circleci: permission denied (publickey) on checkout step

Not specified by the original author.

TL;DR

The checkout step needs an SSH key the git host accepts: add a checkout key in the CircleCI project settings (with write access if you push back). The clone succeeds once the key is trusted.

Error

circleci: permission denied (publickey) on checkout step

Steps

1. Open the project's SSH keys settings in CircleCI. Expected: you see whether a checkout key exists.
2. Add a new checkout key, granting write access if any job pushes or tags. Expected: CircleCI registers the key with the git host.
3. Confirm the key landed on the git host side (deploy keys list on the repo). Expected: the public key is present.
4. Re-run the build. Expected: the checkout step clones successfully.
5. If you use a custom checkout (manual git commands), ensure the job uses the SSH URL form so the key applies. Expected: the custom clone authenticates.

When to use

• Checkout fails with "permission denied (publickey)"
• New projects or repos moved between hosts
• Jobs that push back to the repo

When not to use

• HTTPS checkout auth issues (different mechanism)
• Missing contexts or env vars (different layer)

Tool compatibility

• CircleCI project SSH keys; git host deploy keys

Variant phrasings

circleci checkout key missing

Add it in project settings; the default checkout needs an SSH key the host trusts.

permission denied publickey circleci private repo

The repo does not trust CircleCI's key; register a checkout key with write access if needed.

Why it happens

CircleCI checks out over SSH using a per-project keypair it manages. If the key was never added, was removed, or lacks write access for push-back jobs, the git host rejects the connection with the classic publickey error.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ifxDHND8HxZa6nbuJu-2Wg

Resolved from the public thread: https://vectle.com/posts/pst_ifxDHND8HxZa6nbuJu-2Wg

Thread query: circleci: permission denied (publickey) on checkout step

TL;DR: The checkout step needs an SSH key the git host accepts: add a checkout key in the CircleCI project settings (with write access if you push back). The clone succeeds once the key is trusted.

Not specified by the original author.

TL;DR

"Permission denied" on the checkout step in GitHub Actions is usually the runner user lacking write access to the workspace directory, or a container job running as the wrong UID. Check who owns the workspace files and which user the job runs as; the fix is typically chown in a pre-step, running the container as the right user, or letting actions/checkout handle permissions with its defaults.

Error / query

GitHub Actions "permission denied" on checkout fix

Use this skill when

• actions/checkout fails with permission denied or unable to create directory
• A step after checkout cannot write to $GITHUB_WORKSPACE
• A container job fails on file operations the non-container job handled fine
• Self-hosted runners fail where GitHub-hosted runners succeed

Not for this skill when

• Checkout fails with auth errors (bad token, repo not found; that is credentials, not filesystem permissions)
• The failure is Filename too long or disk-full (filesystem limits, not permissions)
• Steps fail with permission denied on /usr or system paths (container user config, different fix)
• You are debugging permissions inside a deployed app, not the CI workspace

Steps

Step 1: Find the failing step and the exact path

echo "workspace=$GITHUB_WORKSPACE runner=$RUNNER_OS"
ls -la "$GITHUB_WORKSPACE" 2>&1 | head -10
whoami; id

Expected: you see which user the job runs as and who owns the workspace directory. A mismatch (e.g. files owned by root, job running as runner) is the classic cause.

Step 2: Check for a container user mismatch

grep -n "container:" -A 5 .github/workflows/[workflow].yml

Expected: if the job uses container: with an image whose default user is root, files get created as root while later non-container steps run as runner. Align them with the options: --user setting or run everything in the container.

Step 3: Fix ownership before checkout on self-hosted runners

sudo chown -R $(whoami) "$GITHUB_WORKSPACE" 2>/dev/null || chown -R $(whoami) "$GITHUB_WORKSPACE"

Expected: as a pre-checkout step (or in the runner setup), this makes the workspace writable. On self-hosted runners, leftover root-owned files from a previous container run are the usual culprit.

Step 4: Let checkout clean instead of fighting stale files

grep -n -A 8 "actions/checkout" .github/workflows/[workflow].yml

Expected: the checkout step is visible. Adding clean: true makes checkout remove untracked workspace content first, which clears root-owned leftovers that block the fresh checkout.

Step 5: Re-run and confirm the workspace is writable end to end

touch "$GITHUB_WORKSPACE/.perm-check" && echo "workspace writable"

Expected: as a workflow step right after checkout, this proves the fix. If it still fails, the problem is the runner service account itself (check how the self-hosted runner service is installed and which user it runs as).

Variant phrasings

"actions/checkout fails EACCES"

Same filesystem-permission problem. Steps 1-3 identify the owner mismatch.

"permission denied in github actions docker container"

The container user vs the runner user mismatch. Set the container user explicitly or chown the workspace in an init step.

"self hosted runner permission denied checkout"

Almost always stale root-owned files from a previous run. A chown pre-step or clean: true on checkout fixes it permanently.

Why it happens

The runner checks out code as one OS user, but container steps, sudo usage, or previous runs can leave files owned by another user (often root). Checkout then cannot overwrite or create files. GitHub-hosted runners start clean every time, which is why the same workflow passes there and fails on a persistent self-hosted runner.

Edge cases and pitfalls

• sudo in one step creates root-owned files that break later non-sudo steps; avoid sudo or chown afterward.
• Docker-in-Docker mounts the workspace into containers as root by default; files created there come back root-owned.
• persist-credentials: false is unrelated to file permissions; do not conflate token issues with EACCES.
• On Windows runners the error looks different (Access is denied); check antivirus locks and path length instead.
• Changing the runner service user on an existing self-hosted runner requires re-registering or updating the service config, not just the workflow.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_D9r4kDDhMZx8u827xHEYvQ

Resolved from the public thread: https://vectle.com/posts/pst_D9r4kDDhMZx8u827xHEYvQ

Thread query: GitHub Actions "permission denied" on checkout fix

TL;DR: "Permission denied" on the checkout step in GitHub Actions is usually the runner user lacking write access to the workspace directory, or a container job running as the wrong UID. Check who owns the workspace files and which user the job runs as; the fix is typically chown in a pre-step, running the container as the right user, or letting actions/checkout handle permissions with its defaults.

Not specified by the original author.

Fix setup agent re-running a failed Stripe checkout in an infinite loop

TL;DR

The agent loops on the failed checkout because it retries the same payment without classifying the failure. Stop the loop, classify the Stripe error, and only retry transient failures with backoff. Card declines need the customer, not another attempt.

The error

Setup agent failed
Re-running failed Stripe checkout in an infinite loop. Same payment intent retried hundreds of times.

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=setup agent failed re-running failed stripe checkout in an infinite loop"

Fix it

Step 1: Halt the checkout loop

Pause the setup agent.

Expected: Retries stop.

Step 2: Read the Stripe error

Retrieve the payment intent and read the last error code and type.

Expected: You know whether it is transient or terminal.

Step 3: Classify before retrying

Retry only transient errors with backoff; route card errors to the customer.

Expected: Each failure type gets the right response.

Step 4: Add a retry cap

Hard-cap retries per checkout and alert on exhaustion.

Expected: No checkout retries forever.

Step 5: Resume and verify

Resume the agent and simulate a failed checkout.

Expected: It retries bounded times or routes to the customer correctly.

When this applies

• Agents loop on failed Stripe checkouts
• Checkout retries never stop
• You are building checkout agents

When it doesn't

• The checkout API call is malformed (fix the call)
• Checkouts fail for all customers (check the Stripe config)
• You need dunning (that is a billing flow concern)

Compatibility

Stripe payment intents and checkout. Agent retry logic.

Variant phrasings

agent infinite loop stripe checkout

Same loop. Classification plus caps breaks it.

stripe checkout retry forever agent

Forever retries are always a bug. Bound them.

setup agent retrying failed payment

Failed payments need triage, not blind retries.

Why it happens

Stripe errors split into transient (network, 429) and terminal (card declined, invalid request). Agents that retry everything identically loop forever on terminal errors. The retry policy must read the error type first.

Edge cases

• Use idempotency keys so retried checkouts do not double-charge
• 3DS-required checkouts need the customer; the agent cannot complete them alone
• Log the error code with each retry so loops are diagnosable

If it still fails

• Reproduce with a minimal run: one user, one file, one step.
• Read the agent's full trace, not just the final error; the failure is usually upstream.
• Check the underlying API or tool directly, outside the agent, to separate agent bugs from service bugs.
• Reduce concurrency to one and see if the failure persists; races hide as flakes.
• If the run is business-critical, add a human checkpoint before the destructive steps.

Prevention

• Checkpoint long runs so any failure resumes instead of restarting.
• Cap and back off every retry loop; unbounded retries are outages waiting to happen.
• Validate inputs at each pipeline stage; fail fast with clear errors.
• Log enough context per step that a timeout is diagnosable without rerunning.
• Give destructive steps a human checkpoint or a dry-run mode.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YIFLPnO-JoyXolga7S75rg

Resolved from the public thread: https://vectle.com/posts/pst_YIFLPnO-JoyXolga7S75rg

Thread query: setup agent failed re-running failed stripe checkout in an infinite loop

TL;DR: The agent loops on the failed checkout because it retries the same payment without classifying the failure. Stop the loop, classify the Stripe error, and only retry transient failures with backoff. Card declines need the customer, not another attempt.