Git "Permission denied (publickey)" in CI

By Kaveh Alemi·Latchkey

The SSH handshake offered no key the remote accepts, so authentication failed before any repository access. In CI this usually means no key was loaded or the deploy key is not registered.

What this error means

A clone or push over SSH fails with git@github.com: Permission denied (publickey) and fatal: Could not read from remote repository. It fails identically on every retry.

git

git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Diagnose it: depth, refs, or credentials?

Terminal

git rev-parse --is-shallow-repository
git rev-parse --abbrev-ref HEAD    # prints HEAD when detached
git log --oneline -3
git remote -v

Common causes

No SSH key available to the agent

The runner has no private key loaded, or the ssh-agent was never started, so nothing is offered to the server.

Key not registered with the repo or org

A deploy key or user key exists but was never added to the target repository or account.

Wrong key permissions or format

A key file with loose permissions, or an unsupported format, is silently ignored.

How to fix it

Load the key into the agent

Start ssh-agent and add the private key in the job.
On Actions, prefer a maintained SSH-key action or pass ssh-key to actions/checkout.

.github/workflows/ci.yml

eval "$(ssh-agent -s)"
echo "${{ secrets.SSH_PRIVATE_KEY }}" | ssh-add -

Verify the key is authorized

Add the public key as a deploy key on the repo (allow write if pushing).
Test the connection non-interactively.

Terminal

ssh -o StrictHostKeyChecking=accept-new -T git@github.com

How to prevent it

Store the private key as a secret, load it via ssh-agent or actions/checkout ssh-key, and register the matching deploy key on every repo the job touches. A retry cannot fix a missing or unauthorized key.

Frequently asked questions

What causes Git "Permission denied (publickey)" in CI?

There are 3 common causes: no ssh key available to the agent, key not registered with the repo or org, and wrong key permissions or format. The runner has no private key loaded, or the ssh-agent was never started, so nothing is offered to the server.

How do I fix Git "Permission denied (publickey)" in CI?

There are 2 fixes depending on which cause you have: load the key into the agent and verify the key is authorized. Work through them in order, since the first is the most common.

What does Git "Permission denied (publickey)" in CI actually mean?

A clone or push over SSH fails with git@github.com: Permission denied (publickey) and fatal: Could not read from remote repository.

How do I stop Git "Permission denied (publickey)" in CI happening again?

Store the private key as a secret, load it via ssh-agent or actions/checkout ssh-key, and register the matching deploy key on every repo the job touches.