# Connect GitHub

> Keep GitHub tokens away from AI agents with a repository connection. Let an authorized Computer clone, fetch and push without receiving the token.

Keep GitHub tokens away from AI agents by connecting one repository to one
Computer. When your Fungi host has GitHub Connections configured, an Agent using
that Computer can clone and fetch the repository. Push also needs write access
from the GitHub App and must pass GitHub's branch rules. Private repositories
work when the App installation includes them.

Your GitHub credential never goes into the Computer. Fungi holds it and uses it
only when the Computer asks GitHub for that repository. There is no token to
paste into the Computer or credential helper to configure yourself.

1. In your Team, open **System Settings → Connectors → GitHub**.

2. Under **GitHub**, pick the **Computer** that should get the repository. An
   Agent can be created without a Computer. New Computers get a generated name,
   so if you have several, pick one attached to the Agent you'll ask.

3. Type the **Repository** as `owner/name`, for example `octocat/hello-world`.

4. Choose **Connect GitHub**. A GitHub window opens. Install or authorize the
   Fungi GitHub App there and give it access to that repository. Come back to
   Fungi and wait for **Connected repositories** to show the repository. If the
   window closes before you finish, choose **Resume** for the pending
   connection.

<Screen
  src="/screens/github-connection.png"
  alt="GitHub in System Settings, with one connected repository."
  caption="A connected repository shows up under Connected repositories."
/>

## Ask the Agent to use it

Talk to an Agent attached to that Computer. This prompt is illustrative: replace
the public example repository with one included in your GitHub App installation,
and ask for a push only if that installation has write access.

```text
Clone https://github.com/octocat/hello-world, fix the typo in the README,
commit it on a new branch and push the branch.
```

Use the `https://github.com/...` address. SSH addresses like
`git@github.com:...` don't work from a Computer.

## What the connection allows

- Git transport for that repository on the selected Computer. It does not grant
  general GitHub API access or access to other private repositories.
- `git push` only when the GitHub App can write to the repository and the
  destination branch permits it.

GitHub still has the final say on every push. The App is limited by its
installation's repository selection and permissions. Branch protection still
applies.

If a push is refused, `git` tells you why:

| Message                              | What to do                                                                            |
| ------------------------------------ | ------------------------------------------------------------------------------------- |
| `no GitHub connection that can push` | Connect the repository to this Computer, and check the App can write to it on GitHub. |
| `not installed on this repository`   | Add the repository to the Fungi GitHub App's repository selection on GitHub.          |
| `protected branch hook declined`     | Push to another branch, then open a pull request on GitHub.                           |
| `GitHub rate-limited this push`      | Wait a minute and push again.                                                         |

To remove access, choose **Disconnect** next to the repository and confirm. If
**GitHub not configured** appears, this host cannot start a GitHub Connection;
ask its operator to configure the integration. If Connections is temporarily
unavailable, use **Retry** rather than assuming authorization succeeded.
Disconnect prevents new authorized Git operations, but a request already
admitted can finish.

## GitHub sign-in and connected logins

Using **Continue with GitHub** to sign in to Fungi does not give a Team access
to your repositories. The Team connection above is a separate authorization.
Likewise, **Account → Connected logins** manages Apps such as Fungi Local that
access your Fungi account; it does not disconnect this GitHub repository
connection. Manage repository access from the Team's **System Settings →
Connectors → GitHub** section.

**Next:** [Give your Agent a task](/guides/work-with-agents/).