You then either have to do something monstrous with key storage, or set up an OIDC relationship between GitHub (yes, or GitLab ... permissions they need to talk to one another — which of course ...