Using SSH inside a Codespace to clone remote repos

[TheProGuyPF]

Select Topic Area

Question

Body

How can I idiomatically clone remote private repositories over SSH in a Codespace?

I'm trying to move over my local-dev workflow to codespaces. I've got a large multi-repository project which needs to clone ~40 private repositories. Locally we use a script which clones via SSH: we generate and add our keys to github and it just works, but, I can't find en idiomatic way to git clone over SSH in a codespace. I receive this error:

git clone --recurse-submodules git@github.com:MyOrg/ProjectA.git projects/ProjectA
Cloning into 'projects/ProjectA'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

(Note: I've added permissions for all the necessary repos in customizations.codespaces.repositories in devcontainers.json) Example:

"customizations": {
    "codespaces": {
      "repositories": {
        "MyOrg/ProjectA": {
          "permissions": {
            "issues": "write",
            "pull_requests": "write",
            "contents": "write"
          }
        }
      }
    }
  }

I've had success using the gh cli which clones over HTTPS using the GITHUB_TOKEN, however some of these project are Rust based and pull in internal dependencies over SSH so having a key is mandatory (unless we hack around and re-route Git SSH requests into HTTPS, but I'd rather not if there's a better solution).

I've also tried to copy over a local SSH into the codespace for use, but this doesn't work either. I can run a ssh-agent in the codespace to generate and add a new key but this would then have to be done for every new container I create which is a pain as I want these containers to be throw-awayable thus the setup needs to be as automated/configurable as possible.

Can't find any docs and past discussions on this, but I'm open to any and all help/suggestions :)

[opwx]

Hello @TheProGuyPF Letme Solve your issues.

You're trying to move your local development workflow to Codespaces, which involves cloning around 40 private repositories. You're using SSH to clone these repositories, but you're encountering a permission denied error when trying to clone them in a Codespace.

The problem with the current approach

Your current script generates and adds SSH keys to GitHub, which works locally. However, this approach doesn't work in a Codespace because the SSH keys are not persisted across container restarts. You've tried copying over a local SSH key into the Codespace, but that doesn't work either.

A potential solution

One idiomatic way to clone remote private repositories over SSH in a Codespace is to use a deploy key. A deploy key is an SSH key that's specifically generated for a Codespace and can be used to authenticate with GitHub.

Here's a step-by-step approach to solve the issue:

Generate a deploy key: In your Codespace, run the command ssh-keygen -t ed25519 -C "codespace-deploy-key" to generate a new SSH key pair.
Add the deploy key to GitHub: Go to your GitHub repository settings, navigate to Deploy keys, and add the public key generated in step 1.
Update your customizations configuration: In your customizations configuration, add the following:

[opwx]

Reply @TheProGuyPF Here is the markdown

"customizations": {
"codespaces": {
"repositories": {
"MyOrg/ProjectA": {
"permissions": {
"issues": "write",
"pull_requests": "write",
"contents": "write"
},
"ssh": {
"github": {
"deployKey": "codespace-deploy-key"
}
}
}
}
}
}

[opwx]

Reply @TheProGuyPF This configuration tells Codespaces to use the deploy key for SSH authentication.

Update your git clone command: Update your git clone command to use the deploy key:

git clone --recurse-submodules git@github.com:MyOrg/ProjectA.git projects/ProjectA

With these changes, you should be able to clone your private repositories over SSH in a Codespace.

Additional considerations

If you have multiple repositories that require SSH access, you may want to consider using a single deploy key for all repositories. This can simplify the process of managing SSH keys across multiple repositories.

Additionally, you may want to explore using GitHub Actions to automate the process of generating and adding deploy keys to your repositories.

[TheProGuyPF]

Thanks for the explanation.
Could you direct me to the docs/sources you used to get this info? Unfortunately I cannot find anything.
I'm not sure what codespace-deploy-key is in this regard, and how do I generate it.

[bogumilo]

Article that helped me: https://dylancastillo.co/posts/how-to-use-github-deploy-keys.html