Short answer: there isn’t a public Python helper for that yet. The easiest “Python equivalent” is to shell out to the same CLI and capture the token. Here’s a minimal example using subprocess (assumes you’re already authenticated to Prefect Cloud in your environment, e.g., via

PREFECT_API_KEY

or

prefect cloud login

):

import subprocess

repo = "bild-ai/estimator"
cmd = ["uv", "tool", "run", "prefect-cloud", "github", "token", repo]

result = subprocess.run(cmd, check=True, capture_output=True, text=True)
token = result.stdout.strip()

print("GitHub token:", token)

A couple of clarifying questions so I can offer a pure-HTTP example if you prefer: - Are you looking for a direct REST call (no subprocess) to Prefect Cloud to mint the GitHub App installation token? - If so, which Prefect Cloud region are you on and do you have your account/workspace IDs handy? The endpoint path depends on those, and I can give you a ready-to-run

requests

snippet once I have that.

In short: exit code 128 is Git’s generic “fatal” error. Prefect failed when it tried to

git clone

your repo. The underlying cause is almost always one of the following: Most common causes - Authentication failed - Private repo and no credentials provided - Token missing/expired/insufficient scopes (needs at least read:contents) - GitHub App not installed on that repo/org, or not granted access to that repo - Git is not available in the runtime image (common on slim containers) - Network/DNS/egress issues reaching github.com - SSH vs HTTPS mismatch (e.g., repo URL is HTTPS but only SSH keys are configured) - Submodules require separate auth and fail during clone - Repo/branch/tag doesn’t exist or is misspelled - GitHub rate limiting (unauthenticated clones hit low limits) How to quickly diagnose 1) Look for Git’s stderr in the worker logs — it usually says exactly why (e.g., “Repository not found”, “Authentication failed”, “Could not resolve host: github.com”). - If you can, share the exact stderr line so I can be precise. 2) Exec into the same runtime (pod/container/VM) that is failing and run:

git --version
git ls-remote <https://github.com/org/my-repo.git>

- If private: test with a token

git ls-remote https://<TOKEN>@github.com/org/my-repo.git

Replace <TOKEN> with a valid GitHub PAT or a short‑lived GitHub App token and confirm it works. 3) Verify your Prefect deployment/source config - If you’re using Prefect 3.x deployments from source, ensure your

prefect.yaml

source:

points at the correct URL/branch and that credentials are available to the worker. - Docs: prefect.yaml reference Fixes by scenario - Private repo over HTTPS - Provide a token to the runtime and ensure it has repo read scope: - Set

GITHUB_TOKEN

in your worker/deployment env, or use your own secret management to export it at runtime. - Or embed the token when testing (don’t commit this):

https://<TOKEN>@github.com/org/my-repo.git

- Using Prefect’s GitHub App integration - Ensure the app is installed on your org and authorized for

org/my-repo

. - Make sure your workspace/project is linked to that repo so Prefect can mint a short‑lived installation token at runtime. - You can verify access by minting a token locally and testing

git ls-remote

with it. - SSH clone - Use the SSH URL (

git@github.com:org/my-repo.git

), mount the private key, and set:

GIT_SSH_COMMAND="ssh -i /path/to/key -o StrictHostKeyChecking=no"

- Ensure

known_hosts

includes GitHub or disable strict checking (only if acceptable for your environment). - Missing git - Add git to your image (examples): - Debian/Ubuntu:

apt-get update && apt-get install -y git

- Alpine:

apk add --no-cache git

- Submodules - Ensure the same credentials work for submodules. You may need to switch submodule URLs to HTTPS and rely on

GITHUB_TOKEN

. If you share: - The full Git error line (stderr) - Whether the repo is private - Your repo URL form (HTTPS vs SSH) - How your deployment’s

source:

is configured and what image your worker uses …I can pinpoint the exact fix and provide the minimal changes needed.

Thanks for the snippet — that helps. What your flow is doing - You mint a short‑lived GitHub App installation token via

uv tool run prefect-cloud github token bild-ai/estimator

. - You pass that value into

GitRepository(..., credentials={"access_token": gh_token})

. - Prefect clones the repo as part of

from_source(...).deploy(...)

. - Git exits with 128, which is a generic fatal error (typically “authentication failed”, “repo not found”, or network). The most likely culprits in this setup - The token is valid but not being used the way Git expects for GitHub App tokens. - The

credentials

dict key doesn’t match the expected schema (safer to use

GitCredentials

directly). - The branch

dev

does not exist or the repo URL has angle brackets accidentally included in code. - Git isn’t present in the runtime image (less likely if the error is during deploy on your local machine). Two reliable ways to pass the token 1) Use Prefect’s GitCredentials object (recommended to avoid dict key mismatches)

from prefect.storage import GitRepository, GitCredentials

repo = GitRepository(
    url="<https://github.com/bild-ai/estimator.git>",  # ensure no angle brackets in code
    branch="dev",
    credentials=GitCredentials(access_token=gh_token),
)

2) Embed the token in the URL using the GitHub App pattern GitHub App installation tokens work best with Basic auth using the username

x-access-token

and the token as the password:

safe_url = f"<https://x-access-token:{gh_token}@github.com/bild-ai/estimator.git>"

repo = GitRepository(
    url=safe_url,
    branch="dev",
)

Note: keep this out of logs; don’t print the full URL. Quick checks to pinpoint the error - Verify the token works with Git directly from the same environment:

git ls-remote <https://x-access-token:<TOKEN>@github.com/bild-ai/estimator.git>

If this fails, the app likely isn’t installed for that repo, or the token isn’t what we expect. - Confirm the branch exists:

git ls-remote --heads <https://x-access-token:<TOKEN>@github.com/bild-ai/estimator.git> dev

- Turn on Git debug to capture the real error:

import os
  os.environ["GIT_TRACE"] = "1"
  os.environ["GIT_CURL_VERBOSE"] = "1"

Then re-run your deploy and check stderr in the logs. The message usually says “Authentication failed”, “Repository not found”, or “Could not resolve host”. Common gotchas with GitHub App tokens - They expire quickly (~1 hour). If there’s a delay between minting and cloning, it can fail. - The GitHub App must be installed on the org and granted access to

bild-ai/estimator

. - For Git over HTTPS,

x-access-token:<token>

is the most reliable approach. If you can share the exact Git stderr line (from the Prefect logs around the clone), I can zero in on the exact fix. Docs for context: prefect.yaml reference