{
  config,
  lib,
  pkgs,
  ...
}: {
  imports = [../../../agenix/age/identityPaths];

  options.dotfiles.inputs.home-manager.programs.gh.enable =
    lib.dotfiles.mkEnableOption;

  config = lib.mkIf config.dotfiles.inputs.home-manager.programs.gh.enable {
    age.secrets.modulesHomeManagerProgramsGhGhToken.file = ./gh_token.age;
    dotfiles.inputs.agenix.age.identityPaths.enable = true;

    home.sessionVariables.GH_TOKEN = let
      file = config.age.secrets.modulesHomeManagerProgramsGhGhToken.path;
    in ''$(${lib.getExe' pkgs.coreutils "cat"} "${file}")'';

    # Prevent configuration drift by avoiding the creation of the undeclared
    # file.
    xdg.configFile."gh/hosts.yml".source = pkgs.emptyFile;

    programs.gh = {
      enable = true;
      settings.git_protocol = "ssh";
    };
  };
}
