mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

agents keep their github token in /run, fetched on every start, not in the state dir

Browse source
This commit is contained in:
atlas 2026-11-15 02:04:04 +01:00 • committed by mara
commit 4bd02ea14d
1 changed files with 310 additions and 78 deletions
Download patch file Download diff file Expand all files Collapse all files

36
nix/agent-modules/github.nix
View file

@ -1,13 +1,12 @@
# GitHub integration (services.hyperhive.agent.github.enable): a `gh` wrapper + a git
# credential helper, both reading the PAT from the agent's
# `github-token` state file at invocation, so a token ./github-token.nix
# fetches takes effect with no rebuild. The token PATH is baked in at build
# time (nix knows `userName`) — NOT read from `$HIVE_GITHUB_TOKEN_FILE`,
# because claude's Bash tool runs `bash -c` in a minimal env that
# doesn't source `/etc/set-environment`, so the env var isn't present
# where `gh`/`git` actually run. The token value never enters the nix
# store (only its path). github.com only; git auths as `x-access-token`
# + PAT.
# credential helper, both reading the PAT from `github.tokenFile` (the file
# ./github-token.nix fetches into under `/run`) at invocation, so a fetched
# token takes effect with no rebuild. The token PATH is baked in at build
# time — NOT read from an env var, because claude's Bash tool runs `bash -c`
# in a minimal env that doesn't source `/etc/set-environment`, so the env var
# isn't present where `gh`/`git` actually run. The token value never enters
# the nix store (only its path). github.com only; git auths as
# `x-access-token` + PAT.
{
pkgs,
lib,
@ -16,9 +15,10 @@
}:
let
userName = config.services.hyperhive.agent.user.name;
tokenFile = config.services.hyperhive.agent.github.tokenFile;
ghWrapper = pkgs.writeShellScriptBin "gh" ''
if [ -r "/agents/${userName}/state/github-token" ]; then
GH_TOKEN="$(cat "/agents/${userName}/state/github-token")"
if [ -r "${tokenFile}" ]; then
GH_TOKEN="$(cat "${tokenFile}")"
export GH_TOKEN
fi
exec ${pkgs.gh}/bin/gh "$@"
@ -26,11 +26,11 @@ let
gitCredHelper = pkgs.writeShellScriptBin "git-credential-hive-github" ''
# git credential-helper protocol: only the `get` action needs an answer.
[ "''${1:-}" = "get" ] || exit 0
if [ -r "/agents/${userName}/state/github-token" ]; then
if [ -r "${tokenFile}" ]; then
# GitHub ignores the username for PAT auth — `x-access-token` is the
# conventional placeholder; the PAT is the password.
printf 'username=x-access-token\n'
printf 'password=%s\n' "$(cat "/agents/${userName}/state/github-token")"
printf 'password=%s\n' "$(cat "${tokenFile}")"
fi
'';
in
@ -43,7 +43,7 @@ in
git credential helper for `https://github.com`, both authenticated from
an operator-supplied personal access token (PAT). The operator links the
PAT in the swarm UI, and the agent fetches it from the swarm secret store
into `<state>/github-token` (needs `services.hyperhive.agent.bao.addr`),
into `/run` (needs `services.hyperhive.agent.bao.addr`),
so giving an agent GitHub is a runtime action, no per-agent config or
rebuild. The wrappers read the token file at invocation, so a fetched
PAT takes effect immediately; until one exists, `gh` / `git push` just
@ -72,7 +72,7 @@ in
# Wire the GitHub credential helper for `git push` over HTTPS. Host-scoped
# to `https://github.com`, so it never touches the forge (localhost:3000)
# or any other remote. The helper reads the PAT from the agent's
# `github-token` state file at invocation and auths as `x-access-token` +
# `github.tokenFile` at invocation and auths as `x-access-token` +
# the PAT. System /etc/gitconfig merges under the agent's ~/.gitconfig
# (safe.directory), so this is additive.
# Nested-path binding + mkIf (matching the other `environment.etc."…"`
@ -110,8 +110,8 @@ in
# (agent-service.nix) — one todo stream, two producers.
HIVE_AGENT_SOCKET = "/run/hive-agent/${userName}/agent.sock";
RUST_LOG = "info";
# HYPERHIVE_STATE_DIR comes from systemd.globalEnvironment; the
# poller reads the agent's `github-token` from under it.
# The file ./github-token.nix fetches the PAT into; a path, never the value.
HIVE_GITHUB_TOKEN_FILE = tokenFile;
};
serviceConfig = {
ExecStart = "${config.services.hyperhive.agent.packages.hive-github-notify}/bin/hive-github-notify";
@ -138,7 +138,7 @@ in
systemd.paths.hive-github-notify = lib.mkIf config.services.hyperhive.agent.github.enable {
description = "start hive-github-notify when the GitHub token appears";
wantedBy = [ "multi-user.target" ];
pathConfig.PathChanged = "/agents/${userName}/state/github-token";
pathConfig.PathChanged = tokenFile;
};
};
}