added permission in nix.yml (#136) #15

	name: CI

	permissions:
	contents: read
	packages: write

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["main"]
	workflow_dispatch:

	jobs:
	build:
	runs-on: x86_64-linux
	outputs:
	docker-image-name: ${{ steps.docker.outputs.image_name }}
	steps:
	- uses: actions/checkout@v4
	- uses: cachix/cachix-action@v15
	with:
	name: nammayatri
	authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
	skipPush: true

	- name: Build all flake outputs
	run: om ci

	# Push and pin whitelisted paths to cachix
	# - name: Push to cachix
	# if: github.ref == 'refs/heads/main'
	# run: nix run .#cachix-push

	- name: Docker tasks
	id: docker
	if: (github.ref == 'refs/heads/main')
	run: \|
	nix build .#dockerImage -o docker-image.tgz
	echo "image_name=$(nix eval --raw .#dockerImage.imageName):$(nix eval --raw .#dockerImage.imageTag)" >> $GITHUB_OUTPUT

	- name: Upload Docker image tarball
	if: (github.ref == 'refs/heads/main')
	uses: actions/upload-artifact@v4
	with:
	name: docker-image
	path: docker-image.tgz

	push-docker:
	needs: build
	runs-on: ubuntu-latest
	if: (github.ref == 'refs/heads/main')
	steps:
	- name: Download Docker image tarball
	uses: actions/download-artifact@v4
	with:
	name: docker-image
	- name: Load and push Docker image
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	echo "$GITHUB_TOKEN" \| docker login ghcr.io -u "${{ github.actor }}" --password-stdin
	docker load < docker-image.tgz
	docker push ${{ needs.build.outputs.docker-image-name }}
	docker logout ghcr.io

Provide feedback