Limited Github repo access

limited_gh_access.md

Limited Github repo access

Option 1: SSH key + separate accounts

Create seperate accounts on Github, for example one personal account and on account for work

Pros:

• easy to setup
• SSH keys are not exposed when using SSH forwarding with a devcontainer

Cons:

• requires to setup 2 SSH keys locally
• no segregation within one key access

Option 2: Deploy key per repo

Add one SSH key per repo as a Deploy Key (keys cannot be reused so they all need to be different).

How to:

1. ssh-keygen -t ed25519 -f ~/.ssh/github-ORG-REPONAME -C "Deploy key for ORG REPONAME"
2. cat ~/.ssh/github-REPONAME.pub | pbcopy
3. go to https://github.com/ORG/REPONAME/settings/keys and create a key
4. setup the keys in .ssh/config with:

Host github-ORG-REPONAME
    HostName github.com
    User git
    IdentityFile ~/.ssh/github-ORG-REPONAME
    IdentitiesOnly yes
    AddKeysToAgent yes

5. clone with `git clone git@github-ORG-REPONAME:ORG/REPONAME.git

Pros:

• segregation per repo
• SSH keys are not exposed when using SSH forwarding with a devcontainer

Cons:

• hassle to setup (multiple keys on Github and locally)
• could not get it to work with devcontainers

Option 3: Personal Access Token (PAT)

Create a PAT for right repos and with the right level of granularity

How to:

Configure git:

git config --global credential.https://git.521000.best.useHttpPath true # save credential per repo url
git config --global credential.helper osxkeychain # for sourcetree on macOS

Create a personal access token:

1. go to https://github.com/settings/personal-access-tokens/new
2. change Resource owner if repos are owned by another org
3. select repos
4. select permissions "content" + read and write

Clone the code:

1. git clone https://...
2. enter username: github username
3. enter password: the personal access token

In devcontainer, check it is using the personal access token:

# What helper is configured?
git config --show-origin --show-scope --get-all credential.helper
# HTTPS credential path
printf "protocol=https\nhost=github.com\n\n" | git credential fill

Pros:

• fine-grain access per repo and per action
• confirmed working with devcontainers

Cons:

• PAT is exposed in the devcontainer, so could be stolen