feat: tiered GitHub token context switching - #971
Conversation
Add gh-restricted, gh-private, gh-admin functions that switch GITHUB_TOKEN by reading tiered PATs from macOS Keychain. Defaults to restricted on shell startup; escalation gated by keychain password. Restricted uses automation.keychain-db (AI accessible). Private and admin use elevate-access.keychain-db (user unlock required). Centralizes token configuration in lib/user-config.nix under github.tokens with per-tier service + keychain attributes for DRY. Includes temporary direnv darwin overlay tracking NixOS/nix#6065: Mach-O signature corruption causes fish test SIGKILL. Remove when NixOS/nix#15638 lands.
There was a problem hiding this comment.
Pull request overview
Adds a tiered GitHub token “context switching” workflow for the macbook-m4 shell environment (defaulting to least privilege on startup), and introduces a temporary darwin overlay to keep direnv checks passing by skipping the test-fish target impacted by a Nix daemon Mach-O signing corruption bug.
Changes:
- Add
gh-restricted,gh-private,gh-admin, andgh-token-statuszsh functions that setGITHUB_TOKENby reading tiered PATs from macOS Keychain. - Centralize per-tier token metadata (service name + keychain DB) in
lib/user-config.nixand wire the new switching into zsh init with a restricted default. - Add a temporary nixpkgs overlay on darwin to override
direnv’scheckPhaseto excludetest-fish.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| overlays/direnv-darwin-fix.nix | Adds a darwin-only overlay to skip direnv’s test-fish while keeping other tests. |
| modules/darwin/common.nix | Enables the new overlay in the darwin nixpkgs overlay list. |
| lib/user-config.nix | Introduces github.tokens per-tier service/keychain config for DRY token switching. |
| hosts/macbook-m4/home.nix | Persists keychain helper + vars for runtime switching; sources switching script; defaults new shells to restricted. |
| hosts/macbook-m4/gh-token-switching.zsh | Implements the gh-* token switching/status functions. |
Need me to fix this? Tag @copilot in a reply to request an automatic fix.
Do NOT tag me just to say thanks — only tag if you want me to make changes.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a tiered GitHub token context switching mechanism for macOS, allowing users to switch between restricted, private, and admin PATs stored in the macOS Keychain. It also includes a temporary Nix overlay to fix a direnv build issue on Darwin caused by a known Nix daemon bug. One improvement was identified regarding the shell script: error messages and setup instructions should be redirected to stderr to avoid polluting stdout during command substitution or pipelining.
- gh-token-switching.zsh: call security directly to distinguish missing entries from locked/access-denied/empty failures; route errors to stderr; add REQUIRES contract comment listing expected env vars - home.nix: unset _get_keychain_secret and _KC_AI_DB after init since the switching functions no longer need them at runtime - direnv-darwin-fix.nix: use lib.optionalAttrs instead of if/then/else
Summary
Changes
gh-restricted,gh-private,gh-admin,gh-token-status, and internal_gh_switch_tokenhelper with comprehensive error handlinggithub.tokenssection with per-tier attributes (service,keychain) for DRY token configurationTest Plan
nix flake check— verifies flake syntax and overlay importssudo darwin-rebuild switch --flake .— applies configuration; verify no errorsgh-token-statusshows restricted tokengh-privateand verify keychain password prompt appearsGITHUB_TOKENis set from the elevate-access keychain after unlockgh-restrictedand verify token reverts to automation keychain tokengh-adminand verify admin token is set after keychain unlockGITHUB_PERSONAL_ACCESS_TOKENremains unchanged across all tier switchesgh repo list) — should only see public reposRelated