@evan Yeah, sounds like just SSH is network restricted. I'm guessing you could generate a PAT and use that for HTTPS auth to push; AFAIK there's no way to restrict that in GHES