As for repository access, you could have one qube with github access. Your dev qube would not have github access, but it would have access to a private repository. Your guthub qube can pull from the private repo and push to github without ever running or installing any of the code.