pre-commit: authentication in internal github repos

Problem statement: prek can’t clone a repo: that lives in an internal (private) GitHub repo — https:// clone fails without credentials. I forked my personal pre-commit-hooks into an org-owned repo and updated all our .pre-commit-config.yaml files to point at it: - repo: https://github.com/<org>/pre-commit-hooks rev: 5695e23285bef67d1dee957e5c12e86f58ba843b # frozen: v1.0.0 hooks: - id: check-bash-shebang This approach works locally (my GitHub token is broad). CI (github actions) fails though: fatal: could not read Username for 'https://github.com': terminal prompts disabled The repo is INTERNAL, not public. As such, prek clones the repo: URL to fetch the hooks; with no credentials on the runner, it can’t. First instinct: git@github.com:<org>/pre-commit-hooks. Runners have no SSH key though! The fix is to keep https:// in the config, mint a short-lived token that can read the hooks repo, and tell git to rewrite the URL: - name: Generate app token uses:…