Github

A server that needs to pull the latest code from several GitHub repos on its own, with no one around to type a password, is a bad place to keep a Personal Access Token. A PAT is scoped to the whole account (or needs fine-grained setup anyway), the leak risk is higher, and rotating it is a hassle. A deploy key fits better: it’s read-only, scoped to a single repo, and dies with the repo if removed, so the blast radius of a compromised server stays small. ...

While authenticating gh in WSL, running gh auth login opened the browser within WSL for device authorization. The device code was accepted, but the callback never returned to the CLI - the handshake hung indefinitely. Using a Personal Access Token (PAT) with --with-token sidesteps the browser flow entirely. Go to https://github.com/settings/tokens/new and generate a token. Choose an expiry that suits your needs (90 days is a reasonable default) and select the scopes you need. For general gh usage: ...

We work in an environment where we have multiple GitHub accounts that is tied to different repositories. It took us a while to figure out how to properly set this up, so that the correct identify is tied to the correct repository. Let me walk you through an example on how we did it. Assuming that you have 3 identity, ie. 3 private keys, tied to 3 different GitHub repository. ...