[kixelated]

Problem

The PR check workflow grants every job id-token: write without a protected environment.

Approach

Keep only contents: read and explicitly use the pinned Magic Nix Cache action's GitHub Actions backend with FlakeHub disabled. No OIDC-enabled job is needed.

Impact

• Public API and wire: unchanged.
• PR and main checks cannot mint OIDC tokens. Nix caching continues through GitHub Actions.

Alternatives

Moving the cache to a protected main-only job is unnecessary: the pinned action supports caching without OIDC. Explicit backend inputs keep CI from opportunistically selecting FlakeHub.

Checks

• quest gate nix develop --command just ci: passed (clippy, format, 31 library tests, cargo-deny). Four existing unused-license-allowance warnings; no GPU execution claim.
• Local Cargo isolation used a temporary empty [workspace] because this scratch clone is nested inside MoQ. It was removed after checks.
• actionlint and zizmor --offline: passed, no findings.
• Verified the exact pinned action's backend selection and no-OIDC test matrix. Its successful Ubuntu no-OIDC job runs cache liveness, upload, and substitution checks with ordinary Nix, FlakeHub disabled, and GitHub caching selected.
• The repository's own PR check passed at this head. The log records Contents: read without OIDC permission, Native GitHub Action cache is enabled, and successful Nix store uploads.

Review

Claude Code, claude-opus-5-5, medium effort, round 1: no findings at 99a8b072aeee9c57099d1e1c6c1bdf8c45792e04.

Follow-ups

The separate source port in moq-dev/vaapi#5 still needs review, merge, and crate publication before MoQ can adopt it. moq-dev/moq#7684 records the remaining release prerequisites. No source or version changes in this PR.

(Written by GPT-6.1 Sol)

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The workflow retains contents: read and removes id-token: write. The magic Nix cache action now disables FlakeHub and enables the GitHub Actions cache.

Merge Risk: Minimal · up to 99a8b

The workflow reduces token permissions and explicitly selects GitHub Actions caching. No actionable merge-blocking issue was identified; mergeable subject to normal CI checks.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main CI permission change.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description states the problem (every job in the PR check workflow gets id-token: write without a protected environment), the approach (keep only contents: read and explicitly select the GitHub Ac…

Full details: Description check

Explanation

The description states the problem (every job in the PR check workflow gets id-token: write without a protected environment), the approach (keep only contents: read and explicitly select the GitHub Actions cache backend with FlakeHub disabled in Magic Nix Cache), the impact, alternatives, and test evidence. It matches the changeset in .github/workflows/check.yml, which removes id-token: write and sets the cache action's backend inputs, so it is clearly related and specific.

Finishing Touches

Simplify code

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: ba71258f-8e14-428d-942b-79a70342fdff

Commits

Reviewing files that changed from the base of the PR and between 7751d38 and 99a8b07.

Files selected for processing: 1

• .github/workflows/check.yml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.