Access a private GitHub repository from a Cloud Build step (glide install fails)

TL;DR: Cloud Build steps have no GitHub credentials by default, so private repos are unreachable until you inject them. Store a deploy key or token encrypted, pull it into the build from Cloud Storage in an early step, then use it for git operations (add GitHub to known_hosts to avoid the host-key verification failure). Google's tutorial on using encrypted files in builds covers exactly this pattern.

[WARN] Unable to checkout github.com/[org]/[repo]
[ERROR] Update failed ... Unable to get repository

Steps

1. Create a GitHub deploy key (or token) for the private repo and store it encrypted where the build can fetch it (e.g. Cloud Storage).
2. In an early build step, fetch the key and add GitHub to known_hosts.

3. Run the git operations (clone, glide install) using the injected key.

   Expected: the private repo fetches. Success check: glide install completes without the checkout errors.

When to use this

• Cloud Build, Go project depending on a private GitHub repo.
• Errors like "Host key verification failed", "Could not read from remote repository", or "could not read Username for 'https://github.com'".

When NOT to use this

• Public repos; no credentials needed.
• Non-Cloud Build CI; the injection mechanism differs.

Compatibility

• Google Cloud Build with the git builder; follow Google's encrypted-files tutorial for the key handling.

Variant phrasings

• "cloud build private github repo"
• "cloud build glide install private repo"
• "cloud build git host key verification failed"

Root cause

Build steps run with the build service account, which has no GitHub credentials, so both SSH and HTTPS clones fail in their characteristic ways.

Edge cases

• Never bake the key into the image or repo; fetch it at build time from encrypted storage.

In the thread Access a private GitHub repository from a Cloud Build step (glide install fails), the question was: A Go project (A) depended on another private GitHub repository (B), and the Cloud Build pipeline could not fetch it. glide install failed with: [WARN] Unable to checkout github.com/avi/api, [ERROR] Update failed for github.com/avi/api: Unable to get repository. Cloning directly with the git builder failed too: SSH clone failed with "Host key verification failed / Could not read from remote repository", and HTTPS clone failed with "could not read Username for 'https://github.com': No such device or address". The build service account had no credentials for GitHub. The verified resolution: Cloud Build steps have no GitHub credentials by default, so private repos are unreachable until you inject them. The recommended approach is to store a deploy key or token encrypted and pull it into the build: keep the SSH key in Cloud Storage, fetch it in an early build step, then use it for git operations (add GitHub to knownhosts to avoid the host-key verification failure). Google published a tutorial on using encrypted files in builds covering exactly this pattern. This resolved the reporter's glide/private-repo failures. Original discussion: https://vectle.com/threads/thrug35OVIWokBJ45IwGV3y8Q