Repository Access
10 incident problems about Repository Access. Start with the reviewed ones.
Read first
When the CI cache restores the wrong dependency graphAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when package.json, the lockfile, and artifacts no longer agree even after a cache hit.CI/CD3 min readWhen GitHub Actions succeeds but only the rollout failsAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the build logs look fine but the failure surfaces only on the target deploy cluster or runtime.CI/CD3 min readThe checking order when GitHub Actions succeeds but only the deploy failsAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the workflow is green but the failure happens only in the rollout, promotion, or health check stage.CI/CD3 min read
Recommended problems
Reviewed problems first, then problems with detailed scenarios.
git push rejected (fetch first): a push that worked 30 minutes agogit push rejected (fetch first): a push that worked 30 minutes ago is a hands-on troubleshooting drill. Know what 'fetch first' means and why --force is the wrong fix. repository-access needs to be checked by narrowing scope, recent change, and the current live signal before r...ReviewedCI/CDBeginner3 minFreeCICD-1191Private submodule checkout breaksA team copies a public submodule checkout recipe. The main repo checks out cleanly, but private submodules fail depending on whether the SSH agent was configured before or after checkout.CI/CDIntermediate22 minPro
All problems (10)
git push rejected (fetch first): a push that worked 30 minutes agogit push rejected (fetch first): a push that worked 30 minutes ago is a hands-on troubleshooting drill. Know what 'fetch first' means and why --force is the wrong fix. repository-access needs to be checked by narrowing scope, recent change, and the current live signal before r...ReviewedCI/CDBeginner3 minFreeCICD-1191Private submodule checkout breaksA team copies a public submodule checkout recipe. The main repo checks out cleanly, but private submodules fail depending on whether the SSH agent was configured before or after checkout.CI/CDIntermediate22 minProSECURITY-1212Secret was revoked quickly but scanners keep firingA token leak is revoked and replaced promptly, but secret scanning continues to alert for days.SecurityIntermediate16 minProCICD-1225Token-based checkout works but post-job cleanup failsA pipeline migrates from SSH keys to token auth and later starts failing after the main work is already done.CI/CDAdvanced18 minProCICD-1230A private action resolves in one repository but fails in anotherTwo repositories call the same private action, but only one starts failing after security policy changes at the org level.CI/CDAdvanced20 minProCICD-1202Deploy key works for one checkout path but package restore still fails on a second private repositoryOne private repository is accessible, yet restore still breaks because a second dependency path needs a different credential scope than the first successful checkout.CI/CDAdvanced23 minProCICD-1213Private submodules still failToken-based checkout works, yet private submodules still attempt SSH and fail.CI/CDIntermediate19 minProCICD-1217Workflow passes on hosted runners but fails on self-hostedA workflow that looked portable breaks only after the team routes it to self-hosted infrastructure.CI/CDIntermediate19 minProCICD-1209Self-hosted runner says a required secret is missing after the workflow moved behind a reusable callThe secret exists centrally, but the called workflow still fails because the new call contract no longer matches how the secret is declared.CI/CDIntermediate20 minProCICD-1196Checkout succeeds but dependency fetch from a private submodule still fails under the package managerThe repository itself checks out, yet the build fails when a package manager attempts to read a private submodule path with a different auth path than the initial checkout.CI/CDIntermediate22 minPro