You do this once. GitHub shows the permissions and returns the private key to Forge. The key stays on the cluster, not in git.