Git SSH "Load key: invalid format" in CI

SSH could not parse the private key file. The key material is intact in the secret but got mangled on the way to disk - a stripped trailing newline, CRLF line endings, or lost formatting all make OpenSSH reject it as invalid.

What this error means

An SSH operation fails with Load key "/path/id_ed25519": invalid format (sometimes error in libcrypto), then Permission denied (publickey). The key works on a developer machine but not after being injected via a CI secret.

Load key "/home/runner/.ssh/id_ed25519": invalid format
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Common causes

Missing trailing newline

OpenSSH requires the private key file to end with a newline. A secret that dropped the final newline makes the key fail to parse.

CRLF line endings

A key pasted on Windows or through a tool that rewrote line endings has \r\n, which OpenSSH does not accept.

Echo/quoting mangled the key

Writing the key with echo or shell interpolation can collapse newlines or expand characters, corrupting the PEM structure.

How to fix it

Write the key verbatim with a trailing newline

Use a heredoc or printf that preserves newlines, and ensure a final newline.

install -d -m 700 ~/.ssh
printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519
ssh-keygen -y -f ~/.ssh/id_ed25519 >/dev/null   # validates the key parses

Strip CRLF if present

Normalize line endings when the secret may have been saved with CRLF.

printf '%s' "$DEPLOY_KEY" | tr -d '\r' > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519

How to prevent it

• Store the full PEM key including its trailing newline in the secret.
• Use the checkout action’s ssh-key input, which writes the key correctly.
• Avoid echo/interpolation for key material; prefer printf/heredoc.

Related guides