gador/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos/services.github-runners: handle gho_ tokens (#427029)

Browse Source
This commit is contained in:
Aleksana
2026-01-07 12:27:51 +00:00
committed by GitHub
parent 983f0d2ae3 30470e1f31
commit 2dc1d2229b
2 changed files with 40 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nixos/modules/services/continuous-integration/github-runner/options.nix
+24
View File
@@ -102,6 +102,30 @@
example = "/run/secrets/github-runner/nixos.token";
};
tokenType = lib.mkOption {
type = lib.types.enum [
"auto"
"access"
"registration"
];
description = ''
Type of token to use for runner registration.
An access token is a personal access token or any other kind of GitHub token that
starts with `ghp_`, `gho_`, etc prefix. It is passed as `--pat` to the runner
config script.
A registration token is an unprefixed string generated by the
"Add new self-hosted runner" page. It is passed as `--token` to runner config
script.
The default `auto` attempts to detect the token type automatically based on its
format.
'';
example = "registration";
default = "auto";
};
name = lib.mkOption {
type = lib.types.nullOr lib.types.str;
description = ''
nixos/modules/services/continuous-integration/github-runner/service.nix
+16 -5
View File
@@ -184,14 +184,25 @@
${lib.optionalString cfg.ephemeral "--ephemeral"}
${lib.optionalString cfg.noDefaultLabels "--no-default-labels"}
)
# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
# if it is not a PAT, we assume it contains a registration token and use the --token option
token=$(<"${newConfigTokenPath}")
if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
case ${cfg.tokenType} in
access)
args+=(--pat "$token")
else
;;
registration)
args+=(--token "$token")
fi
;;
auto)
# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"),
# we have to use the --pat option, if it is not a PAT, we assume it contains a
# registration token and use the --token option
if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
args+=(--pat "$token")
else
args+=(--token "$token")
fi
;;
esac
${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
# Move the automatically created _diag dir to the logs dir
mkdir -p "$STATE_DIRECTORY/_diag"