github-safe-push

name	github-safe-push
description	Push GitHub remotes without leaking tokens or paths.
version	0.1.0
author	Chad Keith
license	MIT
platforms	["linux","macos","windows"]
metadata	{"hermes":{"tags":["GitHub","git","push","secrets","identity"],"related_skills":["github-auth","github-pr-workflow"]}}

GitHub Safe Push

How Chad Keith's agent pushes. Auth setup lives in github-auth. PR lifecycle lives in github-pr-workflow. This skill is the push itself: identity, leak scan, remote hygiene, then git push.

When to Use

• Any git push, first-time origin, or "publish this repo"
• A repo .env holds GITHUB_TOKEN / GITHUB_USERNAME
• Public docs, READMEs, or examples are about to be committed

Don't use for: creating a PAT, gh auth login, or opening a PR. Load github-auth or github-pr-workflow for those.

Identity (hard rule)

Commits and shipped author fields say Chad Keith. Nothing else.

Field	Value
git user.name	Chad Keith
git user.email	[e-mail]
SKILL.md / plugin.yaml / LICENSE author	Chad Keith

Do not write Hermes Agent, Nous, a machine hostname, or a local username into author fields. Do not put C:\Users\..., /c/Users/..., or %USERPROFILE% into README, .env.example, comments, or commit messages.

Set identity local to the repo unless the user asked for global:

terminal(command="git config user.name \"Chad Keith\" && git config user.email \"[e-mail]\"")

Prerequisites

• git on PATH
• A GitHub remote the account can write
• Token only from repo .env, $HERMES_HOME/.env, or gh auth — never from chat, never echoed

On Windows with git-bash, terminal is MSYS. Pass native C:/Users/<user>/... paths to git -C, not /c/Users/<user>/....

Procedure

1. Confirm the workdir is the intended repo (git rev-parse --show-toplevel). Criterion: one repo, expected name.
2. Set local user.name / user.email to the table above if missing. Criterion: git log -1 --format='%an <%ae>' would show Chad Keith.
3. Scan what will ship:
   • git status + git diff + git ls-files
   • refuse if .env, *.pem, id_rsa, or any file matching a GitHub token regex (ghp_, github_pat_, gho_, ghu_, ghs_) is staged or already tracked
   • refuse if the diff adds a machine-local home path or an author that is not Chad Keith Criterion: scan printed clean or the push did not run.
4. Remote must be a bare HTTPS or SSH URL. No https://user:[e-mail]/.... If origin is missing, add https://github.com/<owner>/<repo>.git from .env GITHUB_USERNAME + GITHUB_REPO (no defaults that bake one person into the script). Criterion: git remote get-url origin has no @ before github.com on HTTPS.
5. Auth for the push:
   • prefer gh if gh auth status works
   • else GIT_ASKPASS that prints username vs token from env, then delete the askpass file
   • never git remote set-url with the token in it Criterion: push succeeded and .git/config still has a clean URL.
6. Redact the token from any captured stdout/stderr before it enters the transcript. Criterion: the reply to the user has no secret.
7. After push, git status -sb and git ls-files | grep -E '\\.env$' (expect not tracked). Criterion: branch tracks origin; .env still untracked.

Public docs standard

READMEs and examples look like any other project:

• Paths: $HERMES_HOME, ~/.hermes, %LOCALAPPDATA%/hermes, /path/to/clone
• Clone: https://github.com/<owner>/<repo>.git or this project's real homepage URL — not a home-directory checkout
• Env examples: empty GITHUB_TOKEN=, GITHUB_USERNAME=your-github-username
• Voice: third person / installer docs. Never "already done if I set it up", "you asked", or a session recap.

Pitfalls

• github-auth's "embed token in the remote URL" option is banned here. It writes the secret into .git/config.
• credential.helper store writes a plaintext token to disk. Prefer askpass for a one-shot push.
• Printing keys from .env is fine. Printing values is not.
• MSYS: git -C /c/Users/<user>/... fails. Use C:/Users/<user>/... for native git.
• Do not commit .env.example that contains a real username unless it is clearly a placeholder.

Verification

• git remote get-url origin is credential-free
• git ls-files does not include .env
• latest commit author is Chad Keith <[e-mail]>
• tracked README has no C:\Users\ or /c/Users/ home path