I have my main git SSH key stored in 1Password, and I use the 1Password agent to make it available in my system.
This means whenever I run git pull or similar read-only commands I need to touch my fingerprint sensor. I was looking for a solution that would only prompt me for pushes.
Unfortunately, git doesn't support read-only SSH keys.
This gist describes a workaround which:
- Forces clones/pulls/etc to use HTTPS with a read-only finegrained personal access token
- Forces pushes to use SSH with specific public key
This solution is not limited to 1Password, it works with any type of ssh private key.
