From 8ef0842b01aaafb7493fbd74a37f66d137e0c6ed Mon Sep 17 00:00:00 2001
From: Mitchell Hashimoto <m@mitchellh.com>
Date: Tue, 20 Jan 2026 13:07:06 -0800
Subject: [PATCH] ci: authenticate pinact to avoid GH rate limits

When we're running a lot of CI we're hitting low unauthenticated rate
limits.
---
 .github/workflows/test.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index fbac22a47..734b8d224 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -844,6 +844,8 @@ jobs:
     if: github.repository == 'ghostty-org/ghostty'
     runs-on: namespace-profile-ghostty-xsm
     timeout-minutes: 60
+    permissions:
+      contents: read
     env:
       ZIG_LOCAL_CACHE_DIR: /zig/local-cache
       ZIG_GLOBAL_CACHE_DIR: /zig/global-cache
@@ -866,6 +868,8 @@ jobs:
           useDaemon: false # sometimes fails on short jobs
       - name: pinact check
         run: nix develop -c pinact run --check
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   prettier:
     if: github.repository == 'ghostty-org/ghostty'