Connect an agent to GitHub with DigitalOcean Action Gateway

Every Harness Runtime command runs through doctl, so you need a recent build that's signed in.

1. 1Install doctl. On a Mac, run brew install doctl. On other systems, follow DigitalOcean's install guide.
2. 2In the control panel, click Account, then API, then Generate New Token. Pick Full Access.
3. 3Run the commands below and paste the token when asked.

doctl auth init
doctl harness-runtime --help

You should see a list of session commands, including launch, list, pause and remove.

This token can change anything in your DigitalOcean team. Keep it out of spec files, chats and repos.

The gateway stores the GitHub login and adds it to each tool call, so the agent never holds the token.

1. 1Open the Connections page and click Add connection.
2. 2Pick GitHub, then DigitalOcean's OAuth app. Keep the Actor ID it fills in from your login email.
3. 3Review the Permissions, click Connect, and approve access on GitHub.

You should see your GitHub connection marked Active.

This grant isn't limited to one repository. It reaches every repository the GitHub account can open.

One YAML file sets the agent, its model key, the gateway tools and what needs your approval.

1. 1Save the text below as github-agent.yaml.
2. 2Don't add a GITHUB_TOKEN line. The gateway brings the GitHub login, so the sandbox doesn't need one.
3. 3Swap registry.npmjs.org for the package host your project uses.

name: github-helper
harness: claude-code
size: mars-2vcpu-4gb
secrets:
  ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY}
egress:
  - registry.npmjs.org
tools:
  - do.actions
permissions:
  default: ask
  rules:
    - tool: file.read
      action: allow
    - tool: do.actions/action_search
      action: allow

You should see a saved github-agent.yaml with harness: claude-code, do.actions and no GitHub token.

default: ask makes every GitHub call wait for you. Naming one host under egress blocks all others, and DigitalOcean adds GitHub and the model hosts itself.

Watching the first calls shows you which GitHub tools the agent picks and what each one sends.

1. 1Run the commands below, with your Anthropic key in place of [YOUR ANTHROPIC KEY].
2. 2When Claude Code starts, ask: List the 5 newest open issues in [OWNER/REPO]. Draft a comment for the oldest one and wait for my OK.
3. 3Read each approval request, then press y to approve or n to reject.

export ANTHROPIC_API_KEY=[YOUR ANTHROPIC KEY]
doctl harness-runtime launch github-agent.yaml

You should see approval requests that name each GitHub tool and its arguments, then the issue list and a draft comment.

Your key fills the ${ANTHROPIC_API_KEY} slot at launch. Never save or share a copy of the spec with the key filled in.

The agent can read anything in its environment, so confirm the GitHub token isn't in there.

1. 1Ask the agent to run the command below. It prints variable names only, not their values.
2. 2Approve the shell command when asked.
3. 3Look through the list for GITHUB_TOKEN or any other GitHub variable.

Run this and show me the output: env | cut -d= -f1 | sort

You should see a list of names with ANTHROPIC_API_KEY in it and no GitHub token.

Your Anthropic key is readable in there, like any secret. Use a key you can rotate, and rotate it if anything looks wrong.

A session bills for compute until it pauses or you remove it.

1. 1Press Ctrl+D to detach. The session keeps running in the cloud.
2. 2Run the command below to remove it.
3. 3Done with GitHub access? Run doctl harness-runtime connections list, then doctl harness-runtime connections revoke with the connection's ID.

doctl harness-runtime remove github-helper

You should see no github-helper session when you run doctl harness-runtime list.