$npx -y skills add adityahimaone/hermes-agent-rtk-caveman --skill github-authSet up GitHub authentication for the agent using git (universally available) or the gh CLI. Covers HTTPS tokens, SSH keys, credential helpers, and gh auth — with a detection flow to pick the right method automatically.
| 1 | # GitHub Authentication Setup |
| 2 | |
| 3 | This skill sets up authentication so the agent can work with GitHub repositories, PRs, issues, and CI. It covers two paths: |
| 4 | |
| 5 | - **`git` (always available)** — uses HTTPS personal access tokens or SSH keys |
| 6 | - **`gh` CLI (if installed)** — richer GitHub API access with a simpler auth flow |
| 7 | |
| 8 | ## Detection Flow |
| 9 | |
| 10 | When a user asks you to work with GitHub, run this check first: |
| 11 | |
| 12 | ```bash |
| 13 | # Check what's available |
| 14 | git --version |
| 15 | gh --version 2>/dev/null || echo "gh not installed" |
| 16 | |
| 17 | # Check if already authenticated |
| 18 | gh auth status 2>/dev/null || echo "gh not authenticated" |
| 19 | git config --global credential.helper 2>/dev/null || echo "no git credential helper" |
| 20 | ``` |
| 21 | |
| 22 | **Decision tree:** |
| 23 | 1. If `gh auth status` shows authenticated → you're good, use `gh` for everything |
| 24 | 2. If `gh` is installed but not authenticated → use "gh auth" method below |
| 25 | 3. If `gh` is not installed → use "git-only" method below (no sudo needed) |
| 26 | |
| 27 | --- |
| 28 | |
| 29 | ## Method 1: Git-Only Authentication (No gh, No sudo) |
| 30 | |
| 31 | This works on any machine with `git` installed. No root access needed. |
| 32 | |
| 33 | ### Option A: HTTPS with Personal Access Token (Recommended) |
| 34 | |
| 35 | This is the most portable method — works everywhere, no SSH config needed. |
| 36 | |
| 37 | **Step 1: Create a personal access token** |
| 38 | |
| 39 | Tell the user to go to: **https://github.com/settings/tokens** |
| 40 | |
| 41 | - Click "Generate new token (classic)" |
| 42 | - Give it a name like "hermes-agent" |
| 43 | - Select scopes: |
| 44 | - `repo` (full repository access — read, write, push, PRs) |
| 45 | - `workflow` (trigger and manage GitHub Actions) |
| 46 | - `read:org` (if working with organization repos) |
| 47 | - Set expiration (90 days is a good default) |
| 48 | - Copy the token — it won't be shown again |
| 49 | |
| 50 | **Step 2: Configure git to store the token** |
| 51 | |
| 52 | ```bash |
| 53 | # Set up the credential helper to cache credentials |
| 54 | # "store" saves to ~/.git-credentials in plaintext (simple, persistent) |
| 55 | git config --global credential.helper store |
| 56 | |
| 57 | # Now do a test operation that triggers auth — git will prompt for credentials |
| 58 | # Username: <their-github-username> |
| 59 | # Password: <paste the personal access token, NOT their GitHub password> |
| 60 | git ls-remote https://github.com/<their-username>/<any-repo>.git |
| 61 | ``` |
| 62 | |
| 63 | After entering credentials once, they're saved and reused for all future operations. |
| 64 | |
| 65 | **Alternative: cache helper (credentials expire from memory)** |
| 66 | |
| 67 | ```bash |
| 68 | # Cache in memory for 8 hours (28800 seconds) instead of saving to disk |
| 69 | git config --global credential.helper 'cache --timeout=28800' |
| 70 | ``` |
| 71 | |
| 72 | **Alternative: set the token directly in the remote URL (per-repo)** |
| 73 | |
| 74 | ```bash |
| 75 | # Embed token in the remote URL (avoids credential prompts entirely) |
| 76 | git remote set-url origin https://<username>:<token>@github.com/<owner>/<repo>.git |
| 77 | ``` |
| 78 | |
| 79 | **Step 3: Configure git identity** |
| 80 | |
| 81 | ```bash |
| 82 | # Required for commits — set name and email |
| 83 | git config --global user.name "Their Name" |
| 84 | git config --global user.email "their-email@example.com" |
| 85 | ``` |
| 86 | |
| 87 | **Step 4: Verify** |
| 88 | |
| 89 | ```bash |
| 90 | # Test push access (this should work without any prompts now) |
| 91 | git ls-remote https://github.com/<their-username>/<any-repo>.git |
| 92 | |
| 93 | # Verify identity |
| 94 | git config --global user.name |
| 95 | git config --global user.email |
| 96 | ``` |
| 97 | |
| 98 | ### Option B: SSH Key Authentication |
| 99 | |
| 100 | Good for users who prefer SSH or already have keys set up. |
| 101 | |
| 102 | **Step 1: Check for existing SSH keys** |
| 103 | |
| 104 | ```bash |
| 105 | ls -la ~/.ssh/id_*.pub 2>/dev/null || echo "No SSH keys found" |
| 106 | ``` |
| 107 | |
| 108 | **Step 2: Generate a key if needed** |
| 109 | |
| 110 | ```bash |
| 111 | # Generate an ed25519 key (modern, secure, fast) |
| 112 | ssh-keygen -t ed25519 -C "their-email@example.com" -f ~/.ssh/id_ed25519 -N "" |
| 113 | |
| 114 | # Display the public key for them to add to GitHub |
| 115 | cat ~/.ssh/id_ed25519.pub |
| 116 | ``` |
| 117 | |
| 118 | Tell the user to add the public key at: **https://github.com/settings/keys** |
| 119 | - Click "New SSH key" |
| 120 | - Paste the public key content |
| 121 | - Give it a title like "hermes-agent-<machine-name>" |
| 122 | |
| 123 | **Step 3: Test the connection** |
| 124 | |
| 125 | ```bash |
| 126 | ssh -T git@github.com |
| 127 | # Expected: "Hi <username>! You've successfully authenticated..." |
| 128 | ``` |
| 129 | |
| 130 | **Step 4: Configure git to use SSH for GitHub** |
| 131 | |
| 132 | ```bash |
| 133 | # Rewrite HTTPS GitHub URLs to SSH automatically |
| 134 | git config --global url."git@github.com:".insteadOf "https://github.com/" |
| 135 | ``` |
| 136 | |
| 137 | **Step 5: Configure git identity** |
| 138 | |
| 139 | ```bash |
| 140 | git config --global user.name "Their Name" |
| 141 | git config --global user.email "their-email@example.com" |
| 142 | ``` |
| 143 | |
| 144 | --- |
| 145 | |
| 146 | ## Method 2: gh CLI Authentication |
| 147 | |
| 148 | If `gh` is installed, it handles both API access and git credentials in one step. |
| 149 | |
| 150 | ### Interactive Browser Login (Desktop) |
| 151 | |
| 152 | ```bash |
| 153 | gh auth login |
| 154 | # Select: GitHub.com |
| 155 | # Select: HTTPS |
| 156 | # Authenticate via browser |
| 157 | ``` |
| 158 | |
| 159 | ### Token-Based Login (Headl |