That's fine if you have a single repo, but CI normally needs to access lots of different repos. GitHub's documentation describes why you need machine users for anything but the most trivial deployment.

https://developer.github.com/guides/managing-deploy-keys/

It's also what GitHub does internally.

If I understand that page correctly, the only real difference is that Github arbitrarily prevents you from using the same deploy key for multiple repositories. If they lifted that restriction, this problem would go away.

Yep, same here. Our build system uses multiple repos (and now you can have as many as you want!)

This is shortsighted on their part, I hope they pay attention.

Semaphore works the same way.