@

ci(nix): least-privilege the two nix workflows, symmetric path filters

Review follow-ups, all three mechanical:

- nix-check.yml declares `permissions: contents: read` instead of inheriting
  it. It was the only workflow in .github/workflows/ without a permissions
  block, and inheriting a repo-level setting is precisely what broke the bump
  workflow it ships alongside.
- The push trigger now watches .github/workflows/nix-check.yml like the
  pull_request trigger already did, so an edit to the check itself is checked
  on both legs.
- bump-nix-package.yml drops `pull-requests: write`. The PR is opened with the
  PAT now, so that grant on GITHUB_TOKEN buys nothing.
@

Author: EtienneLescot

.github/workflows/bump-nix-package.yml

@@ -10,9 +10,10 @@ on:
         required: true
         type: string
 
+# GITHUB_TOKEN only pushes the branch here — the PR itself is opened with the
+# PAT below, so no `pull-requests: write` is needed (and it never worked).
 permissions:
   contents: write
-  pull-requests: write
 
 jobs:
   bump:

.github/workflows/nix-check.yml

@@ -29,6 +29,13 @@ on:
     paths:
       - package-lock.json
       - nix/**
+      - .github/workflows/nix-check.yml
+
+# Read-only, and stated rather than inherited: the repo default happens to be
+# `read` today, which is exactly the kind of repo-level setting that silently
+# changed this workflow's sibling out from under it.
+permissions:
+  contents: read
 
 jobs:
   npm-deps-hash: