Use nix flakes with private github deps

arianvp · April 11, 2024, 5:58pm

gist.github.com

https://gist.github.com/arianvp/8f80c23a3410d27746fb97a6563d9677

.envrc

#!/bin/sh

#If already set (e.g. in github actions); use that instead
if [ -z "$GITHUB_TOKEN" ]; then
  nix run nixpkgs#gh auth status || nix run nixpkgs#gh auth login
  GITHUB_TOKEN="$(nix run nixpkgs#gh auth token)"
  export GITHUB_TOKEN
fi

NIX_CONFIG="access-tokens = github.com=$GITHUB_TOKEN"

This file has been truncated. show original

README.md

# Use nix flakes with private github deps

![image](https://gist.github.com/assets/628387/72a4fe30-b3f2-4f59-add6-e7fe7110ed62)

flake.nix

{
  description = "A very private flake";

  inputs = {
    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
    runners.url = "github:arianvp/runners"; # private dep
  };

  outputs = { self, nixpkgs, runners }: {
    packages.aarch64-darwin.default = nixpkgs.legacyPackages.aarch64-darwin.hello;

This file has been truncated. show original

dpc · April 11, 2024, 6:06pm

I was actually in need of this, so thank you so much! I guess the biggest clue for me here is NIX_CONFIG and what exactly to put there.

I went to try it out and have some questions already.

What is the recommended way to wire it in the CI - let’s say Github Actions, the .envrc is not going to get automatically applied there anyway, right? So I guess the workflows need to set the NIX_CONFIG directly, as in .envrc? Also - note that Github will not let one create secrets starting by GITHUB_, so I went with NIX_GITHUB_TOKEN, but I guess it doesn’t matter much if NIX_CONFIG needs to be set manually anyway.

echo 'NIX_CONFIG=\"access-tokens = github.com=$NIX_GITHUB_TOKEN\"" > $GITHUB_ENV somewhere early should do that job, I guess?

arianvp · April 11, 2024, 6:19pm

Yes you’ll need to create a PAT or GitHub App that has the permissions to clone the other repos at the moment. I’ll see if I can hook up an example for GitHub actions next

arianvp · April 11, 2024, 7:20pm

It seems this could be very helpful in allowing GitHub actions access to other repos without long lived PATs:

https://twitter.com/lorenc_dan/status/1778459301515776012?t=IuL0GXjvmPXM-Scc1Lkeow&s=19

jonringer · April 12, 2024, 2:09am

Should also be able to do <flake>.url = "git+ssh://git@github.com/owner/repo";. Similar to builtins.fetchGit, it will use your user’s ssh credentials.