Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/trueberryless/nix. My nix config github.com/clemensschlipfinger/general-grievous-nix
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596{ pkgs, lib, username, ... }:##################################################################################### Claude Code runs every git and gh command as trueberryless-bot## The env block lives in Claude Code's managed settings, which the CLI and the# desktop app read on every session and which user/project settings cannot# override. Your own terminal is untouched.####################################################################################let home = "/Users/${username}";
botName = "trueberryless-bot"; botEmail = "324652437+trueberryless-bot@users.noreply.github.com"; botSigningKey = "${home}/.ssh/github-bot.pub"; # Classic PAT of the bot account (see README) botToken = "${home}/.config/github-bot/token"; # gh config dir holding only the bot account, generated from botToken below botGhConfigDir = "${home}/.config/github-bot/gh";
# Passed via GIT_CONFIG_{COUNT,KEY_n,VALUE_n}: this is git's highest-priority # scope, so it wins over ~/.gitconfig, includeIf blocks and repo-local config gitConfig = [ [ "user.name" botName ] [ "user.email" botEmail ] [ "user.signingkey" botSigningKey ] [ "gpg.format" "ssh" ] [ "commit.gpgsign" "true" ] [ "tag.gpgsign" "true" ] # Drop the keychain helper for GitHub only, then answer with the bot token [ "credential.https://github.com.helper" "" ] [ "credential.https://github.com.helper" "!f() { test \"$1\" = get && printf 'username=${botName}\\npassword=%s\\n' \"$(cat ${botToken})\"; }; f" ] # SSH remotes would authenticate with ~/.ssh/github (the human account) [ "url.https://github.com/.insteadOf" "git@github.com:" ] [ "url.https://github.com/.insteadOf" "ssh://git@github.com/" ] ];
gitEnv = { GIT_CONFIG_COUNT = toString (builtins.length gitConfig); } // lib.listToAttrs ( lib.concatLists ( lib.imap0 (i: kv: [ (lib.nameValuePair "GIT_CONFIG_KEY_${toString i}" (builtins.elemAt kv 0)) (lib.nameValuePair "GIT_CONFIG_VALUE_${toString i}" (builtins.elemAt kv 1)) ]) gitConfig ) );
managedSettings = pkgs.writeText "claude-code-github-bot.json" ( builtins.toJSON { env = gitEnv // { GH_CONFIG_DIR = botGhConfigDir; # An inherited token would take precedence over the bot's hosts.yml GH_TOKEN = ""; GITHUB_TOKEN = ""; }; } );in{ system.activationScripts.postActivation.text = '' echo "installing Claude Code managed settings..." >&2 install -d -m 755 "/Library/Application Support/ClaudeCode/managed-settings.d" install -m 644 ${managedSettings} "/Library/Application Support/ClaudeCode/managed-settings.d/50-github-bot.json" '';
home-manager.users.${username} = { lib, ... }: { home.file.".claude/CLAUDE.md".source = ../dotfiles/claude/CLAUDE.md; # Linked file by file so ~/.claude/rules itself stays writable home.file.".claude/rules" = { source = ../dotfiles/claude/rules; recursive = true; };
home.activation.claudeBotGh = lib.hm.dag.entryAfter [ "writeBoundary" ] '' if [ -r "${botToken}" ]; then token="$(tr -d '[:space:]' < "${botToken}")" ( umask 077 mkdir -p "${botGhConfigDir}" printf 'github.com:\n git_protocol: https\n users:\n ${botName}:\n oauth_token: %s\n user: ${botName}\n oauth_token: %s\n' \ "$token" "$token" > "${botGhConfigDir}/hosts.yml" ) else echo "claudeBotGh: ${botToken} missing, Claude Code's gh will not be authenticated" >&2 fi ''; };}