Git submodules best practice - always use ssh protocol over https?

Question

I work on a lot of projects that use submodules, and some of them are added to their parent repos using a combination of both the https and ssh protocols, as if it's not important which one. SSH protocol has benefits that it uses ssh keys, but requires users set up those keys first.

I'd like to make a team policy: all projects should use GitHub's git user with ssh protocol in submodules. What are the pros/cons of said policy?

Answer 1

Pro:

• ssh keys can be registered/revoked

Cons:

• ssh keys must be installed (%HOME%\.ssh)
• ssh keys, if you have multiple sets, must be managed in a %HOME%\.ssh\config file (and the url must reflect that)
• ssh keys, if passphrase protected, would need an ssh-agent (to avoid entering the passphrase more than once per session)

I prefer activating 2FA on GitHub account, and use only Personal Access Token, which can be revoked as well, but which are used as classic username/password way (and which can be cached) with https url.

In both cases, the user need to be added as a collaborator to the GitHub repo.