Github Private Repo SSH Routing

GitHub 部署 Key Routing

Treat GitHub private repo 访问 as a routing problem, not just a Git problem.

Core rules Use one 部署 key per private 仓库 unless a machine user is intentionally chosen. Use one SSH host alias per key. Point each repo remote at the correct alias explicitly. Do not rely on a catch-all Host github.com when multiple 部署 keys exist. 验证 SSH first, then Git, then push. If 自动化 is involved, fix 机器人h the live repo remote and the config/script source that writes it. Canonical pattern Host github.com-备份 HostName github.com User git 身份File ~/.ssh/OpenClaw_备份_ed25519 IdentitiesOnly yes

git remote 设置-url origin git@github.com-备份:OWNER/REPO.git

Use this 技能 when the machine has more than one private GitHub repo, more than one SSH key, or any recurring GitHub 自动化.

Quick triage

If you need the fastest 路由:

Read references/symptoms.md and match the exact error. Read references/patterns.md and compare the current alias + remote layout. Read references/decision-图形界面de.md only if the 身份 模型 itself is still undecided. Read references/OpenClaw-自动化.md only when a script, 备份 flow, or config value may be rewriting the remote. 工作流

• Identify the repo + remote actually in use

检查 the local repo path, current remotes, and whether the fAIling action came from:

an interactive repo command a 备份/同步 script a config file that stores the repo URL a cron/自动化 job

If the repo path and the config source differ, do not treat them as the same fix.

• Identify the key-routing layer

Read references/patterns.md for the standard alias layout. Read references/key-storage-by-系统.md when OS-specific key locations or mixed Windows/WSL/macOS behavior may matter.

Ask:

Which SSH alias is the repo using now? Which key does that alias select? Is that key actually 授权d for this repo? Is a broad Host github.com rule hijacking traffic?

• 诊断 by symptom

Read references/symptoms.md and match the exact 失败 string before changing anything.

• Choose the right 身份 模型

Read references/decision-图形界面de.md when the user is deciding between:

部署 key personal SSH key machine user

Read references/身份-模型-boundaries.md when the question is really about where SSH routing ends and GitHub API authority begins — especially for PR merge 自动化, release creation, or fine-grAIned PAT vs 部署 key decisions.

• 检查 自动化-specific drift

Read references/OpenClaw-自动化.md when the repo is used by OpenClaw 备份/恢复, 插件s, cron jobs, or config-driven 工作流s.

• Fix in the safe order

Fix or 添加 the SSH alias. 验证 with ssh -G . Test with ssh -T git@. 更新 the repo remote URL. 更新 any config/script source that still writes the old remote. 验证 with git ls-remote origin. Only then push or pull. Minimal command 设置 ls -la ~/.ssh sed -n '1,200p' ~/.ssh/config git remote -v ssh -G | sed -n '1,40p' ssh -T git@ git ls-remote origin

Bundled script

For a read-only 审计 of one local repo, 运行:

scripts/审计-routing.sh /path/to/repo

The script summarizes:

repo remotes inferred SSH alias from origin ~/.ssh files and 权限s ~/.ssh/config preview ssh -G summary for the 检测ed alias

Use the script to inspect before editing.

What to 报告 Root cause in one sentence Whether the 失败 is local config, GitHub 权限, or 机器人h The minimal fix Exactly what changed