GitHub least-privilege shipping
- Use repo-scoped SSH deploy keys for
git push. - Use fine-grained PATs for PR operations only.
- Load repo-specific
GH_TOKENwith direnv. - Prefer PR-first with branch protections enabled.
Copyable patterns for real operator workflows.
git push.GH_TOKEN with direnv.