New Mac bootstrap — installs brew+gh, then hands off to private dotfiles machine-bootstrap

new-mac.sh

#!/usr/bin/env bash
# new-mac.sh — PUBLIC bootstrap stub for a brand-new Mac.
#
#   curl -fsSL https://gist.githubusercontent.com/jerrod/6dcf3599587166c6de956de447314761/raw/new-mac.sh | bash
#
# The dotfiles repo is private, so this stub does only the three things that
# can't live there: install Homebrew, install gh, log in to GitHub. It then
# fetches bin/machine-bootstrap from the private repo and hands off — all the
# real setup (dotfiles, secrets, oh-my-zsh, brew bundle, gcloud, containers,
# tailscale) lives THERE, so this stub never needs to change.
set -euo pipefail

GH_REPO="${DOTFILES_GH_REPO:-jerrod/dotfiles}"

say() { printf '\n\033[1m== %s\033[0m\n' "$*"; }

# 1. Homebrew (its installer also installs the Xcode Command Line Tools)
if ! command -v brew >/dev/null 2>&1; then
  for prefix in /opt/homebrew /usr/local; do
    [ -x "$prefix/bin/brew" ] && eval "$("$prefix/bin/brew" shellenv)" && break
  done
fi
if ! command -v brew >/dev/null 2>&1; then
  say "installing Homebrew"
  /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" </dev/tty
  for prefix in /opt/homebrew /usr/local; do
    [ -x "$prefix/bin/brew" ] && eval "$("$prefix/bin/brew" shellenv)" && break
  done
fi
command -v brew >/dev/null 2>&1 || { echo "Homebrew install failed"; exit 1; }

# 2. gh, authenticated
command -v gh >/dev/null 2>&1 || { say "installing gh"; brew install gh; }
if ! gh auth status >/dev/null 2>&1; then
  say "authenticating gh (device code — open the URL on ANY device, enter the code)"
  # BROWSER=echo keeps this headless-safe: instead of launching a local
  # browser, gh prints the device-code URL for you to open elsewhere.
  BROWSER="${BROWSER:-echo}" gh auth login --web --git-protocol https </dev/tty
fi

# 3. hand off to the real bootstrap in the private repo
say "fetching machine-bootstrap from $GH_REPO"
gh api "repos/$GH_REPO/contents/bin/machine-bootstrap" \
  -H "Accept: application/vnd.github.raw" | bash