You can have a read-write user on your CI server, but use a read-only user for a...

eeeeeeeeeeeee on June 17, 2015 | parent | context | favorite | on: Read-only deploy keys

You can have a read-write user on your CI server, but use a read-only user for any remote server where code is deployed. It's bad security policy that GitHub ever allowed deploy keys to be RW.