My co-worker figured out a way to run the GitHub CLI with read-only keys restricted to specific repos. I need to do that still.