Git ls-remote command fails when trying to query references from a remote repository, typically due to authentication issues, network problems, or incorrect repository URLs.
The `git ls-remote` command is used to display references (branches, tags) available in a remote repository along with their commit IDs. This error occurs when Git cannot establish a connection to query the remote repository, which is often the first step in operations like cloning, fetching, or in CI/CD pipelines validating repository access. This failure typically manifests in automated environments like Jenkins, GitHub Actions, or CircleCI where credentials need to be properly configured. The command may fail with various exit codes (commonly 128) indicating that Git was unable to authenticate, reach the remote server, or parse the repository URL correctly. The error is particularly common when migrating between authentication methods (password to token), configuring new CI systems, or when network proxies interfere with Git operations.
First, confirm Git is installed and in your system PATH:
git --version
which git # On Linux/Mac
where git # On WindowsIn Jenkins, check: Manage Jenkins → Global Tool Configuration → Git and ensure the Git path is correct (e.g., C:\Program Files\Git\bin). If Git isn't installed, install it on your server:
# Ubuntu/Debian
sudo apt-get update && sudo apt-get install git
# CentOS/RHEL
sudo yum install git
# macOS
brew install gitTry running ls-remote manually to see the exact error:
git ls-remote https://github.com/username/repo.git
# Or for SSH
git ls-remote [email protected]:username/repo.gitThis will reveal whether it's an authentication, network, or URL issue.
If working with multiple repositories in GitHub Actions, set persist-credentials: false:
- uses: actions/checkout@v4
with:
persist-credentials: falseThis prevents the default GITHUB_TOKEN from interfering with authentication to secondary repositories.
Check and update cached credentials:
Windows:
1. Open Control Panel → Credential Manager → Windows Credentials
2. Find your Git credentials under Generic Credentials
3. Edit or remove outdated credentials
Linux/Mac:
# Check current credential helper
git config --global credential.helper
# Clear cached credentials
git credential-cache exit
# Or for specific helper
git credential-osxkeychain eraseFor GitHub: Remember that password authentication was removed August 2021. Use personal access tokens instead.
If using tokens, the correct HTTPS URL format is:
git ls-remote https://username:[email protected]/username/repo.git
# NOT: https://token:[email protected]/...Or configure Git to use the token as password:
git config --global credential.helper store
git ls-remote https://github.com/username/repo.git
# Enter username and paste token as password when promptedRemove or correct proxy settings that may block Git:
# Check current proxy settings
git config --global --get http.proxy
git config --global --get https.proxy
# Remove proxy if not needed
git config --global --unset http.proxy
git config --global --unset https.proxy
# Or check ~/.gitconfig for proxy settings
cat ~/.gitconfigAlso check environment variables:
unset http_proxy
unset https_proxyFor SSH URLs, ensure your SSH key is properly configured:
# Test GitHub SSH connection
ssh -T [email protected]
# Check SSH agent has keys loaded
ssh-add -l
# Add your SSH key if needed
ssh-add ~/.ssh/id_rsaCheck .git/config to ensure the remote URL is correct:
cat .git/config
# Verify [remote "origin"] url is correctOlder Git versions may have TLS compatibility issues:
# Check current version
git --version
# Update Git (Ubuntu/Debian)
sudo apt-get update && sudo apt-get upgrade git
# Update Git (macOS)
brew upgrade git
# Update Git (Windows)
# Download latest from https://git-scm.com/downloadsCI/CD Environment Considerations:
In containerized CI environments, avoid including the .git/ directory in Docker images as cached credentials can cause authentication failures.
Jenkins-Specific Configuration:
When using Jenkins with Git plugins, the repository URL field must exactly match the format your credentials expect. If credentials are configured for HTTPS, don't use SSH URLs and vice versa.
GitHub Actions Workflow Security:
The persist-credentials: false setting is particularly important in workflows that interact with multiple repositories or need to authenticate with different credentials mid-workflow. The default GITHUB_TOKEN has limited scope and may not work for operations on secondary repos.
Firewall and Network Policies:
Corporate networks may block Git protocols on non-standard ports. Ensure outbound connections are allowed on:
- HTTPS (port 443) for HTTPS URLs
- SSH (port 22) for SSH URLs
- Consider using HTTPS URLs instead of SSH in restricted environments
Credential Storage Security:
When using credential helpers in CI, prefer short-lived tokens or environment variables over stored credentials. Rotate tokens regularly and use minimal permission scopes.
kex_exchange_identification: Connection closed by remote host
Connection closed by remote host when connecting to Git server
fatal: unable to access: Proxy auto-configuration failed
How to fix 'Proxy auto-configuration failed' in Git
fatal: unable to access: Authentication failed (proxy requires basic auth)
How to fix 'Authentication failed (proxy requires basic auth)' in Git
fatal: unable to access: no_proxy configuration not working
How to fix 'no_proxy configuration not working' in Git
fatal: unable to read tree object in treeless clone
How to fix 'unable to read tree object in treeless clone' in Git