# GitHub

> Connect GitHub, clone private repositories, publish a project, and how Codevre keeps your GitHub token out of your code.

Last updated: October 17, 2026
Source: https://codevre.com/docs/ide/github

## Connect GitHub

You need a Codevre account. Then use any of these:

- the GitHub button or **⋯ ▸ Connect GitHub** in Source Control
- `gh auth login` (or `vre gh auth login`) in the terminal

A new tab opens to authorize Codevre on GitHub. When you're done, the IDE shows **GitHub connected as @yourname** and restarts the runtime, so terminals start fresh with Git access.

Check the connection with `gh auth status`:

```
✓ Logged in to github.com via Codevre
```

To disconnect, use the same button, **Disconnect GitHub**, or `gh auth logout`. The runtime restarts again, which drops the credential immediately.

The `gh` command in Codevre only supports `gh auth login`, `gh auth status` and `gh auth logout`. Other `gh` subcommands aren't available.

## What needs GitHub connected

| Works without connecting | Needs GitHub connected |
|---|---|
| `git init`, add, commit, branch, log, diff | `git push`, `git pull`, `git fetch` |
| Cloning public repositories | Cloning private repositories |
| | Publish to GitHub |

## Publish a project

In Source Control, click **Publish to GitHub**:

1. Enter a repository name (letters, numbers, `-` and `_`).
2. Choose **private** or **public**. Dismissing the menu cancels, so nothing becomes public by accident.

Codevre then:

1. Initializes Git and makes an "Initial commit", if needed.
2. Creates the repository on GitHub, with the description "Created with Codevre".
3. Renames your branch to match GitHub's default branch, adds the `origin` remote, and pushes.

## How your token is used

Your GitHub OAuth token is stored server-side with your Codevre account. Codevre treats authenticated Git as **a capability of the IDE, not something your project can read**:

- The token is **never** put in the runtime environment. Nodepod exposes environment variables to project code as `process.env`, so the only GitHub value there is `CODEVRE_GITHUB_LINKED` (`1` or `0`).
- The token is attached to **one Git invocation at a time**, and only for `clone`, `fetch`, `pull`, `push` and `sparse-checkout`.
- Only two things get it: **Source Control operations**, and a **single, plain `git …` command you type yourself** in the terminal.
- Terminal commands with `;`, `&`, `|`, `<`, `>`, backquotes, `$`, several lines, or text injected by tasks, templates or the Agent are **never** given the token. They still run, just without authentication.
- npm scripts, `node` programs, startup tasks and the Agent can't get the token, even if they call `git` themselves.

So a package you install, or a script in a project you opened, can't steal your GitHub access. For more, see [Tokens and secrets](tokens-and-secrets.md).

## Cloning

```sh
git clone https://github.com/owner/repo
```

Clone into the project root and the repository becomes the project. See [Cloning a repository](files-and-projects.md#cloning-a-repository). Private repositories need GitHub connected, and the command must be typed as a single plain `git clone` line.

## Troubleshooting

- **"GitHub is linked but no access token was found."** Disconnect and reconnect GitHub.
- **A push from a script says it isn't authenticated.** This is by design; only Source Control and commands you type directly are authenticated. Run the `git push` yourself.
- **Push rejected.** GitHub has commits you don't. Pull first, or confirm **Force Push**. See [Pull, push and sync](source-control.md#pull-push-and-sync).