Fix: CI/CD Git Clone or Checkout Failure

!Symptoms

• CI pipeline fails at git checkout/clone step
• Error: 'Permission denied (publickey)' during clone
• Shallow clone fails with 'error: Could not read from remote repository'
• Submodule update fails in CI

?Root Causes

• Deploy key or SSH key not configured in CI environment
• GitHub/GitLab token expired or has insufficient scope
• Repository is private and CI lacks access
• Git submodule URLs use SSH but CI only has HTTPS credentials
• Shallow clone depth too small for the merge-base calculation

#Diagnosis Steps

1. 1Check the exact error message in the clone step output
2. 2Verify SSH key or token is configured in CI settings
3. 3For GitHub Actions: check if actions/checkout@v4 is configured with the right token
4. 4Test repository access: does the CI service account have read access?
5. 5Check if submodules use different auth than the main repo

>Fix

1. 1Add SSH deploy key to CI environment and repository settings
2. 2Use a Personal Access Token (PAT) or GitHub App token with repo scope
3. 3For GitHub Actions: use `token: ${{ secrets.MY_PAT }}` in actions/checkout if default token is insufficient
4. 4Convert submodule URLs to HTTPS: `git config --global url."https://github.com/".insteadOf [email protected]:`
5. 5Increase fetch-depth for shallow clones: `fetch-depth: 0` for full history

*Prevention

• Use GitHub App tokens instead of PATs for better security and auditability
• Configure .gitmodules with HTTPS URLs for CI compatibility
• Document CI access requirements in the repository README
• Set up token rotation reminders before expiry
• Test CI pipeline access as part of onboarding new repositories

Related Error Messages