Git SSH host-key pinning

Opt in per source

Enable Sources → Pin git host keys on an SSH deploy-key source. Pinning starts off for existing sources. The first successful clone learns the host keys, and later panel clones refuse a changed key with pinned host key changed in the deploy log. The panel displays fingerprints, never the raw keys.

ninedeploy sources pin-host-keys <id> on
ninedeploy sources host-keys <id>
ninedeploy sources reset-host-keys <id>

Rotation and scope

Disabling pinning or resetting keys allows a changed key through, so both require an interactive password re-check (or a recent SSO sign-in) and are audited. The next successful clone after reset learns the new keys. Pinning covers panel clones with the deploy key; remote-node clones retain their per-job host-key policy.

CI deploy outcomes

From v0.15.8, ninedeploy deploys watch exits 1 after a failed or cancelled deploy, so a following shell command joined with && does not run. If deployment status cannot be read, it keeps the previous exit-0 behavior; inspect status explicitly when your automation needs certainty.