Setting the debatability of using personal accounts on the workplace aside.
The company I work for is dedicated to creating apps for other companies. Because of this we have many different clients and handle many different projects within our company's Github Enterprise organization. I'm one of the people in charge of the company's Medium blog. Since we would like to promote the company by showing the kind of people that work here, I consider it essential to be able to post articles using each of our personal accounts. In my opinion, being able to share sample code greatly increases the value of an article. And being able to do it with our own personal Github accounts would also serve as a motivator for people to contribute to the blog. (Especially those who have many personal projects on their personal Github accounts)
All engineers at our workplace have Github Enterprise accounts. These accounts allow us to pull and push from the repositories within our organization. Only admins are allowed to create new repositories though.
Our GHE accounts connect through SSH.
We are currently not allowed to use personal Github accounts within our work computers, but allowing them is being taken into consideration.
Managers are afraid that if personal Github accounts are allowed on company machines, employees might end up pushing our clients' code to their personal repositories BY MISTAKE, making it a huge risk of unintentional information leak.
Allow me to clarify here that, it is not an issue of policies or trust.
Considering the following hypothetical actions taken by an employee:
- Clones a project from the GHE repository to work on it.
- Modifies some code or adds some features to the project (but forgets push the changes)
- Changes account and works on some personal project from their personal account.
- Remembers that he has to commit changes. So he opens the work project and pushes the changes.
- For some reason he misses the message or warning that he is pushing or creating a repository with his personal account.
Is there a way to ensure that client code won't be made public by a mistake like this? (either through some kind of configuration)
Is uploading code to their personal accounts by mistake even possible considering the repository was made on GHE? (If my understanding is correct, repositories cloned by my work account are automatically configured to push, merge, and pull from the Github Enterprise using the work account only, so even if i changed the account i'd just get an error, but maybe i'd get a prompt to create a new repository on my account? I'm not really an expert using Github...)