Dotfiles bootstrap entrypoint for a fresh Mac

install.sh

#!/bin/bash
# Dotfiles bootstrap entrypoint — designed to be hosted on a public Gist:
#   curl -fsSL https://gist.githubusercontent.com/kimizuy/b5c1a148b44f3ca52b6791c8f5b99079/raw/install.sh | bash
# The repository is private, so we authenticate with gh before cloning.

set -euo pipefail

REPO="kimizuy/dotfiles"
REPO_URL="https://github.com/${REPO}.git"
DOTFILES_DIR="$HOME/ghq/github.com/kimizuy/dotfiles"

# ---------- 1. Xcode Command Line Tools ----------
if ! xcode-select -p &>/dev/null; then
  echo "Installing Xcode Command Line Tools..."
  xcode-select --install

  echo "Waiting for Xcode CLT installation to complete..."
  until xcode-select -p &>/dev/null; do
    sleep 5
  done
  echo "Xcode CLT installed."
else
  echo "Xcode CLT already installed."
fi

# ---------- 2. Install Homebrew ----------
if ! command -v brew &>/dev/null; then
  echo "Installing Homebrew..."
  NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
  eval "$(/opt/homebrew/bin/brew shellenv)"
  echo "Homebrew installed."
else
  echo "Homebrew already installed."
fi

# ---------- 3. Authenticate with GitHub ----------
if ! command -v gh &>/dev/null; then
  echo "Installing GitHub CLI..."
  # Bootstrap-only: this brew-installed gh is removed by `cleanup = "uninstall"`
  # during the later darwin-rebuild because gh is not in homebrew.brews.
  # The Nix-managed gh (nix/modules/home/packages.nix) takes over and keeps the
  # same auth (stored in the macOS keyring).
  brew install gh
fi

if ! gh auth status &>/dev/null; then
  echo "Authenticating with GitHub (browser will open)..."
  # admin:public_key is required later by `gh ssh-key add` in bootstrap.sh.
  gh auth login --hostname github.com --web --git-protocol https --scopes admin:public_key
fi

# ---------- 4. Clone (or update) dotfiles ----------
mkdir -p "$(dirname "$DOTFILES_DIR")"

if [ -d "$DOTFILES_DIR/.git" ]; then
  echo "Dotfiles already cloned. Pulling latest changes..."
  # Ensure remote is HTTPS (a previous run may have switched it to SSH)
  git -C "$DOTFILES_DIR" remote set-url origin "$REPO_URL"
  # Use gh credential helper directly to avoid global config issues.
  # First -c credential.helper= clears any inherited helpers (global/system),
  # then the second -c sets gh as the sole credential provider.
  git -C "$DOTFILES_DIR" \
    -c credential.helper= \
    -c credential.helper='!gh auth git-credential' \
    pull
else
  echo "Cloning dotfiles..."
  gh repo clone "$REPO" "$DOTFILES_DIR"
fi

# ---------- 5. Hand off to bootstrap.sh ----------
exec bash "$DOTFILES_DIR/setup/bootstrap.sh"