Integrate vscode + gnome-libsecret + pass(password-store) on NixOS

home-manager/desktop.nix

@@ -26,4 +26,12 @@
       };
     };
   };
+
+  # Extracted from encryption.nix to avoid dbus error in GitHub hosted runner
+  #
+  # https://github.com/nix-community/home-manager/blob/release-24.11/modules/services/pass-secret-service.nix
+  # Make it possible to use libsecret which is required in vscode GitHub authentication(--password-store="gnome-libsecret"), without gnome-keyring(GH-814).
+  #
+  # Alternative candidates: https://github.com/grimsteel/pass-secret-service
+  services.pass-secret-service.enable = true;
 }

nixos/desktop/default.nix

@@ -177,14 +177,24 @@
       # Don't use unstable channel. It frequently backported to stable channel
       #   - https://github.com/NixOS/nixpkgs/commits/nixos-24.11/pkgs/applications/editors/vscode/vscode.nix
       # https://github.com/NixOS/nixpkgs/blob/nixos-24.11/pkgs/applications/editors/vscode/generic.nix#L207-L217
-      (vscode.override {
-        # https://wiki.archlinux.org/title/Wayland#Electron
-        # https://github.com/NixOS/nixpkgs/blob/3f8b7310913d9e4805b7e20b2beabb27e333b31f/pkgs/applications/editors/vscode/generic.nix#L207-L214
-        commandLineArgs = [
-          "--enable-wayland-ime=true" # TODO: Remove after https://github.com/NixOS/nixpkgs/pull/361341 introduced. At least nixos-25.05
-          # TODO: Add `"--wayland-text-input-version=3"` after vscode updates the Electron to 33.0.0 or higher. See GH-689 for detail.
-        ];
-      })
+      (
+        (vscode.override {
+          # https://wiki.archlinux.org/title/Wayland#Electron
+          # https://github.com/NixOS/nixpkgs/blob/3f8b7310913d9e4805b7e20b2beabb27e333b31f/pkgs/applications/editors/vscode/generic.nix#L207-L214
+          commandLineArgs = [
+            "--enable-wayland-ime=true" # TODO: Remove after https://github.com/NixOS/nixpkgs/pull/361341 introduced. At least nixos-25.05
+            # TODO: Add `"--wayland-text-input-version=3"` after vscode updates the Electron to 33.0.0 or higher. See GH-689 for detail.
+
+            # https://github.com/microsoft/vscode/blob/5655a12f6af53c80ac9a3ad085677d6724761cab/src/vs/platform/encryption/common/encryptionService.ts#L28-L71
+            # https://github.com/microsoft/vscode/blob/5655a12f6af53c80ac9a3ad085677d6724761cab/src/main.ts#L244-L253
+            "--password-store=gnome-libsecret" # Required for GitHub Authentication. For example gnome-keyring, kwallet5, KeepassXC, pass-secret-service
+          ];
+        }).overrideAttrs
+        (prevAttrs: {
+          # https://incipe.dev/blog/post/using-visual-studio-code-insiders-under-home-manager/#an-os-keyring-couldnt-be-identified-for-storing-the-encryption-related-data-in-your-current-desktop-environment
+          runtimeDependencies = prevAttrs.runtimeDependencies ++ [ pkgs.libsecret ];
+        })
+      )
 
       # NOTE: Google might extract chrome from themself with `Antitrust` penalties
       #       https://edition.cnn.com/2024/11/20/business/google-sell-chrome-justice-department/