GitHub and collaboration

Remotes, SSH keys, the pull request workflow, reviews, forks and the GitHub CLI.

Remotes

Also called origin, upstream

What: Named links to other copies of the repository. origin is the one you cloned from; upstream is the usual name for the original project when you work from a fork.
Why: Every push, pull and fetch goes to a named remote.

Shell

git remote -v
git remote add upstream git@github.com:org/app.git
git remote set-url origin git@github.com:me/app.git

fetch, pull and push

Also called origin/main, tracking branch

What: fetch downloads new commits without changing your files, pull fetches and then merges or rebases, and push uploads your commits.
Why: Fetching first lets you see what changed before it touches your work.

Shell

git fetch origin
git log --oneline main..origin/main
git pull --rebase
git push -u origin fix-empty-cart

Watch out

Pulling onto a branch with uncommitted changes without knowing whether it will merge or rebase.

SSH keys

Also called ed25519, ssh-keygen, public key, private key

What: A key pair: a private key that stays on your machine and a public key (.pub) you give to GitHub or a server. They prove who you are without a password.
Why: GitHub does not accept account passwords for Git operations, and servers should only accept key logins.

Shell

ssh-keygen -t ed25519 -C "sara@example.com"
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
cat ~/.ssh/id_ed25519.pub   # paste into GitHub
ssh -T git@github.com

Watch out

Sharing, uploading or copying the private key between machines instead of making a new one.

GitHub flow

What: A lightweight workflow: main is always deployable; each change gets a branch, commits, a pull request, review and checks, then a merge and branch deletion.
Why: Short branches mean small reviews, fewer conflicts and a main branch you can trust.

Watch out

Letting a branch live for weeks and gather unrelated changes.

Pull request

Also called PR, draft PR

What: A request to merge a branch, with a description, discussion, review and automated checks.
Why: It is where teams catch bugs, share knowledge and record why a change was made.
Example: Title: "Fix crash on empty cart". Body: why, what changed, how you tested it, screenshots, and "Closes #42".

Watch out

Huge pull requests with no description, which reviewers skim or ignore.

Code review

What: Reading a teammate's change to check correctness, tests, clarity and fit, and leaving comments, suggestions or approval.
Why: It spreads knowledge of the codebase and catches problems before users do.
Example: Instead of "bad name", try "Could this be cartTotal? I read sum as the tax sum at first."

Watch out

Approving without reading, or mixing small preferences with blocking issues.

Forks and syncing

Also called fork, upstream sync

What: A fork is your own copy of someone else's repository on GitHub. You push branches to your fork and open pull requests to the original, syncing from upstream regularly.
Why: It is how you contribute to projects where you do not have write access.

Shell

git fetch upstream
git switch main
git merge --ff-only upstream/main
git push origin main

Watch out

Committing on your fork's main, which makes every later sync conflict.

GitHub CLI

Also called gh

What: The official command-line tool for GitHub: repositories, pull requests, issues, releases and Actions runs from the terminal.
Why: Saves trips to the browser and works in scripts.

Shell

gh auth login
gh repo clone org/app
gh pr create --fill
gh pr checkout 42
gh pr status
gh run list

Secrets in Git

Also called .env, API key leak, committed secrets, push protection

What: Passwords, tokens and keys committed to a repository stay in its history even after you delete the file.
Why: Leaked keys are found and abused quickly, especially on public repositories.
Example: If a key leaks: revoke or rotate it at the provider first, then remove it from history, then check for misuse.

Watch out

Believing that deleting the file in a new commit, or making the repository private, makes the secret safe.

Go deeper