From be1811edb1f2f4be4b201fea65187c796d28fcd4 Mon Sep 17 00:00:00 2001
From: Joshua Peek <josh@users.noreply.github.com>
Date: Sun, 20 Jul 2025 14:52:51 -0700
Subject: [PATCH 1/2] nixos/services.github-runners: handle github oauth access
 tokens

---
 .../services/continuous-integration/github-runner/service.nix   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/continuous-integration/github-runner/service.nix b/nixos/modules/services/continuous-integration/github-runner/service.nix
index aaf8083dc5b9..fc334b147f4d 100644
--- a/nixos/modules/services/continuous-integration/github-runner/service.nix
+++ b/nixos/modules/services/continuous-integration/github-runner/service.nix
@@ -187,7 +187,7 @@
                         # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
                         # if it is not a PAT, we assume it contains a registration token and use the --token option
                         token=$(<"${newConfigTokenPath}")
-                        if [[ "$token" =~ ^ghp_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
+                        if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
                           args+=(--pat "$token")
                         else
                           args+=(--token "$token")

From 30470e1f31282e5281bc3a301acb946e0b5f2c59 Mon Sep 17 00:00:00 2001
From: Joshua Peek <josh@users.noreply.github.com>
Date: Sun, 20 Jul 2025 14:55:08 -0700
Subject: [PATCH 2/2] nixos/services.github-runners: add `tokenType` option

---
 .../github-runner/options.nix                 | 24 +++++++++++++++++++
 .../github-runner/service.nix                 | 21 ++++++++++++----
 2 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/continuous-integration/github-runner/options.nix b/nixos/modules/services/continuous-integration/github-runner/options.nix
index cb1020b7eab9..23436c2adf71 100644
--- a/nixos/modules/services/continuous-integration/github-runner/options.nix
+++ b/nixos/modules/services/continuous-integration/github-runner/options.nix
@@ -102,6 +102,30 @@
               example = "/run/secrets/github-runner/nixos.token";
             };
 
+            tokenType = lib.mkOption {
+              type = lib.types.enum [
+                "auto"
+                "access"
+                "registration"
+              ];
+              description = ''
+                Type of token to use for runner registration.
+
+                An access token is a personal access token or any other kind of GitHub token that
+                starts with `ghp_`, `gho_`, etc prefix. It is passed as `--pat` to the runner
+                config script.
+
+                A registration token is an unprefixed string generated by the
+                "Add new self-hosted runner" page. It is passed as `--token` to runner config
+                script.
+
+                The default `auto` attempts to detect the token type automatically based on its
+                format.
+              '';
+              example = "registration";
+              default = "auto";
+            };
+
             name = lib.mkOption {
               type = lib.types.nullOr lib.types.str;
               description = ''
diff --git a/nixos/modules/services/continuous-integration/github-runner/service.nix b/nixos/modules/services/continuous-integration/github-runner/service.nix
index fc334b147f4d..2a0720a6b0c7 100644
--- a/nixos/modules/services/continuous-integration/github-runner/service.nix
+++ b/nixos/modules/services/continuous-integration/github-runner/service.nix
@@ -184,14 +184,25 @@
                           ${lib.optionalString cfg.ephemeral "--ephemeral"}
                           ${lib.optionalString cfg.noDefaultLabels "--no-default-labels"}
                         )
-                        # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
-                        # if it is not a PAT, we assume it contains a registration token and use the --token option
                         token=$(<"${newConfigTokenPath}")
-                        if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
+                        case ${cfg.tokenType} in
+                        access)
                           args+=(--pat "$token")
-                        else
+                          ;;
+                        registration)
                           args+=(--token "$token")
-                        fi
+                          ;;
+                        auto)
+                          # If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"),
+                          # we have to use the --pat option, if it is not a PAT, we assume it contains a
+                          # registration token and use the --token option
+                          if [[ "$token" =~ ^gh[a-z]+_* ]] || [[ "$token" =~ ^github_pat_* ]]; then
+                            args+=(--pat "$token")
+                          else
+                            args+=(--token "$token")
+                          fi
+                          ;;
+                        esac
                         ${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
                         # Move the automatically created _diag dir to the logs dir
                         mkdir -p  "$STATE_DIRECTORY/_diag"