gh cli auth login does not work with the provided package.

[dotKuro]

Issue description

Running gh auth login for the first time after setting programs.gh.enable = true; in your home.nix will crash the gh cli with following error:

failed to authenticate via web browser: open /home/dotkuro/.config/gh/config.yml: read-only file system

Maintainer CC

@Gerschtli

Technical details

I investigated the source code of the gh cli and it seems that it not only writes the hosts.yaml which is for authentication (and should not be managed from the package which is correct 👍 ) but it also writes the config.yaml and will fail to do so, because the file is managed from the package. This will cause the gh cli to crash and stop the authentication.

I don't think that there is a way for a package to handle this correctly, I just wanted to document this issue. If anything the gh source code would need to be changed to not crash in this situation (which I think is reasonable, because people should be able to manage their configs them selfes), but I don't think this has a great chance of happening.

A current workaround would be:

• install the program by adding it to the home.packages list
• login in with the cli
• delete the config.yaml file
• remove gh from the home.packages and use progams.gh.enable instead

[drewrisinger]

@dotKuro thanks for the workaround, I found the same issue yesterday. Have you filed an upstream issue at https://github.com/cli/cli? A quick search through the issues didn't find any related to this issue, so it's probably worth opening at least before assuming they won't fix.

[EncodePanda]

But the issue seems that the configuration of gh module in home-manager points to a file in storage, thus it can not be modified by gh

[Gerschtli]

Probably you should not try to use home-manager to manage gh config file when using gh tool to manage its config.. I do not know any way to fix this.

[EncodePanda]

Hmm... I'm confused :)
Just to clarify: When enabling gh in home-manager, you have few options you can modify (like git protocol to use) and once you home-manager switch it will translate that to a .config/gh/config.yml. But that config does not hold secretes (obviously) so when you run gh for the first time, it tries to modify this config.yml (to add missing bits). But since the file is just a symlink to store, this operation fails. I think this makes gh not suitable for home-manager. I'm actually installing it via home.packages

[dotKuro]

@EncodePanda That is almost correct: Actually the secret of gh is stored in a seperate file to the config. Therefore the config can be managed using home manager, but when starting gh for the first time and creating a secret gh crashes in the moment it would create the config, because gh works internally in a way that it cannot write the secret with out having write permissions for the config file. It is just a little weird, but the config and the secret of gh are two different files.

[EncodePanda]

@dotKuro yes, you are 100% correct, maybe it is worth creating a ticket in gh

[samuela]

For anyone following along with the workaround, you have to add pkgs.gitAndTools.gh to home.packages, not pkgs.gh.

[stale]

Thank you for your contribution! I marked this issue as stale due to inactivity. If this remains inactive for another 7 days, I will close this issue. Please read the relevant sections below before commenting.

If you are the original author of the issue

• If this is resolved, please consider closing it so that the maintainers know not to focus on this.
• If this might still be an issue, but you are not interested in promoting its resolution, please consider closing it while encouraging others to take over and reopen an issue if they care enough.
• If you know how to solve the issue, please consider submitting a Pull Request that addresses this issue.

If you are not the original author of the issue

• If you are also experiencing this issue, please add details of your situation to help with the debugging process.
• If you know how to solve the issue, please consider submitting a Pull Request that addresses this issue.

Memorandum on closing issues

If you have nothing of substance to add, please refrain from commenting and allow the bot close the issue. Also, don't be afraid to manually close an issue, even if it holds valuable information.

Closed issues stay in the system for people to search, read, cross-reference, or even reopen--nothing is lost! Closing obsolete issues is an important way to help maintainers focus their time and effort.

[samuela]

Bump, still an issue. I think we should either clearly document this behavior and/or open an issue upstream on gh.

[sumnerevans]

Also, since NixOS/nixpkgs#109396, gh is in top-level pkgs.

[stale]

Thank you for your contribution! I marked this issue as stale due to inactivity. If this remains inactive for another 7 days, I will close this issue. Please read the relevant sections below before commenting.

If you are the original author of the issue

• If this is resolved, please consider closing it so that the maintainers know not to focus on this.
• If this might still be an issue, but you are not interested in promoting its resolution, please consider closing it while encouraging others to take over and reopen an issue if they care enough.
• If you know how to solve the issue, please consider submitting a Pull Request that addresses this issue.

If you are not the original author of the issue

• If you are also experiencing this issue, please add details of your situation to help with the debugging process.
• If you know how to solve the issue, please consider submitting a Pull Request that addresses this issue.

Memorandum on closing issues

If you have nothing of substance to add, please refrain from commenting and allow the bot close the issue. Also, don't be afraid to manually close an issue, even if it holds valuable information.

Closed issues stay in the system for people to search, read, cross-reference, or even reopen--nothing is lost! Closing obsolete issues is an important way to help maintainers focus their time and effort.

[shinzui]

This is still an issue.

[sullyj3]

Created the upstream issue here

[sullyj3]

This has been fixed by cli/cli#5378

[berbiche]

Thanks for the update.
Now we just have to wait for it to reach nixpkgs.

[samuela]

This still hasn't reached nixpkgs AFAICT (just got the error now). Is there anything we can do to hasten it making it into nixpkgs?