Only use repo scope with github.
Add comment as to why we do the cacerts copy.