A --socket=ssh-agent permission would be nice. My use case is building docs inside a sandbox with flatpak-builder and deploying them by pushing to the gh-pages branch of my repository on GitHub.

With the following options to flatpak run I can get GitHub to recognize my SSH key, so I assume it would just be a question of passing the appropriate args to bwrap:

flatpak run --command=bash --share=network --filesystem=$SSH_AUTH_SOCK --env=SSH_AUTH_SOCK=$SSH_AUTH_SOCK org.gnome.Sdk//3.26