Source control

Buildkite Pipelines integrates with source control providers to create builds from repository events. Connecting a provider configures the integration for events and build statuses. Depending on the provider and agent type, you might also need to configure credentials so the agent can clone private repositories.

Connect a source control provider

Configure access to private repositories

Choose a repository authentication method based on where your agents run and which provider connection you use:

  • Buildkite hosted agents with GitHub, Origin, or Code Storage: Repository access is included when you connect the full-access GitHub App, an Origin repository, or a Code Storage repository. See Buildkite hosted agent code access.
  • Buildkite hosted agents with Entire: Connect an Entire project and select a repository. Checkout credentials are automatic, and the connection adds the Entire checkout plugin by default. See Entire hosted-agent checkout.
  • Self-hosted agents with Entire: An organization administrator can turn on Allow self-hosted agents to use checkout credentials in the Entire connection's Settings panel. Otherwise, supply your own ENTIRE_TOKEN in an agent environment hook. The checkout plugin installs the Git remote helper on Linux amd64 and arm64. See Entire self-hosted checkout for setup and runtime requirements.
  • Self-hosted agents with GitHub or GitHub Enterprise Server: Enable Buildkite-managed GitHub App token checkout on a queue to use temporary, read-only credentials without installing SSH keys or GitHub App private keys on your agents. Requires an App integration with code access.
  • SSH key stored in Buildkite Secrets: This is the recommended SSH-based option for the Limited Access GitHub App and providers without native repository access. Follow the instructions for self-hosted agents or Buildkite hosted agents.
  • SSH key stored on an agent machine: Self-hosted agents can use keys in the agent user's ~/.ssh directory. See Managing SSH keys on agent machines.
  • Customer-managed GitHub App installation access token: If you need to manage your own GitHub App, self-hosted agents can generate a short-lived token in a pre-checkout hook. Unlike managed queue credentials, this requires your own App private key and token-generation hook. See Using GitHub App installation access tokens.