Maybe: - create a GitHub App or something that can generate transient tokens - implement some CLI that generates a token - login with that token - push See

Maybe: - create a GitHub App or something that can generate transient tokens - implement some CLI that generates a token - login with that token - push See e.g: https://medium.com/@tiwari09abhi/github-app-token-authorization-a-complete-guide-169461f2953f https://medium.com/@tiwari09abhi/github-app-token-authorizat... https://martin.baillie.id/wrote/ephemeral-github-tokens-via-hashicorp-vault/ https://martin.baillie.id/wrote/ephemeral-github-tokens-via-... But I'm not even sure because GH auth system is all over the place and downright nuts in some places... e.g a fine grained token with repo access can't curl a tarball with the usual URL, it has to use the /api which makes tooling that constructs URLs from repo names and versions break with no recourse as soon as you disable classic PATs