Clone and deploy from a private remote repository

Important: You now have the Deploy tool, an advanced, easy-to-use system that integrates with your GitHub repository. You can find more information in Deploy, the automatic deployment tool from GitHub.

In other articles we have covered deployment strategies, such as creating or cloning a repository from cPanel and even applying changes from that interface.

Today, however, we will look at a different method, since the cPanel interface is not usually the best option when you work with a private remote repository.

In the following example we will clone a private repository hosted on GitHub and pull changes from it when needed.

Requirements

Bear in mind that we will work in the terminal, so you need at least a basic knowledge of how to use it and to enable SSH access on your hosting service.

Once logged in, create an Ed25519 key dedicated solely to this repository. If the file name already exists, choose another; do not overwrite an identity in use:

umask 077
mkdir -p ~/.ssh
ssh-keygen -t ed25519 -f ~/.ssh/github_repositorio_deploy -C "deploy repositorio cpanel"
chmod 600 ~/.ssh/github_repositorio_deploy
chmod 644 ~/.ssh/github_repositorio_deploy.pub

Use a passphrase and an SSH agent when the process allows interaction. If you need to run an unattended pull, the key can be left without a passphrase, but it must stay outside public_html, with 600 permissions, not be reused and have read-only access to a single repository. Show the public key with:

cat ~/.ssh/github_repositorio_deploy.pub

Granting permissions on GitHub

Now we need to allow access from our server to the private repository. On GitHub, go to the repository in question:

• Click Settings in that repository.
• In the side menu, open Deploy keys.
• Click Add deploy key, paste the public key and give it a recognisable title.
• Do not turn on write access if the hosting only needs to clone and update the code.

Set up an alias to force Git to use that identity:

Host github-repositorio
    HostName github.com
    User git
    IdentityFile ~/.ssh/github_repositorio_deploy
    IdentitiesOnly yes

Save the block in ~/.ssh/config, run chmod 600 ~/.ssh/config and first verify GitHub's fingerprint through an independent channel.

To check everything is correct, run this over SSH in your account:

ssh -T git@github-repositorio

If you get output like:

Hi usuario/repositorio! You've successfully authenticated, but GitHub does not provide shell access.

it means authentication is working and we can continue with the steps.

If instead you get Permission denied (publickey)., you do not have permission; go through the process again, as some step must not have been done correctly.

These steps are for GitHub, but other platforms such as Bitbucket have a similar process using SSH key authentication.

Cloning the private repository

Copy the repository URL from the Code button, SSH tab, and replace github.com with the github-repositorio alias you configured earlier.

Clone the repository outside the public directory:

mkdir -p ~/repositories
git clone git@github-repositorio:usuario/repositorio.git ~/repositories/repositorio

Do not clone directly inside public_html: you would expose the .git directory if the web server does not block it. Publish only the files you need using the Deploy tool, .cpanel.yml or a strategy of releases and symbolic links.

Getting the changes

Cloning or updating with Git does not install dependencies or automatically publish a website. To update the clone, first check its status:

cd "$HOME/repositories/repositorio" || exit 1
git status --short
git branch --show-current

If there are local changes or the branch is not the expected one, stop and check where they came from. For the main branch, an update that does not automatically create a merge would be:

git pull --ff-only origin main

Adapt the branch and then run the project's deployment procedure. Do not use git reset --hard to hide a divergence without checking what you would lose.

The read-only key in this example does not allow git push. If you need to recover a change made on the hosting, review it and bring it into your development workflow without widening the deploy key's permission for convenience.

Considerations

Git on our system works just as it does on your local computer. If you want to do without GitHub, you can create a private repository outside public_html and connect your computer to that remote. Also keep any working clone outside the public directory and publish only the files you need to public_html using Deploy, .cpanel.yml or a release strategy. cPanel's Git interface lets you manage this workflow.

GitHub's ssh -T test may finish with exit code 1 even when it confirms authentication, because it does not offer an interactive shell. Check the message and the authorised repository, not just the exit code.