Relax sandboxing for darwin due to pre-commit

Author: fzakaria

.github/workflows/ci.yml

@@ -91,7 +91,8 @@ jobs:
         github_token: ${{ secrets.GITHUB_TOKEN }}
         dogfood: ${{ github.event_name == 'workflow_dispatch' && inputs.dogfood || github.event_name != 'workflow_dispatch' }}
         # The sandbox would otherwise be disabled by default on Darwin
-        extra_nix_config: "sandbox = true"
+        # Unfortunately due to some packages (dotnet), we must set it to relaxed.
+        extra_nix_config: ${{ matrix.os == 'darwin' && 'sandbox = relaxed' || 'sandbox = true' }}
     # Since ubuntu 22.30, unprivileged usernamespaces are no longer allowed to map to the root user:
     # https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
     - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0