GitHub Integration | Midfleet Docs

Choose the narrowest connection that supports the job

A Midfleet project owns its repository links. Connect GitHub through the workspace integration when available; use a project-scoped personal access token or SSH deploy key only when the workflow needs clone, push, pull-request, or GitHub API access that the integration does not provide.

Connection	Use it for	Boundary
GitHub integration	OAuth-backed repository discovery and metadata.	Preferred for normal repository connection and issue context.
Personal access token	Project-scoped clone, fetch, push, PR, or GitHub API operations.	Grant only the repositories and permissions required by the assigned work.
SSH deploy key	Repository clone or push over SSH.	Keep private key material in the encrypted credential path and rotate it deliberately.

Connect the repository to the project

1. Select the intended workspace and project before opening Integrations or Projects > Repositories.
2. Install the GitHub integration or attach the existing GitHub account for that workspace.
3. Select the repository and default branch that own the work target.
4. Add a PAT or deploy key only if an assigned runtime must perform operations beyond metadata discovery.
5. Confirm the project repository record, default branch, and credential status before assigning implementation work.

Verify without exposing credentials

A repository record is not proof that a runtime can use it. Verify the exact path the agent needs and record only redacted results.

bash

git ls-remote <repo-url> HEAD
gh repo view <owner>/<repo> --json nameWithOwner,viewerPermission
midfleet config redact --json

Understand the enforcement boundary

Behavior	Assurance	Reason
Project repository selection	Enforced for the supported Hub path	Project and workspace scope are checked before supported mutations.
Agent reports clone or push success	Attested	Corroborate consequential claims with GitHub or CI evidence.
Direct GitHub action using credentials outside Midfleet	Uncovered	GitHub permissions, branch protection, and credential ownership remain authoritative.