Git

SPACE uses the native JupyterLab Git integration for source control of Python projects, scripts, notebooks, and related files.

This Git workflow is intended for files in the SPACE Python workspace. It is separate from the Planning Analytics Git integration, which manages IBM Planning Analytics model assets.

Repository workflow

Use a Git repository for Python files that should be versioned or shared between developers.

A single repository for the client Python workspace is the recommended starting point. git is a suggested repository folder name, but the repository can use another folder when required by the project.

Use the JupyterLab Git interface for normal repository operations such as:

• reviewing changed files;
• staging changes;
• committing;
• pulling remote changes;
• pushing commits;
• working with branches.

Because SPACE uses the native Git extension, developers can use familiar Git concepts without a separate SPACE-specific source-control workflow.

Authentication

Private repositories require Git credentials to be configured for the SPACE Python environment.

For SSH-based authentication, use a dedicated SSH key for the SPACE installation and grant its public key the appropriate repository access in the Git hosting platform.

Succeedium-managed SPACE environments can have this configuration managed as part of the deployment. Administrators of client-managed SPACE installations can configure it using the server-side files described below.

Client-managed SPACE configuration

For client-managed installations, keep Python Git configuration under:

config/python/git/
├── .gitconfig
├── id_ed25519
├── id_ed25519.pub
├── known_hosts
└── ssh_config

This keeps the Git configuration outside the SPACE application image and separates it from application source code.

The directory can be mounted read-only into the Python service:

volumes:
  - ./config/python/git:/space-git:ro

environment:
  GIT_CONFIG_GLOBAL: /space-git/.gitconfig
  GIT_SSH_COMMAND: "ssh -F /space-git/ssh_config"

GIT_CONFIG_GLOBAL tells Git to use the installation-specific global configuration.

GIT_SSH_COMMAND directs Git SSH operations through the supplied SSH configuration.

Generate an SSH key

On the SPACE server, generate a dedicated Ed25519 key pair for Git access:

ssh-keygen -t ed25519 -f ./config/python/git/id_ed25519

Use an appropriate deployment-specific comment or key-management convention if required by your organization.

Add the generated public key, id_ed25519.pub, to the Git provider or repository with only the permissions required by the SPACE environment.

Keep the private key on the SPACE server.

SSH configuration

Configure ssh_config to use the mounted key for the required Git host. For example:

Host github.com
    HostName github.com
    User git
    IdentityFile /space-git/id_ed25519
    IdentitiesOnly yes
    UserKnownHostsFile /space-git/known_hosts

Replace the host when using another Git provider.

Populate known_hosts with the verified SSH host key for the Git provider according to your organization's security process.

Git identity

Use .gitconfig to configure the Git identity and other installation-level settings required for commits.

For example:

[user]
    name = SPACE
    email = space@example.com

Use an identity appropriate for the client environment and repository workflow.

Security

Treat the SSH private key as an infrastructure credential.

• keep it under the local SPACE server configuration;
• do not commit it to the SPACE application repository or client Python repository;
• do not bake it into a Docker image;
• mount the Git configuration read-only where possible;
• grant the key only the repository permissions the environment requires.

SPACE Python secrets are intended for credentials consumed by Python code at runtime. Git SSH authentication is infrastructure configuration used by Git itself, so the SSH private key should remain in the server-side Git configuration rather than being retrieved by Python code as a SPACE secret.