Private repo access

Configure credentials so that agentregistry can read manifests and clone source code from private GitHub or GitLab repositories.

To deploy an agent or MCP server to a runtime, you must provide a container image. However, you can also add a reference to a GitHub or GitLab repository that holds the source code and Dockerfile for your agent or MCP server. Plugins and Skills don’t have a container image option. They use a GitHub or GitLab repository as their primary source instead.

If the git repository is private, you can configure Solo Enterprise for agentregistry with your GitHub or GitLab credentials so that the registry can clone it.

Step 1: Create credentials

Create your GitHub or GitLab credentials to access private repositories. The permissions that you require vary depending on the type of credential that you set up.

Create a GitHub Personal Access Token (PAT). The required permissions depend on the token type.

Token type	Required permissions
Classic PAT	`repo` scope
Fine-grained PAT	Resource owner: The private repo owner. Repository access: Scope to only the repositories that you plan to use. Repository permissions: `Contents: Read`, note that `Metadata: Read` is automatically required.

Save the PAT in an environment variable.
```
export PAT=<github-pat>
```

Create a GitLab Personal Access Token (PAT). The required permissions depend on the token type.
Note: GitLab deploy tokens are not supported. Deploy tokens can authenticate a git clone but cannot access the GitLab REST API, which Solo Enterprise for agentregistry uses during the manifest pre-fetch. Use a Personal Access Token instead.
Token type Required permissions
Classic PAT read_repository scope
Fine-grained PAT Code: Download permission. Note that Code: Read is not sufficient.
Save the PAT in an environment variable.
```
export PAT=<gitlab-pat>
```

Token type	Required permissions
Classic PAT	`read_repository` scope
Fine-grained PAT	`Code: Download` permission. Note that `Code: Read` is not sufficient.

Step 2: Configure credentials

Create a Secret resource with your credentials, then reference it from the credentialsRef field of any Agent, MCP server, Skill, or Plugin manifest that uses a private repository. The Secret must be in the same namespace as the artifact that references it.

Kind	Field path
Agent, MCPServer, Skill	`spec.source.repository.credentialsRef`
Plugin	`spec.source.git.repository.credentialsRef`

Create the Secret.

arctl apply -f- <<EOF
apiVersion: ar.dev/v1alpha1
kind: Secret
metadata:
  name: git-credentials
spec:
  stringData:
    password: $PAT
EOF

arctl apply -f- <<EOF
apiVersion: ar.dev/v1alpha1
kind: Secret
metadata:
  name: git-credentials
spec:
  stringData:
    username: oauth2
    password: $PAT
EOF

Verify that the Secret was created. The response never includes the credential values, only the keys that were stored.

arctl get secret git-credentials -o yaml

Example output:

apiVersion: ar.dev/v1alpha1
kind: Secret
metadata:
  name: git-credentials
spec:
  type: Opaque
status:
  dataKeys:
    - password

Reference the Secret in the manifest of your AI artifact.

spec:
  source:
    repository:
      url: https://github.com/my-org/my-repo
      credentialsRef:
        name: git-credentials

spec:
  source:
    type: git
    git:
      repository:
        url: https://github.com/my-org/my-repo
        credentialsRef:
          name: git-credentials

Next steps

Store agent source code Push your agent source code to a GitHub or GitLab repository and reference it in the registry. Store MCP server source code Push your MCP server source code to a GitHub or GitLab repository and reference it in the registry.

Artifact approval