Git "Host key verification failed" in CI
SSH would not connect because it could not verify the server host key against known_hosts. On a fresh CI runner the host is simply unknown, and non-interactive SSH refuses to trust it on the fly.
What this error means
An SSH clone or push fails with Host key verification failed and fatal: Could not read from remote repository. There is no prompt because CI runs non-interactively.
git
No ECDSA host key is known for github.com and you have requested strict checking.
Host key verification failed.
fatal: Could not read from remote repository.Diagnose it: depth, refs, or credentials?
Terminal
git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD # prints HEAD when detached
git log --oneline -3
git remote -vCommon causes
github.com missing from known_hosts
A clean runner has no known_hosts entry, and strict checking rejects the unverified host.
Outdated or rotated host key
A pinned known_hosts entry no longer matches after GitHub rotated its keys.
How to fix it
Add the host key before connecting
- Pre-populate known_hosts with the current GitHub key.
- Or, for the first connect only, accept new keys automatically.
Terminal
mkdir -p ~/.ssh
ssh-keyscan github.com >> ~/.ssh/known_hostsPin the verified key (preferred)
- Use the published GitHub SSH key fingerprints rather than blindly trusting whatever responds.
- Refresh the pinned entry if GitHub rotates keys.
Terminal
ssh -o StrictHostKeyChecking=accept-new -T git@github.comHow to prevent it
- Seed known_hosts with the published GitHub fingerprints as part of runner setup so SSH steps never hit an unknown host.
Frequently asked questions
What causes Git "Host key verification failed" in CI?
There are 2 common causes: github.com missing from known_hosts and outdated or rotated host key. A clean runner has no known_hosts entry, and strict checking rejects the unverified host.
How do I fix Git "Host key verification failed" in CI?
There are 2 fixes depending on which cause you have: add the host key before connecting and pin the verified key (preferred). Work through them in order, since the first is the most common.
What does Git "Host key verification failed" in CI actually mean?
An SSH clone or push fails with Host key verification failed and fatal: Could not read from remote repository.
How do I stop Git "Host key verification failed" in CI happening again?
Seed known_hosts with the published GitHub fingerprints as part of runner setup so SSH steps never hit an unknown host.
Related guides
Git "Permission denied (publickey)" in CIFix the Git "git@github.com: Permission denied (publickey)" error in CI, caused by a missing SSH key, an
Git "could not read Username" with no terminal in CIFix the Git "could not read Username ... No such device or address" error in CI, caused by Git prompting for
Git "git@github.com: Permission denied (publickey)" - Deploy Key in CIFix Git SSH "git@github.com: Permission denied (publickey)" in CI for deploy keys - the right private key is