techlist.io
KREN
github

GitHub for Beginners: Answers to some common questions (opens in new tab)

githubgitversion-controlsshpersonal-access-tokensmerge-rebase

The post is a beginner-friendly guide to common GitHub questions, focusing on SSH authentication and Personal Access Tokens (PATs). It explains how to securely connect a computer to GitHub, create credentials for command-line and API access, and limit those credentials appropriately. The provided excerpt ends just as it introduces merging versus rebasing.

SSH Keys and GitHub Authentication

  • An SSH key consists of:
    • A private key that stays on the computer and must never be shared.
    • A public key uploaded to GitHub.
  • Git uses the matching key pair to verify identity when pushing and pulling code.
  • To create an Ed25519 key pair, run ssh-keygen with the email associated with the GitHub account.
  • Users can accept the default file location and protect the key with a passphrase.
  • ssh-agent securely stores the key so the passphrase does not need to be entered repeatedly.
  • The public key can be copied with cat ~/.ssh/id_ed25519.pub and added through Settings → SSH and GPG keys → New SSH key.
  • A descriptive title, such as “work-laptop,” helps identify the device later.

Personal Access Tokens

  • A PAT is a GitHub-managed credential for authenticating command-line tools and API requests.
  • Tokens can be revoked and configured with limited permissions.
  • GitHub offers:
    • Fine-grained tokens, which can be restricted to specific repositories and individual read or write permissions.
    • Classic tokens, which use broader predefined scopes.
  • When creating a fine-grained token, users choose:
    • A name and description.
    • An expiration date.
    • Repository access.
    • Specific permissions and whether each is read-only or read/write.
  • Classic tokens are created through Developer settings → Personal access tokens → Tokens (classic) and use scopes to define access.
  • GitHub displays a token only once, so it should be copied immediately and stored securely, such as in a password manager.
  • A PAT can be supplied instead of a password when Git prompts for credentials in a terminal.

Merging and Rebasing

  • The excerpt begins introducing the difference between merging and rebasing and how to resolve merge-related problems.
  • The supplied content ends before that explanation is provided.

Use SSH keys for secure Git operations from a trusted device, and use narrowly scoped, expiring PATs when tools or APIs require token-based authentication. Never share private keys or tokens, and store credentials securely.