Say you train on a GPU VM on AWS and keep a smaller one on GCP for evals. The code sits in a private GitHub repo, so every new VM starts the same way. You get a token onto the machine somehow, clone, and cd into the folder. Later, when a run fails, the traceback points at files that only exist on that VM.
Skyportal can take over that first step. You save a GitHub token in your account once, then ask SARA, the agent in Skyportal's chat, to clone the repo. The approval card shows the plain URL, and Skyportal adds the token only to the command it runs on the VM. When the clone finishes, SARA runs its next commands from the repo's root folder, so it can read the file from a traceback or start your script without being told where the code is. You don't need cloud account keys for any of this, only the SSH login Skyportal already has for the VM.
What the VM needs
Connect the VM to Skyportal over SSH first. The Bring Your Own Cloud GPU post covers that for AWS, GCP, Lambda, RunPod and Vast.ai.
The VM needs git, and it needs python3 as well. After a clone, Skyportal runs a short python3 script on the VM to read the repo's root folder, remote and branch. Without python3 the clone still happens, but the repo isn't selected, so later commands don't start inside it.
Save a GitHub token
Public repos don't need a token. For a private one, create a fine-grained personal access token on GitHub that covers only that repository, with read access to Contents. That's enough to clone. Keep it that narrow, because the token ends up on the VM: Skyportal clones with the token in the URL, and git saves that URL in the repo's .git/config. Anyone who can read that file can read the token, so revoke it on GitHub when you delete the VM.
In Skyportal, open Agent Settings from the sidebar. The GitHub Integration card has a field for the token and a Save Token button. Skyportal checks the token with GitHub before it saves it, and stores it encrypted. After that the card shows a masked copy and a button to revoke it. Your account keeps one token, so saving a new one replaces the old one.
You can also wait until you need it. If a clone fails because GitHub asks for credentials, SARA stops and shows a "GitHub access needed" card in the chat. Paste the token there, click Save & continue, and SARA retries the clone. The same card comes back when the saved token has expired or been revoked.
A token that works but can't see the repo gets no card, since pasting it again wouldn't help. SARA tells you what to check instead, such as a fine-grained token that doesn't list the repo, or an organization that requires SSO authorization for the token. Then it waits for you.
Ask SARA to clone it
Pick the VM in the chat and ask with the repo's HTTPS URL, for example "Clone https://github.com/acme/trainer into ~/trainer." SARA prepares a git clone command, and it goes through the same approval as any other command.
Use the https://github.com/... form. That's the only form Skyportal adds the token to, so an SSH URL such as git@github.com:acme/trainer.git, or a repo on GitLab or Bitbucket, gets no token from Skyportal.
A clone doesn't count as a destructive command, so it runs even on a VM under Production, which is read-only by default. git pull and git checkout do count, and Production refuses them. On Dev or Staging they follow the same approval rules as any other change.
Working inside the repo
When the clone finishes, SARA posts a line naming the folder and the repository it selected. From then on, every command it runs on that VM starts with a cd into the repo's root folder. Clones are the exception, so a second clone doesn't land inside the first repo, and the new repo becomes the selected one. The selection belongs to the VM you cloned on, so commands on other VMs in the same chat don't start inside it.
That keeps follow-up requests short. Requests like these work once the repo is selected:
- "Run python train.py --config configs/a100.yaml and show me the first error."
- "Open the file from that traceback and show me the lines around the failing call."
- "Which commit is checked out, and what changed in the last three commits?"
SARA answers them with ordinary commands on the VM, such as cat, grep and git log, and each one follows your approval settings.
From the terminal
The Skyportal CLI saves the same token without showing it on screen. It needs Python 3.11 or newer.
python -m pip install skyportalai
skyportalai login
skyportalai github-token set --repo acme/trainer
skyportalai github-token statusset asks for the token without echoing it. With --repo, Skyportal also checks that the token can reach that repository before it saves anything, so a fine-grained token that wasn't given the repo fails here instead of at clone time. status prints the masked token, and skyportalai github-token remove deletes it. In the interactive shell, /github-token set acme/trainer does the same thing.
Get started
The Pro plan includes the GitHub integration. Sign up, add the VM over SSH, save a token, and ask SARA to clone your repo. The CLI commands are in the docs, under GitHub token.