Skip to main content
--repository clones without credentials, so it only works with public repositories. For a private one, leave it out and clone the repository yourself in the run’s setup script, with a token passed as an environment variable.
1

Create a token on GitHub

In GitHub, open Settings → Developer settings → Personal access tokens → Fine-grained tokens → Generate new token:
  • Repository access: only the repository the agent works on.
  • Permissions → Contents: Read-only. Pick Read and write only if the agent should push a branch.
  • Expiration: as short as you can.
Copy the token, which starts with github_pat_.
2

Write the setup script

setup.sh
Without a repository, the setup script starts in the empty directory the agent works in, so the clone lands there. The [ -d .git ] check skips the clone if the script runs a second time, which can happen after a restart on our side. A setup script that exits with an error fails the run, with failure_kind setup_failed.
3

Start the run

--env GITHUB_TOKEN, without a value, passes the token from your shell, so it never appears on the command line. --env NAME=value sets a value directly.

​
What happens to the token

  • Tracks never returns it. tracks runs get lists the run’s variable names, never their values.
  • The setup script is returned as you wrote it. Keep the token in a variable, never in the script or the prompt.
  • The agent can read it. Variables are set in every process of the agent, and the clone keeps the token in the repository’s remote URL. Give it only the access you’d give the agent.
An agent with a read-and-write token can push to the repository. Use a read-only token unless you ask it to push.

​
In an experiment

Repositories in the library must be public too. For a private one, pick no repository in the experiment’s variants, and put the same script in its run settings: the setup script and a GITHUB_TOKEN variable.
An experiment stores its variables’ values with it, and shows them to your organization’s members in the web app and in tracks experiments get. Use a token made for this experiment only.

​
Other Git hosts

The same works with any host that accepts a token in the clone URL: replace the URL in the setup script with your host’s.