From bd0e554447d25d3856866d32a7bac75b1649eb3f Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive.local>
Date: Sat, 11 Jul 2026 11:42:59 +0200
Subject: [PATCH] =?UTF-8?q?fix(#1970):=20nested-path=20environment.etc."gi?=
 =?UTF-8?q?tconfig"=20+=20mkIf=20=E2=80=94=20whole-set=20binding=20collide?=
 =?UTF-8?q?d=20with=20sibling=20entries?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 nix/templates/harness-base.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/nix/templates/harness-base.nix b/nix/templates/harness-base.nix
index 19489046..13eefd3b 100644
--- a/nix/templates/harness-base.nix
+++ b/nix/templates/harness-base.nix
@@ -1673,8 +1673,11 @@ in
     # the PAT from HIVE_GITHUB_TOKEN_FILE at invocation and auths as
     # `x-access-token` + the PAT. System /etc/gitconfig merges under the agent's
     # ~/.gitconfig (safe.directory), so this is additive.
-    environment.etc = lib.optionalAttrs config.hyperhive.github.enable {
-      "gitconfig".text = ''
+    # Nested-path binding + mkIf (matching the other `environment.etc."…"`
+    # entries above) — a whole-set `environment.etc = {…}` here would collide
+    # with them at the nix level ("attribute already defined").
+    environment.etc."gitconfig" = lib.mkIf config.hyperhive.github.enable {
+      text = ''
         [credential "https://github.com"]
         helper = hive-github
         username = x-access-token