
150
needs :changes
146
151
if :needs.changes.outputs.offlinedocs-only == 'false' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'