# ACL policy for the Forgejo Actions deploy token.
#
# Scopes: read the default namespace (job list / deployment status polling),
# full control over the contract-check job only. The token cannot touch
# agents, other jobs, or Nomad Variables (set via the management token).
#
# Apply with the management token (README §4):
#   nomad acl policy apply -description "Forgejo CI deploy" ci \
#     deploy/nomad/policies/ci.hcl
#
# If `nomad job run` from CI ever fails with permission errors during
# deployment evaluation, fall back to namespace-wide write:
#   namespace "default" { policy = "write" }

namespace "default" {
  policy = "read"

  job "contract-check" {
    policy = "write"
  }
}