Overview
The Git Repository connection stores the repository URL and credentials used by Git-backed dbt projects and the Materialize Git Repository flow. Like any Etlworks connection, it is created once, encrypted at rest, and reused across flows.
Git access through this connection is read-only: Etlworks fetches and materializes repository snapshots but never commits, pushes, or merges.
Available in Etlworks 9.9.9 and later.
Connection parameters
- Repository URL: only HTTPS and ssh:// URLs are accepted. Do not include a token or password in the URL — URLs with embedded credentials are rejected, as are git:// and file:// repositories.
-
Authentication:
- none — public anonymous HTTPS repository.
- https — username and access/API token.
- ssh — private-key authentication.
- Username and Token or Password: for HTTPS authentication. Use a least-privilege access token where your Git provider supports it.
- Private Key File: required for SSH. The file must exist on the execution node — the Etlworks host, or the Integration Agent when the flow runs on an agent.
- Private Key Passphrase: optional passphrase for the key.
- Known Hosts File: required for SSH. Host keys are verified against this file; trust-all mode is not supported.
Security model
- HTTPS tokens are supplied to Git through a private askpass mechanism — they never appear in the command line, the URL, or the log.
- SSH keys and known-host files are staged privately for the operation and removed afterward.
- Git runs as an argument vector, not through a shell.
- Materialized project size, file count, timeout, destination root, and path traversal are all bounded and validated.
- Submodules and Git LFS are not silently enabled.