← Verse · A-to-Mind · Fix an automation

GitHub Actions "Permission denied (publickey)" on checkout: why it fails and how to fix it

You see: Permission denied (publickey) ยท fatal: Could not read from remote repository

What it means

The job tried to fetch another private repository (a private submodule or a second checkout) and the credential it has is not allowed to read it. The automatic GITHUB_TOKEN only covers the repository the workflow runs in, and a runner has no SSH key of its own.

How to fix it

  1. Decide how the job should read the other repository: a read-only deploy key on that repository, or a fine-grained personal access token or GitHub App token limited to it.
  2. Store the key or token as a repository secret (Settings, Secrets and variables, Actions) and never paste it into the workflow file.
  3. Give it to the checkout step, for example actions/checkout with token: ${{ secrets.OTHER_REPO_TOKEN }} (or ssh-key: for a deploy key), and set submodules: recursive if it is a submodule.
  4. If the submodule URL uses [email protected]: and you use a token, change it to the https:// form.
  5. Re-run the workflow.

If it keeps coming back

Tokens expire. If it worked for weeks and then stopped, renew the token and update the secret.

Still stuck? Ask Verse, free

Paste the error and what the automation does. Verse names the likely cause and the fix, in seconds, no account.

Ask Verse about this error

Or have it fixed: $25

One broken automation, diagnosed and repaired, with proof it runs again. Reply to the receipt with what stopped.

Get the One-Time Fix

The One-Time Fix covers one workflow. What you send and what you get back.

Sources