workflow: drop GitHub-only actions for the update job

Replaces cachix/install-nix-action and stefanzweifel/git-auto-commit-action
with inline shell so the workflow no longer touches github.com. Still pulls
the runner image from Docker Hub and the install script from nixos.org —
those are deliberately left for now and can be cut in a follow-up.

actions/checkout stays because it's mirrored on data.forgejo.org and the
runner already resolves it there.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.forgejo/workflows/update.yml

@@ -3,7 +3,7 @@ name: Update flake inputs
 on:
   schedule:
     - cron: '0 4 * * *'  # Daily at 4am UTC
-  workflow_dispatch:       # Allow manual trigger from GitHub Actions tab
+  workflow_dispatch:       # Allow manual trigger from the Actions tab
 
 jobs:
   update:
@@ -16,18 +16,25 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v31
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
-          extra_nix_config: |
-            experimental-features = nix-command flakes
+        run: |
+          set -euxo pipefail
+          curl --proto '=https' --tlsv1.2 -sSfL https://nixos.org/nix/install | sh -s -- --no-daemon
+          echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
+          mkdir -p ~/.config/nix
+          echo 'experimental-features = nix-command flakes' >> ~/.config/nix/nix.conf
 
       - name: Update flake inputs
         run: nix flake update
 
-      - name: Commit updated flake.lock
-        uses: stefanzweifel/git-auto-commit-action@v7
-        with:
-          commit_message: "flake: update inputs"
-          file_pattern: flake.lock
- 
+      - name: Commit and push
+        run: |
+          set -euxo pipefail
+          if git diff --quiet flake.lock; then
+            echo "No changes to flake.lock — skipping commit."
+            exit 0
+          fi
+          git config user.name 'forgejo-actions[bot]'
+          git config user.email 'actions@forg.gregersen.it'
+          git add flake.lock
+          git commit -m 'flake: update inputs'
+          git push