you could write a

pull

step to do this though i think

@Marvin here is my prefect.yaml file:

# Prefect deployment configuration for ingest-mongotoy workflow
# Generated using Python

build: null
push: null
pull: null
deployments:
- name: deployment-ingest-mongotoy-prod-daily
  flow_name: ingest-mongotoy
  entrypoint: workflows/ingestion/ingest-mongotoy/src/ingest_mongotoy/_flows.py:flow_main
  pull:
  - prefect.deployments.steps.git_clone:
      id: clone-step
      repository: <https://github.com/myorg/my-repo.git>
      branch: main
      credentials: '{{ prefect.blocks.github-credentials.my-repo }}'
  - prefect.deployments.steps.run_shell_script:
      id: install-uv
      script: pip install uv
  - prefect.deployments.steps.run_shell_script:
      id: seed-git-creds
      # This avoids prompting and makes any git+https fetch use the token
      script: |
        git config --global url."<https://x-access-token>:${GITHUB_TOKEN}@github.com/".insteadOf "<https://github.com/>"
        git config --global url."<https://x-access-token>:${GITHUB_TOKEN}@github.com/".insteadOf "<ssh://git@github.com/>"
        git config --global url."<https://x-access-token>:${GITHUB_TOKEN}@github.com/".insteadOf "git@github.com:"
      env:
        GITHUB_TOKEN: "{{ prefect.blocks.github-credentials.my-repo.token }}"
      expand_env_vars: true
  - prefect.deployments.steps.run_shell_script:
      id: uv-sync
      script: 'uv export --format requirements.txt --locked --no-dev  --output-file
        requirements.txt

        uv pip install --system -r requirements.txt

        uv pip install --system .'
      directory: '{{ clone-step.directory }}/workflows/ingestion/ingest-mongotoy'
  work_pool:
    name: managed-workpool
    work_queue_name: null
    job_variables:
      image: prefecthq/prefect:3-python3.11

It seems the seed-git-creds is not working. I get the following error: fatal: could not read Username for 'https://github.com': terminal

Short answer: I can’t search Slack history directly from here, so I don’t have visibility into past Slack threads. If it helps, here are a couple of relevant resources outside Slack that cover the same scenario (installing a private GitHub package with managed work pools in Prefect 3.x): - GitHub discussion: Installing dependencies from a private repository for git/pull deployments - Prefect GitHub integration docs (credentials, cloning private repos): Prefect GitHub Integration If you’re looking for “how to do it” right now, a common pattern in Prefect 3.x managed work pools is: - Use deployment steps to: - clone your code (or a repo containing a requirements file) with credentials - pip install your private package using a token provided via an environment variable - Store the GitHub token in a Prefect variable/secret or set it as an env var on the deployment/work pool, then reference it in steps so it isn’t hard-coded. Example

prefect.yaml

deployment snippet:

deployments:
  - name: my-deploy
    entrypoint: flows/my_flow.py:flow
    work_pool:
      name: my-managed-pool
    # Ensure GITHUB_TOKEN is provided via Prefect Variables/Secrets or job env
    steps:
      - pull.git_clone:
          repository: <https://github.com/org/private-flow-repo.git>
          branch: main
          access_token: "{{ env.GITHUB_TOKEN }}"
      - utility.run_shell_script:
          # Install private package via git+https using the token
          script: |
            pip install "git+https://:${GITHUB_TOKEN}@github.com/org/private-package.git@v1.2.3#egg=privatepkg"

Notes: -

pull.git_clone

supports

access_token

(or

credentials

) for private repos. - You can also install from a requirements.txt that contains a git+https line and run

utility.pip_install_requirements

. - Prefer referencing a token from an env var/Prefect variable rather than embedding it in the YAML. If you want me to try to locate a specific Slack thread, can you share any keywords, approximate dates, or who posted in it? I can suggest targeted search queries you can run in Slack (e.g., “managed work pool private github pip”, “git+https token Prefect”, “pip install private repo managed pool”).

Thanks for sharing the

prefect.yaml

and the error. The symptom

could not read Username for '<https://github.comhttps://github.com>'

usually happens when a Git URL rewrite rule is misconfigured and ends up rewriting to a duplicated prefix. In your snippet I also see angle brackets around URLs (e.g.,

<https://github.com/>

). If those angle brackets are in the actual file, Git will treat them literally and the rewrite can go sideways, leading to exactly this kind of duplication. A couple of fixes: 1) Remove angle brackets from the git config lines Make sure your

seed-git-creds

script sets the rewrite rules without `< >`:

- prefect.deployments.steps.run_shell_script:
    id: seed-git-creds
    script: |
      set -eux
      # Rewrite any GitHub fetch to include the token
      git config --global url."<https://x-access-token:${GITHUB_TOKEN}@github.com/>".insteadOf "<https://github.com/>"
      git config --global url."<https://x-access-token:${GITHUB_TOKEN}@github.com/>".insteadOf "<ssh://git@github.com/>"
      git config --global url."<https://x-access-token:${GITHUB_TOKEN}@github.com/>".insteadOf "git@github.com:"
      # Optional: show resulting rules for debugging
      git config -l --show-origin | grep '^file:.*url\.' || true
    env:
      GITHUB_TOKEN: "{{ prefect.blocks.github-credentials.my-repo.token }}"
      GIT_TERMINAL_PROMPT: "0"
    expand_env_vars: true

2) Confirm where the error occurs - If

git_clone

is succeeding (you’re already passing a GitHub credentials block), the failure is likely during the

uv pip install

step when it tries to fetch VCS dependencies (git+https/ssh). The above rewrite covers both https and ssh forms. - If the failure is during the

git_clone

step, you can also pass the token directly via `access_token`:

- prefect.deployments.steps.git_clone:
      id: clone-step
      repository: <https://github.com/myorg/my-repo.git>
      branch: main
      access_token: "{{ prefect.blocks.github-credentials.my-repo.token }}"

or keep

credentials:

if your GitHub credentials block is registered and available. 3) Quick sanity test Add a temporary test step right after seeding to ensure the rewrite works for a private repo you need to access:

- prefect.deployments.steps.run_shell_script:
    id: test-git-access
    script: |
      set -eux
      git ls-remote <https://github.com/myorg/some-private-repo.git> -h | head -n1 || exit 1
    env:
      GITHUB_TOKEN: "{{ prefect.blocks.github-credentials.my-repo.token }}"
      GIT_TERMINAL_PROMPT: "0"

Questions to confirm: - Are the angle brackets actually present in your

prefect.yaml

, or did Slack add them when you pasted? - Does the error happen during the

git_clone

step or during the

uv pip install

step? - Do your requirements/pyproject include

<git+ssh://git@github.com/>...

or

git+<https://github.com/>...

private repos? The above rules handle both, but it helps to confirm.