feat: 新規マシンでも nix-darwin セットアップが通るようにする - #1004
Conversation
- flake をマルチホスト対応にし、mkDarwin ヘルパーで username / hostname をパラメータ化(oykotnoMacBook-Air を追加) - Determinate Nix 環境向けに determinateNix オプションを追加し、 nix-darwin の Nix 管理と衝突しないよう nix.enable = false を設定 - Homebrew 6+ の untrusted tap 拒否対策として、activation 前に primaryUser で brew trust を実行 - gcloud-cli cask を nixpkgs の google-cloud-sdk に置き換え (cask の postinstall が virtualenv コマンドを要求し新規マシンで失敗するため) - bash 4+ を brews に追加(setup-claude.sh と typeset -g を使うスクリプトが必要) - /Users/keito 固定だったパス(skhd・agent-deck・dotfiles)を username 変数化 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
📝 WalkthroughWalkthroughDarwin configurations now support multiple usernames and optional Determinate Nix management. Home Manager paths, host services, IME shortcuts, Homebrew tap trust, Google Cloud tooling, CI evaluation, macOS setup documentation, and repository tooling metadata are updated. ChangesDarwin configuration and macOS setup
Repository tooling metadata
Estimated code review effort: 4 (Complex) | ~45 minutes Sequence Diagram(s)sequenceDiagram
participant Flake
participant NixDarwin
participant HomeManager
Flake->>NixDarwin: Create named Darwin configuration
NixDarwin->>NixDarwin: Apply username and determinateNix
NixDarwin->>HomeManager: Pass configRoot and username
HomeManager->>HomeManager: Configure user home and managed paths
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Claude encountered an error after 3m 3s —— View job I'll analyze this and get back to you. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@nix/modules/homebrew.nix`:
- Around line 19-23: Remove the `|| true` failure suppression from the `brew
trust` command generated by `system.activationScripts.preActivation.text`.
Ensure each required tap trust failure causes activation to exit nonzero, while
preserving the existing user, Homebrew path, and tap iteration behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 72df67ab-1a29-43cd-ae23-a51564000ab6
📒 Files selected for processing (7)
nix/flake.nixnix/home/default.nixnix/home/dotfiles.nixnix/home/packages.nixnix/hosts/darwin/default.nixnix/modules/homebrew.nixtest/nix-darwin-config.test.js
| system.activationScripts.preActivation.text = '' | ||
| if [ -x /opt/homebrew/bin/brew ] && sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust --help >/dev/null 2>&1; then | ||
| ${lib.concatMapStringsSep "\n " ( | ||
| tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}" || true'' | ||
| ) taps} |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
Do not suppress tap-trust failures.
Line 22 masks every brew trust error even though Lines 16-18 identify trust as required before Homebrew activation. This can still make darwin-rebuild switch fail later, while hiding the actionable cause. Let the activation fail, or collect failed taps and exit nonzero.
Proposed fix
- tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}" || true''
+ tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}"''📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| system.activationScripts.preActivation.text = '' | |
| if [ -x /opt/homebrew/bin/brew ] && sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust --help >/dev/null 2>&1; then | |
| ${lib.concatMapStringsSep "\n " ( | |
| tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}" || true'' | |
| ) taps} | |
| system.activationScripts.preActivation.text = '' | |
| if [ -x /opt/homebrew/bin/brew ] && sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust --help >/dev/null 2>&1; then | |
| ${lib.concatMapStringsSep "\n " ( | |
| tap: ''sudo -u ${config.system.primaryUser} -H /opt/homebrew/bin/brew trust "${tap}"'' | |
| ) taps} |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@nix/modules/homebrew.nix` around lines 19 - 23, Remove the `|| true` failure
suppression from the `brew trust` command generated by
`system.activationScripts.preActivation.text`. Ensure each required tap trust
failure causes activation to exit nonzero, while preserving the existing user,
Homebrew path, and tap iteration behavior.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cdb2243a82
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "oykotnoMacBook-Air" = mkDarwin { | ||
| hostname = "oykotnoMacBook-Air"; | ||
| username = "oykot"; | ||
| determinateNix = true; |
There was a problem hiding this comment.
This adds a second Darwin configuration with a Determinate Nix mode, which is a non-trivial architecture change to the macOS environment. I searched docs/adr and found no ADR covering the multi-host/Determinate decision, so future agents and reviewers will not have the context the repository requires before implementation; please add an ADR with the context, decision, and consequences.
Useful? React with 👍 / 👎.
初回 activation ではリンク生成前に helper を呼ぶため ~/.local/bin/kanary-enforce-caps-control が存在せずエラーになる Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
claude / codex のネイティブインストーラーが ~/.local/bin に バイナリを配置するため、新規マシンでも PATH が通るようにする Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- CI に Nix Config Eval ジョブを追加し、両ホストの darwinConfigurations を Linux ランナーで評価検証する (これまで nix ファイルは文字列ベースの jest テストのみで 構成の破損を検出できなかった) - nix 変更が CI をトリガーするよう paths / changes フィルタに追加 - Quality Gate に Nix Config Eval を組み込み - 実機で検証した手順を docs/setup/macos.md として文書化 (Homebrew → Nix → App Store / Kanary → flake ホスト追加 → 初回 switch → Claude/credentials、トラブルシューティング付き) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 269-291: Update the checkout step in the nix-eval job to set
persist-credentials to false, while preserving the existing pinned
actions/checkout reference and all other evaluation steps.
In `@AGENTS.md`:
- Around line 152-157: Escape the pipe character in the shellcheck command
within the scripts table as \| so Markdown keeps the command in one column,
while preserving the existing *.sh glob and command behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: cf0687c7-2c3b-4d74-b2e2-f0136e1f3aab
📒 Files selected for processing (8)
.claude/settings.json.github/workflows/ci.yml.zsh/configs/pre/path.zshAGENTS.mdREADME.mddocs/setup/README.mddocs/setup/macos.mdnix/home/kanary.nix
| nix-eval: | ||
| name: Nix Config Eval | ||
| runs-on: ubuntu-latest | ||
| timeout-minutes: 15 | ||
| needs: changes | ||
| if: needs.changes.outputs.nix == 'true' | ||
| steps: | ||
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
|
|
||
| - name: Install Nix | ||
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | ||
|
|
||
| # 評価はプラットフォーム非依存なので Linux ランナーで aarch64-darwin の | ||
| # darwinConfigurations を検証できる（ビルドはしない） | ||
| - name: Evaluate darwin configurations | ||
| working-directory: nix | ||
| run: | | ||
| for host in keitonoMacBook-Pro oykotnoMacBook-Air; do | ||
| echo "Evaluating darwinConfigurations.${host}..." | ||
| nix eval --raw ".#darwinConfigurations.\"${host}\".system.drvPath" | ||
| echo | ||
| done | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "== workflow excerpt =="
sed -n '240,305p' .github/workflows/ci.yml 2>/dev/null || true
echo
echo "== checkout usages in ci.yml =="
rg -n "actions/checkout|persist-credentials|evaluate|nix eval|darwinConfigurations|secrets|GITHUB_TOKEN|token" .github/workflows/ci.yml || true
echo
echo "== changed workflow diff stat =="
git diff --stat .github/workflows/ci.yml || true
git diff -- .github/workflows/ci.yml | sed -n '1,260p' || trueRepository: keito4/config
Length of output: 3622
🌐 Web query:
actions/checkout persist-credentials default true README
💡 Result:
In the actions/checkout GitHub Action, the persist-credentials parameter is a configuration option that determines whether the authentication token or SSH key used to check out the repository is persisted in the local git configuration [1][2][3]. Key details include: - Default Value: The default is true [1][2][3]. - Purpose: When set to true, it enables subsequent steps in your workflow to run authenticated git commands (e.g., git push, git fetch) without needing to manually re-configure authentication [1][3][4]. - Security Implementation: The credentials are removed during the post-job cleanup [1][3][5]. As of version v6.0.0, the action was updated to store these credentials in a separate file under the $RUNNER_TEMP directory rather than directly in the local.git/config file, improving security by reducing potential exposure [6][7]. - Opt-out: You can explicitly set persist-credentials: false in your workflow step if you do not want the credentials to be persisted [1][3][4]. While this setting has been the subject of long-standing security discussions regarding the exposure of tokens to other steps in a job, it remains the default behavior to support common automation workflows [8][9]. Users are generally advised to follow the principle of least privilege by setting appropriate repository permissions for the GITHUB_TOKEN used in their workflows [9].
Citations:
- 1: https://github.com/actions/checkout
- 2: https://github.com/actions/checkout/blob/cbb722410c2e876e24abbe8de2cc27693e501dcb/action.yml
- 3: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 4: https://github.com/actions/checkout/?tab=readme-ov-file
- 5: https://github.com/actions/checkout/blob/85e6279cec87321a52edac9c87bce653a07cf6c2/README.md
- 6: https://github.com/actions/checkout/tree/v6.0.0
- 7: actions/checkout@v5.0.1...v6.0.0
- 8: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312 - 9: Remove
persist-credentialsor change the default tofalseactions/checkout#485
Disable credential persistence for the checkout used by Nix evaluation.
actions/checkout persists the GitHub token by default, and this job then evaluates PR-controlled Nix darwinConfigurations. Add persist-credentials: false to this checkout step.
Proposed fix
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+ with:
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| nix-eval: | |
| name: Nix Config Eval | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: changes | |
| if: needs.changes.outputs.nix == 'true' | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| # 評価はプラットフォーム非依存なので Linux ランナーで aarch64-darwin の | |
| # darwinConfigurations を検証できる（ビルドはしない） | |
| - name: Evaluate darwin configurations | |
| working-directory: nix | |
| run: | | |
| for host in keitonoMacBook-Pro oykotnoMacBook-Air; do | |
| echo "Evaluating darwinConfigurations.${host}..." | |
| nix eval --raw ".#darwinConfigurations.\"${host}\".system.drvPath" | |
| echo | |
| done | |
| nix-eval: | |
| name: Nix Config Eval | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| needs: changes | |
| if: needs.changes.outputs.nix == 'true' | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 | |
| # 評価はプラットフォーム非依存なので Linux ランナーで aarch64-darwin の | |
| # darwinConfigurations を検証できる（ビルドはしない） | |
| - name: Evaluate darwin configurations | |
| working-directory: nix | |
| run: | | |
| for host in keitonoMacBook-Pro oykotnoMacBook-Air; do | |
| echo "Evaluating darwinConfigurations.${host}..." | |
| nix eval --raw ".#darwinConfigurations.\"${host}\".system.drvPath" | |
| echo | |
| done |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 276-276: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 269 - 291, Update the checkout step in
the nix-eval job to set persist-credentials to false, while preserving the
existing pinned actions/checkout reference and all other evaluation steps.
Source: Linters/SAST tools
| | Script | Command | Purpose | | ||
| | ----------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------- | | ||
| | `format:check` | `prettier --check .` | Code formatting validation | | ||
| | `lint` | `eslint . --ext .js` | Code quality validation | | ||
| | `test` | `jest --runInBand` | Unit test execution | | ||
| | `shellcheck` | `find script -name '*.sh' -type f | xargs -r shellcheck -x` | Shell script validation | |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Escape the pipe in the shellcheck command.
The | in Line 157 creates a fourth Markdown table column, so the documented command is rendered incorrectly. Escape it as \| while preserving the corrected *.sh glob.
Proposed fix
-| `shellcheck` | `find script -name '*.sh' -type f | xargs -r shellcheck -x` | Shell script validation |
+| `shellcheck` | `find script -name '*.sh' -type f \| xargs -r shellcheck -x` | Shell script validation |📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| | Script | Command | Purpose | | |
| | ----------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------- | | |
| | `format:check` | `prettier --check .` | Code formatting validation | | |
| | `lint` | `eslint . --ext .js` | Code quality validation | | |
| | `test` | `jest --runInBand` | Unit test execution | | |
| | `shellcheck` | `find script -name '*.sh' -type f | xargs -r shellcheck -x` | Shell script validation | | |
| | Script | Command | Purpose | | |
| | ----------------------------------------------------------------------------------------------------------------------- | --------------------------------- | -------------------------- | | |
| | `format:check` | `prettier --check .` | Code formatting validation | | |
| | `lint` | `eslint . --ext .js` | Code quality validation | | |
| | `test` | `jest --runInBand` | Unit test execution | | |
| | `shellcheck` | `find script -name '*.sh' -type f \| xargs -r shellcheck -x` | Shell script validation | |
🧰 Tools
🪛 markdownlint-cli2 (0.23.0)
[warning] 157-157: Table column count
Expected: 3; Actual: 4; Too many cells, extra data will be missing
(MD056, table-column-count)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` around lines 152 - 157, Escape the pipe character in the
shellcheck command within the scripts table as \| so Markdown keeps the command
in one column, while preserving the existing *.sh glob and command behavior.
Source: Linters/SAST tools
|
🎉 This PR is included in version 1.127.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Summary
新規マシン（別ユーザー名・別ホスト名・Determinate Nix・Homebrew 6+）で
darwin-rebuild switchが最後まで通らない問題を解消する。oykotnoMacBook-Air での初回セットアップで実際に踏んだ失敗を一つずつ潰し、再発防止として nix 設定の CI 検証とセットアップガイドを追加した。Why
flake が
keito/keitonoMacBook-Pro固定で新規マシンに適用できず、さらに以下の環境差分で activation が失敗するため:error: Determinate detected, aborting activation）brew bundle失敗）virtualenvコマンドを要求して失敗typeset -gを使うスクリプト（setup-claude.sh 等）が macOS 標準 bash 3.2 で動かない~/.local/bin（claude / codex のネイティブインストール先）が PATH に無いまた、nix ファイルは文字列ベースの jest テストしかなく、構成の破損を CI で検出できなかった。
What
mkDarwinヘルパーで username / hostname をパラメータ化（oykotnoMacBook-Air を追加）determinateNixオプションを追加し、有効時はnix.enable = false（既存ホストは従来どおり nix-darwin が Nix を管理）brew trust（brew trust 未対応の旧 Homebrew ではスキップ）google-cloud-sdkに置き換えbashを brews に追加linkGenerationの後に実行~/.local/binを PATH に追加（path.zsh）/Users/keito固定パス（skhd・agent-deck launchd・dotfiles の private-config 参照）を username 変数化How to test
nix eval .#darwinConfigurations.oykotnoMacBook-Air.system.drvPath/keitonoMacBook-Pro両方成功npx jest --runInBand779 件全パス（brew bash 導入後）make nix-switchが従来どおり通ることChecklist
Related
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Improvements