Two githubs, one laptop

I have for some time been plagued by an annoyance in the git configuration on my various computers: I am but one woman, but I have multiple github accounts. There are reasons for this, of course. For the purposes of my personal projects and my open source work, I am djnavarro on github. In that capacity, the djnavarro identity has access to various private repositories, and am authorised to push to various repositories that I don’t own. However, in my work life I am also certara-dnavarro, and the certara-dnavarro professional identity has access to private repositories that (for entirely sensible reasons) are not accessible to djnavarro. It’s a fairly strict separation of roles, but working in a highly regulated industry I’ve come to appreciate this level of caution, and I enforce it on my end too: I don’t grant certara-dnavarro access to private repositories owned by djnavarro. The former is a work account, and there is no reason it should have access to private repositories that I create in my capacity as a private citizen and are unrelated to the terms of my employment. Neither I nor my employer want that! For the most part, these two identities are cleanly separated: on my work laptop I authenticate via a github PAT associated with certara-dnavarro, and on my personal laptop I authenticate via a github PAT for djnavarro. The separation works nicely, and we are all very happy with this arrangement.

Mostly.

However, because life is complicated there are edge cases. For example, I might be asked in my professional role (and therefore on my work laptop) to make contributions to an open source project, and because that project is open source and non-proprietary, the maintainers of the project would often prefer to grant permissions to me via the djnavarro account rather than the certara-dnavarro account. A scenario like this one sits in the messy grey zone where it is neither possible nor desirable to enforce a Severance like separation between work life and personal life. Sometimes the professional is personal, and the personal is professional also. Accordingly, I find myself in a situation where I need my git configuration to support two different github accounts on the same machine.

“Dual essence”, by RyMishRy

Defining my problem

The first part of solving any problem is being precise about the nature of the problem to be solved. In this case it’s important because I want to think about the following issues:

• The configuration on my work laptop should reflect the needs of my work life; the configuration on my personal laptop should not.
• There is a difference between git and github: some aspects to the configuration need to be specific to github, other aspects will hold generally for git.
• In the same sense that my github-for-work-purposes is different to my github-for-personal-purposes, my work email is different to my personal email. My git commits on a work project should be tied to my work email, and commits on a personal project should be tied to my personal email.

Taking these considerations into account, what I really want is something like this:

• There should be an appropriate default. By default, everything git-related that happens on my work laptop should be configured to use my work github account and my work email. Only in special cases should this be altered.
• There should be a clear indicator that the default has been overridden. It should be obvious just by looking at my file system at work when a repo is tied to djnavarro rather than certara-dnavarro. Nobody (most importantly me) should ever be uncertain about which identity is used. To that end, only those repositories that exist within a “special” folder on my work laptop should be allowed to use the djnavarro github identity. This matters because of the critical importance of managing commercial-in-confidence data: if I am working in a repo that uses the djnavarro identity, confidential data cannot be referenced, and I need a very clear marker of where that boundary sits. On my work machine, the djnavarro github identity is strictly constrained: my work machine is allowed to know the bare minimum about that github account that is required for me to work on open source projects that are tied to my employment. Nothing more than that is allowed: again, this serves the interests of both myself and my employer. Separation of powers is a key principle in professional life just as much as it is critical in law.

Solving my problem

The solution I adopted looks like this. I have two .gitconfig files on my machine, one located in the usual location (i.e., ~/.gitconfig) that defines my default configuration, and another located in a specific folder for which I want a different configuration to apply (i.e., ~/github/djnavarro). The “default” configuration looks something like this:

[user]
  name = Danielle Navarro
  email = my.work.email@organisation.com
[core]
  excludesFile = ~/.gitignore
[init]
  defaultBranch = main
[credential "https://github.com"]
  useHttpPath = true
  username = certara-dnavarro
[includeIf "gitdir:~/github/djnavarro/"]
  path = ~/github/djnavarro/.gitconfig

When I execute any git command, this is the file that git will look at for my configuration settings. There are two key features in this file, solving two different aspects to the problem:

• The first thing it does is set useHttpPath = true for my github credentials. What this means is that when git supplies my credentials to github via my credential manager, it does so on a “per-repository” basis. The first time I attempt to push to github, I am prompted to login to github and must supply the relevant PAT (i.e., I use a token associated with djnavarro for some repositories, and a token associated with certara-dnavarro for others). Fortunately, I have login details and PATs for both accounts stored in my password manager, so this is not an onerous task. Importantly, I only have do to this once for each repository.

• The second thing it does is add the includeIf field. If I am invoking git from ~/github/djnavarro or any of its subdirectories, the additional settings from ~/github/djnavarro/.gitconfig will be appended. This solves a different aspect to the problem. Notice that according to my “default” .gitconfig file, my git commits are linked to my work email address. That’s a “git thing” and not a “github thing”. By using the includeIf field, I am able to override this for any repository that lives within the special folder.

Noting this, the settings in my “special” git configuration file look something like this:

[user]
  name = Danielle Navarro
  email = my.personal.email@provider.org
[credential "https://github.com"]
  useHttpPath = true
  username = djnavarro

These settings override those in the default git configuration. For repositories that live within the special directory, git knows to use my personal email address and my personal github account.

To my surprise this setup worked exactly as I hoped, without the usual horrors I encounter when trying to customise anything about git. It’s a minor inconvenience needing to reauthenticate with github for each new repository, but since it’s a one-off thing for each repo I’m not too fussed. The only real downside I’ve found so far is that this configuration seems to confuse the usethis::git_sitrep() function in R, but everything else works really smoothly.

Neat.

“Dual faces”, by RyMishRy

References

Resources I looked up while solving this problem:

• This github help page covers much of what I needed to know
• This stack overflow thread talks a lot about the specific issues involved in this problem
• More generally, this gist and the associated comment thread has a really comprehensive overview of the settings that can be customised via .gitignore