Git submodules best practice - always use ssh protocol over https?

Question

I work on a lot of projects that use submodules, and some of them are added to their parent repos using a combination of both the https and ssh protocols , as if it's not important which one. SSH protocol has benefits that it uses ssh keys, but requires users set up those keys first .

I'd like to make a team policy: all projects should use GitHub's git user with ssh protocol in submodules. What are the pros/cons of said policy?

Answer 1

Pro:

• ssh keys can be registered/revoked

Cons:

• ssh keys must be installed ( %HOME%\\.ssh )
• ssh keys, if you have multiple sets, must be managed in a %HOME%\\.ssh\\config file (and the url must reflect that)
• ssh keys, if passphrase protected, would need an ssh-agent (to avoid entering the passphrase more than once per session)

I prefer activating 2FA on GitHub account , and use only Personal Access Token, which can be revoked as well, but which are used as classic username/password way ( and which can be cached ) with https url .

In both cases, the user need to be added as a collaborator to the GitHub repo .