GitHub Credentials Guide
Bootstrap guide for giving the platform automation scripts full access to all 13 managed GitHub orgs. Follows a god-mode-then-scope-down pattern: create one all-powerful PAT, use it to seed org secrets, then replace it with narrow per-org PATs and revoke the god-mode token.
Script that uses this: scripts/identity/Invoke-GitHubSecretsDistribution.ps1
Script that follows this: scripts/onboarding/Invoke-RepoClaudeSetup.ps1 (needs ORG_PAT seeded first)
See also: GitLab Credentials Guide — same pattern for GitLab
Prerequisites
- Azure CLI logged in as
kris@hybridsolutions.cloudwith access tokv-hcs-vault-01 ghCLI installed (winget install GitHub.cli)- Environment loaded:
. D:\git\platform\scripts\Load-HCSEnvironment.ps1
Phase 1 — God-mode bootstrap
Step 1 — Create the god-mode Classic PAT
Where: github.com → Settings → Developer settings → Personal access tokens → Tokens (classic)
Account: kristopherjturner — the account that is an owner or admin of all 13 managed orgs
Token name: hcs-platform-godmode-<YYYY-MM-DD> (include the expiry date in the name as a reminder)
Expiration: 90 days — set an explicit date, never use no-expiration
Scopes — select ALL of the following:
| Scope | Why |
|---|---|
repo (full) | Read/write all repos, commit statuses, deployments |
workflow | Create and update GitHub Actions workflows |
write:packages + read:packages + delete:packages | GitHub Packages |
admin:org (all sub-scopes) | Manage org settings, members, webhooks, org-level secrets |
admin:public_key (all sub-scopes) | Manage SSH keys |
admin:repo_hook (all sub-scopes) | Manage repo webhooks |
admin:org_hook | Manage org-level webhooks |
notifications | Read notifications |
user (full) | Read/write profile |
delete_repo | Delete repositories (needed for idempotent repo setup) |
write:discussion + read:discussion | GitHub Discussions |
admin:gpg_key (all sub-scopes) | GPG key management |
admin:ssh_signing_key (all sub-scopes) | SSH signing keys |
Do not use fine-grained PATs for the god-mode token. Fine-grained PATs cannot manage org-level secrets or org webhooks across multiple orgs with a single token.
Step 2 — Store in Key Vault immediately
The token value is only shown once. Paste it before navigating away.
az keyvault secret set `
--vault-name kv-hcs-vault-01 `
--name hcs-platform-github-kjt-godmode-pat `
--value '<paste-token-here>'Add a row to docs/identity/secret-inventory.md:
| Secret name | Vault | Purpose | Rotation | Notes |
|---|---|---|---|---|
hcs-platform-github-kjt-godmode-pat | kv-hcs-vault-01 | God-mode Classic PAT — all scopes — bootstrap only | Revoke after Phase 2 | Temporary |
Step 3 — Load into your session
# Load standard environment first (az, ADO PAT, etc.)
. D:\git\platform\scripts\Load-HCSEnvironment.ps1
# Override GITHUB_TOKEN with the god-mode PAT for bootstrap work
$env:GITHUB_TOKEN = az keyvault secret show `
--vault-name kv-hcs-vault-01 `
--name hcs-platform-github-kjt-godmode-pat `
--query value --output tsv
# Authenticate the gh CLI
$env:GITHUB_TOKEN | gh auth login --with-token
gh auth statusStep 4 — Seed org-level Actions secrets (all 13 orgs)
# Preview first
pwsh D:\git\platform\scripts\identity\Invoke-GitHubSecretsDistribution.ps1 -DryRun
# Review log output, then run live
pwsh D:\git\platform\scripts\identity\Invoke-GitHubSecretsDistribution.ps1What the script seeds:
| GitHub secret name | Source KV secret | Orgs targeted |
|---|---|---|
ORG_PAT | hcs-platform-github-kjt-godmode-pat (fallback until per-org PATs exist) | All 13 orgs |
AZURE_SUBSCRIPTION_ID | hcs-platform-azure-sub-id | AzureLocal, thisismydemo |
ANTHROPIC_API_KEY | hcs-platform-anthropic-api-key | AzureLocal, thisismydemo |
All secrets are set with --visibility all (every repo in the org can read them).
Phase 2 — Per-org scoped PATs (AB#22)
Create these after the god-mode bootstrap is confirmed working. Each is a Classic PAT on the kristopherjturner account, scoped only to repo + workflow + read:org — no admin or org-management scopes.
Expiration: 365 days with calendar reminder to rotate.
| GitHub org | KV secret name (→ kv-hcs-vault-01) | Scopes |
|---|---|---|
| AzureLocal | hcs-platform-github-azurelocal-pat | repo, workflow, read:org |
| thisismydemo | hcs-platform-github-thisismydemo-pat | repo, workflow, read:org |
| holdfast-press | hcs-platform-github-holdfast-press-pat | repo, workflow |
| turnerlegacy | hcs-platform-github-turnerlegacy-pat | repo, workflow, read:org |
| faithfulcraftsmen | hcs-platform-github-faithfulcraftsmen-pat | repo, workflow |
| gunnerthelab | hcs-platform-github-gunnerthelab-pat | repo, workflow |
| Heritage-Virginia | hcs-platform-github-heritage-virginia-pat | repo, workflow |
| Hybrid-Solutions-Cloud | hcs-platform-github-hybrid-solutions-cloud-pat | repo, workflow |
| hybridsolutionscloud | hcs-platform-github-hybridsolutionscloud-pat | repo, workflow |
| ifartedcloud | hcs-platform-github-ifartedcloud-pat | repo, workflow |
| project42dev | hcs-platform-github-project42dev-pat | repo, workflow |
| sunpath-dev | hcs-platform-github-sunpath-dev-pat | repo, workflow |
For each token, store it immediately:
az keyvault secret set `
--vault-name kv-hcs-vault-01 `
--name hcs-platform-github-<org>-pat `
--value '<paste-token>'Add each to docs/identity/secret-inventory.md and tick the corresponding row in Table B of docs/onboarding/tracker.md.
Re-seed org secrets with scoped PATs
Once all 13 per-org PATs are in KV, re-run the distribution script. It will automatically use each org's own PAT instead of the god-mode fallback:
pwsh D:\git\platform\scripts\identity\Invoke-GitHubSecretsDistribution.ps1 -DryRun
pwsh D:\git\platform\scripts\identity\Invoke-GitHubSecretsDistribution.ps1Phase 3 — Revoke the god-mode PAT
Only do this after all 13 per-org PATs are confirmed in KV and ORG_PAT has been re-seeded from them.
- GitHub → Settings → Developer settings → Tokens (classic) → find
hcs-platform-godmode-*→ Delete - Remove from KV:powershell
az keyvault secret delete --vault-name kv-hcs-vault-01 --name hcs-platform-github-kjt-godmode-pat - Update
secret-inventory.md— mark the row as revoked/deleted with the date.
Phase 4 — Configure all repos (AB#15)
With ORG_PAT seeded in every org, configure all repos with Claude Code settings:
# Preview — classify repos and show what would be written
pwsh D:\git\platform\scripts\onboarding\Invoke-RepoClaudeSetup.ps1 -DryRun
# Run org by org to review before committing broadly
pwsh D:\git\platform\scripts\onboarding\Invoke-RepoClaudeSetup.ps1 -OrgFilter AzureLocal -DryRun
pwsh D:\git\platform\scripts\onboarding\Invoke-RepoClaudeSetup.ps1 -OrgFilter AzureLocal
# Then the remaining orgs
pwsh D:\git\platform\scripts\onboarding\Invoke-RepoClaudeSetup.ps1Track per-repo completion in Table D of docs/onboarding/tracker.md.