githubid

func ConfigYAML ¶

func ConfigYAML() string

ConfigYAML renders the gh config.yml that accompanies HostsYAML. Its only job is to carry the schema version marker: with it present, gh treats the materialized config as already-migrated and never tries to write to the read-only GH_CONFIG_DIR mount. Without it, gh runs a migration on first use and fails on the read-only dir (see HostsYAML).

func GitAuthor ¶

func GitAuthor(id Identity) (name, email string)

GitAuthor derives the git commit author (name, email) for an island that acts as this identity. Without it, commits inherit the host's gitconfig user.* — so a push authenticated as "work" gets authored with whatever email the daemon host happens to have, which GitHub then misattributes (it keys attribution off the email). We use GitHub's privacy-preserving noreply email so commits attribute to the right account without exposing a real address:

• canonical form (preferred): "<id>+<login>@users.noreply.<host>"
• fallback when the numeric id is unknown (identity stored before id capture): "<login>@users.noreply.<host>" — still account-linked, just the older form.

func GitConfig ¶

func GitConfig(id Identity) string

GitConfig renders a minimal gitconfig carrying just the identity's commit author. The daemon mounts this at /opt/host/gitconfig for identity-scoped islands (in place of the host's own gitconfig), and the entrypoint applies user.name/user.email from it — so authorship matches the push credential.

func HostsYAML ¶

func HostsYAML(id Identity) string

HostsYAML renders the gh hosts.yml for a single identity — what gh reads from GH_CONFIG_DIR to authenticate git over HTTPS inside an island. Only ever one identity per file.

It MUST emit the modern multi-account schema (the per-user `users:` map), not just the legacy top-level form. gh migrates a legacy-only hosts.yml to this schema on first use, which means writing back to GH_CONFIG_DIR — but the daemon mounts that dir read-only, so the migration fails and `gh auth setup-git` errors out, leaving the island with no git credential helper (the clone then can't authenticate). Materializing the already-migrated form means gh has nothing to write. See also ConfigYAML, which supplies the version marker gh checks before deciding to migrate.

func ScopeNote ¶ added in v0.8.74

func ScopeNote(scopes string) (note string, canWrite bool)

ScopeNote explains, in one line, what a token's scopes mean for the work an island does — or says plainly that it cannot tell.

Three states, and collapsing any two of them is how this went wrong:

""            a FINE-GRAINED token. GitHub sends no X-OAuth-Scopes header for
              these; permissions are per-repository and not visible from
              /user at all. "Unknown" is the honest answer, NOT "no scopes".
has "repo"    a classic token that can clone, push, and open pull requests.
otherwise     a classic token that authenticates and cannot write. This is
              the state that produced "Resource not accessible by personal
              access token" inside an island, hours after `github connect`
              reported success — because authenticating and being ABLE TO DO
              THE WORK are different questions and only the first was asked.

func ValidateName ¶ added in v0.8.17

func ValidateName(name string) error

ValidateName rejects an unusable identity name before it's stored.

func VerifyToken ¶

func VerifyToken(ctx context.Context, host, token string) (login string, id int64, scopes string, err error)

VerifyToken confirms a token authenticates against host and returns the login, numeric user id, and SCOPES it carries. Called before storing an identity so a bad or expired token fails fast at `auth push` time instead of silently at clone/push time inside an island. The id feeds the canonical noreply commit email (see GitAuthor).

scopes comes from the X-OAuth-Scopes header GitHub returns on this very call — it was always in the response and always discarded. Without it "your token authenticates" was the strongest thing any surface could say, so a token that could clone and push but NOT open a pull request looked identical to a working one until an agent hit the wall: "Resource not accessible by personal access token", naming nothing that could be acted on.