# Git Identity

Give your PA its own dedicated git identity with a separate SSH key and commit author. This creates a clear audit trail: you can always tell which commits were made by you and which by your PA.


## What it does

Sets up:
- A dedicated SSH keypair for the PA
- Git author configuration (name and email)
- GitHub deploy key or user association
- Local `.gitconfig` scoping so the PA uses its own identity automatically


## Prerequisites

- Git installed
- SSH client installed
- A GitHub account (or other git hosting) where you want the PA to push
- Access to add SSH keys to your git hosting provider


## Steps

Substitute your PA's name for `<paName>` throughout (the example below uses the placeholder to keep the copy generic across estates).

### 1. Generate an SSH keypair

Create a dedicated key for your PA:

```bash
ssh-keygen -t ed25519 -C "<paName>-pa@yourdomain.com" -f ~/.ssh/<paName>_pa_ed25519 -N ""
```

This creates:
- `~/.ssh/<paName>_pa_ed25519` (private key)
- `~/.ssh/<paName>_pa_ed25519.pub` (public key)

### 2. Add the public key to GitHub

Copy the public key:

```bash
cat ~/.ssh/<paName>_pa_ed25519.pub
```

Then add it to GitHub:
- Go to GitHub Settings > SSH and GPG keys > New SSH key
- Title: "<paName> PA" (or whatever you call your PA)
- Key type: Authentication key
- Paste the public key

Alternatively, add it as a deploy key on specific repositories if you want to limit access.

### 3. Configure SSH to use the PA key

Add a host alias to `~/.ssh/config`:

```
Host github-pa
  HostName github.com
  User git
  IdentityFile ~/.ssh/<paName>_pa_ed25519
  IdentitiesOnly yes
```

### 4. Configure git identity

Set up the PA's git identity in your repo. Create or edit `.gitconfig` in your repo root:

```ini
[user]
    name = <paName> (PA)
    email = <paName>-pa@yourdomain.com
```

Then tell git to use this config for this repo:

```bash
git config --local include.path ../.gitconfig
```

Alternatively, set it directly:

```bash
git config --local user.name "<paName> (PA)"
git config --local user.email "<paName>-pa@yourdomain.com"
```

### 5. Update remote URL (optional)

If you want the PA to push using its own SSH key, update the remote to use the host alias:

```bash
git remote set-url origin git@github-pa:yourusername/yourrepo.git
```

### 6. Verify

Test that the PA's identity works:

```bash
ssh -T github-pa
# Should output: Hi yourusername! You've successfully authenticated...

git log --oneline -1
# Commits should show "<paName> (PA)" as author
```


## Security notes

- The PA's SSH key should have the minimum required access. Prefer deploy keys over personal access.
- Never share the private key or commit it to the repository.
- Store the private key path in your secrets vault for reference.
- If the PA only needs to push to specific repos, use per-repo deploy keys instead of a global SSH key.
- Consider enabling signed commits for the PA identity for additional verification.
- Periodically rotate the SSH key, especially if the PA operates on shared infrastructure.