nixos/services.github-runners: handle gho_ tokens (#427029) (2dc1d222) · Commits · nix / nixpkgs

nixos/modules/services/continuous-integration/github-runner/options.nix

+24 −0

Original line number	Diff line number	Diff line
		@@ -102,6 +102,30 @@
		example = "/run/secrets/github-runner/nixos.token";
		};

		tokenType = lib.mkOption {
		type = lib.types.enum [
		"auto"
		"access"
		"registration"
		];
		description = ''
		Type of token to use for runner registration.

		An access token is a personal access token or any other kind of GitHub token that
		starts with `ghp_`, `gho_`, etc prefix. It is passed as `--pat` to the runner
		config script.

		A registration token is an unprefixed string generated by the
		"Add new self-hosted runner" page. It is passed as `--token` to runner config
		script.

		The default `auto` attempts to detect the token type automatically based on its
		format.
		'';
		example = "registration";
		default = "auto";
		};

		name = lib.mkOption {
		type = lib.types.nullOr lib.types.str;
		description = ''

+16 −5

Original line number	Diff line number	Diff line
		@@ -184,14 +184,25 @@
		${lib.optionalString cfg.ephemeral "--ephemeral"}
		${lib.optionalString cfg.noDefaultLabels "--no-default-labels"}
		)
		# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"), we have to use the --pat option,
		# if it is not a PAT, we assume it contains a registration token and use the --token option
		token=$(<"${newConfigTokenPath}")
		if [[ "$token" =~ ^ghp_* ]] \|\| [[ "$token" =~ ^github_pat_* ]]; then
		case ${cfg.tokenType} in
		access)
		args+=(--pat "$token")
		;;
		registration)
		args+=(--token "$token")
		;;
		auto)
		# If the token file contains a PAT (i.e., it starts with "ghp_" or "github_pat_"),
		# we have to use the --pat option, if it is not a PAT, we assume it contains a
		# registration token and use the --token option
		if [[ "$token" =~ ^gh[a-z]+_* ]] \|\| [[ "$token" =~ ^github_pat_* ]]; then
		args+=(--pat "$token")
		else
		args+=(--token "$token")
		fi
		;;
		esac
		${cfg.package}/bin/Runner.Listener configure "''${args[@]}"
		# Move the automatically created _diag dir to the logs dir
		mkdir -p "$STATE_DIRECTORY/_diag"