Buildkite "git clone ... Permission denied (publickey)" in CI

By Kaveh Alemi·Latchkey

During checkout the agent clones your repository over SSH. If the agent has no SSH key that the git host recognizes, the clone fails with "Permission denied (publickey)" and the build never gets the code.

What this error means

The checkout phase fails with "git@github.com: Permission denied (publickey). fatal: Could not read from remote repository." before any step runs.

$ git clone -- git@github.com:acme/app.git .
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Common causes

No SSH key on the agent for the git host

The agent user has no private key, or the key is not authorized as a deploy key or machine user on the repository.

The host key is not trusted

The git host is not in known_hosts, so SSH cannot verify the server and the clone is refused.

How to fix it

Provide an authorized SSH key to the agent

1. Add a deploy key (or machine-user key) with read access to the repository.
2. Deliver the private key to the agent via the S3 Secrets hook or the agent SSH directory, not the repo.
3. Add the git host to known_hosts so the connection is trusted.

ssh-keyscan github.com >> ~/.ssh/known_hosts
GIT_SSH_COMMAND="ssh -i ~/.ssh/buildkite_deploy" git ls-remote git@github.com:acme/app.git

Load git SSH keys through the secrets hook

The S3 Secrets hook can place a repo-scoped private SSH key on the agent for checkout, keeping it out of the pipeline.

How to prevent it

• Give agents a repo-scoped deploy key delivered through a secrets hook.
• Pre-populate known_hosts for your git host on the agent image.
• Rotate agent SSH keys and keep them out of the repository.

Frequently asked questions

Related guides

References

• GitHub Actions documentation