The Push Guard writes to the remote, the Backup Guard only reads. Give each exactly that, and never reuse the Push Guard's credential for the Backup Guard. Save the key or token as a file. Its path is the credential setting in that remote's warden.yaml or backup.yaml (the other settings).
| Credential | Push Guard (warden.yaml): read and write | Backup Guard (backup.yaml): read only |
|---|---|---|
| GitHub deploy key (SSH) | Deploy key with Allow write access | Deploy key without it (deploy keys are read-only by default) |
| GitHub fine-grained personal access token (HTTPS) | Repository permission Contents: Read and write; Metadata: Read-only is always included | Contents: Read-only; Metadata: Read-only |
GitHub App installation token (HTTPS, user name x-access-token) | Repository permission Contents: Read and write | Contents: Read-only |
| GitLab deploy key (SSH) | Deploy key with Grant write permissions to this key | Deploy key without it (read-only) |
| GitLab project access token (HTTPS, any non-blank user name) | Scope **write_repository, role Developer (pushes to unprotected branches) or Maintainer** (protected branches) | Scope **read_repository, with a role that may read the code (e.g. Reporter**) |
| GitLab deploy token (HTTPS) | Not possible: deploy tokens have no scope for pushing to a repository | Scope **read_repository**; set credential_username to the token's user name (default format gitlab+deploy-token-<n>) |
Notes:
- With a GitHub personal access token, GitHub's documentation uses the account's user name as the Git user name; set
credential_usernameto it. - Changes to
.github/workflowsadditionally need the Workflows permission on GitHub. Leaving it out of the Push Guard's token means GitHub itself refuses workflow changes, even if a rule missed one. - The remote's own protections (protected branches, rulesets) still apply to the guard's credential.
Sources: GitHub deploy keys, personal access tokens, GitHub App permissions for Git access; GitLab deploy keys, project access tokens, token scopes, deploy tokens, roles and permissions.