搭建CI工具时，多SSH密钥下如何便捷克隆GitHub/GitLab仓库？

Great question! Since you're building a CI tool that needs to handle unique SSH keys for each repo without messing with global config or heavy Docker setups, here are the most straightforward approaches tailored to your use case:

1. Use the GIT_SSH_COMMAND Environment Variable #

This is the simplest, most direct method for ad-hoc cloning with a specific key. Git lets you override the default SSH command via this variable, so you can specify the exact key file to use for each clone operation.

How to implement it: #

1. Retrieve the SSH private key from your database and write it to a temporary file (make sure to set file permissions to 600 — SSH will reject keys with open permissions):

   echo "$PRIVATE_KEY_FROM_DB" > /tmp/temp_key
   chmod 600 /tmp/temp_key
   

2. Run the clone command with the custom SSH command:

   GIT_SSH_COMMAND="ssh -i /tmp/temp_key -o IdentitiesOnly=yes" git clone git@github.com:username/target-repo.git
   

   • The -i flag tells SSH to use your temporary key file.
   • -o IdentitiesOnly=yes ensures SSH doesn't try to use other keys (like your global id_rsa) which could cause authentication failures or permission issues.

3. After cloning, delete the temporary key file to avoid leaving sensitive data lying around:

   rm /tmp/temp_key
   

2. Generate a Temporary SSH Config File #

If you need more control (e.g., handling multiple hosts or additional SSH options), you can create a one-off SSH config file and tell SSH to use it instead of the global ~/.ssh/config.

How to implement it: #

1. Create a temporary config file with the repo-specific settings:

   cat > /tmp/temp_ssh_config << EOF
   Host github-clone-target
       HostName github.com
       User git
       IdentityFile /tmp/temp_key
       IdentitiesOnly yes
   EOF
   

2. Write your private key to /tmp/temp_key (again, set permissions to 600).
3. Clone using the custom config:

   git clone git@github-clone-target:username/target-repo.git
   

4. Clean up the temporary files once done:

   rm /tmp/temp_key /tmp/temp_ssh_config
   

Key Recommendations for Your CI Tool #

• Prefer GIT_SSH_COMMAND for most cases: It’s lighter, requires no extra config file setup, and works perfectly for single-clone operations.
• Always secure temporary key files: Setting chmod 600 is non-negotiable — SSH will refuse to use keys that are readable by other users.
• Clean up immediately: Don’t leave temporary key files on disk longer than necessary to minimize security risks.

Since you’re only reading the cloned code (not executing anything), these methods are completely safe and avoid the overhead of Docker while solving your multi-key problem efficiently.

内容的提问来源于stack exchange，提问作者Nicolas Beauvais