vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wip(#1970): add hyperhive.githubAccount nix option (single-account, nullable)

Browse source
This commit is contained in:
damocles 2026-07-11 10:30:06 +02:00 • committed by mara
commit 303037689e
1 changed files with 70 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

70
nix/templates/harness-base.nix
View file

@ -624,6 +624,76 @@ in
'';
};
options.hyperhive.githubAccount = lib.mkOption {
type = lib.types.nullOr (
lib.types.submodule {
options = {
username = lib.mkOption {
type = lib.types.str;
example = "the-sword-above";
description = ''
GitHub login the agent acts as. Used as the username for
`git push` over HTTPS and shown to the agent via the
`HIVE_GITHUB_USER` environment variable. Should be a
dedicated bot account, never a human's.
'';
};
tokenFile = lib.mkOption {
type = lib.types.str;
example = "/agents/damocles/state/github-token";
description = ''
Path to the file holding this account's personal access
token (PAT). The token *value* is never in nix --- the
provisioner (dashboard credentials tab, or `hivectl`)
writes an operator-supplied PAT here (0600, agent-owned),
the same contract as `matrixAccounts.<name>.tokenFile`.
The `gh` wrapper and the git credential helper read the
token from this path at invocation time, so a PAT pasted
mid-session takes effect with no rebuild. `gh` / `git push`
simply fail unauthenticated until the file exists.
Keep the PAT minimally scoped (only the repos/scopes the
agent's workflow needs): the agent has passwordless sudo,
so a compromised agent can act as the account within the
token's scopes --- scope is the real blast-radius limiter.
'';
};
host = lib.mkOption {
type = lib.types.str;
default = "github.com";
example = "github.example.com";
description = ''
GitHub host. Defaults to `github.com`; set it for a GitHub
Enterprise instance. Drives both the `gh` API host
(`GH_HOST`) and the git credential helper's URL match.
'';
};
};
}
);
default = null;
example = lib.literalExpression ''
{
username = "the-sword-above";
tokenFile = "/agents/damocles/state/github-token";
}
'';
description = ''
Give the agent a managed GitHub account: a `gh` CLI wrapper and a
git credential helper, both authenticated from an operator-supplied
PAT, so the agent can run `gh` API calls and `git push` to GitHub as
the configured login without any manual `gh auth login` dance.
`null` (the default) leaves GitHub off entirely --- no `gh` wrapper,
no credential helper, no env. When set, the token is supplied out of
band (dashboard credentials tab / `hivectl`) into `tokenFile`; nix
only carries the login + host, never the secret.
Single account per agent by design (unlike `matrixAccounts`, which is
multi-account): the GitHub workflow is "this agent is this one bot".
'';
};
options.hyperhive.frontend.dist = lib.mkOption {
type = lib.types.package;
default = pkgs.hyperhive-frontend;