Custom Git over SSH: deploy aborts at ssh-keyscan under set -e for hosts that don't answer it (e.g. Hugging Face) #4604

To Reproduce

1. On any host with OpenSSH, confirm the trigger:

   ssh-keyscan hf.co      ; echo "exit=$?"   # exit=1, no output
   ssh-keyscan github.com ; echo "exit=$?"   # exit=0, prints keys

2. In Dokploy, create an Application or Compose with Provider = Git (generic), an SSH URL [email protected]:<org>/<repo>, branch main, and an SSH key.
3. Deploy.

Current vs. Expected behavior

Current: the deploy aborts immediately. The per-deploy log shows only Initializing deployment / Error occurred, and git clone never runs.

Root cause: cloneGitRepository (packages/server/src/utils/providers/git.ts) builds the clone script starting with set -e and includes ssh-keyscan -p <port> <host> >> known_hosts;. Hugging Face's SSH endpoint does not answer ssh-keyscan — it waits for the client's SSH identification string before sending its own, while ssh-keyscan waits for the server's, so the probe never completes and exits 1 with no output. Under set -e that aborts the whole script before git clone. The clone itself is fine: a real ssh/git client sends its banner first, so hf.co responds (which is why ssh -T [email protected] and a manual git clone both work).

Minimal repro of the abort, no Dokploy needed:

sh -c 'set -e; ssh-keyscan hf.co >> /tmp/kh; echo REACHED-CLONE'   # REACHED-CLONE never prints

GitHub/GitLab/Gitea are unaffected — their endpoints answer ssh-keyscan normally.

Expected: a host that doesn't answer ssh-keyscan should not make deploys impossible. ssh-keyscan is a best-effort convenience; the clone's own host-key verification is the real boundary.

Provide environment information

Dokploy version: 0.29.8
Host/target: Ubuntu 24.04, x86_64; OpenSSH 9.6, git 2.43, git-lfs 3.4.1
Provider: Custom Git over SSH ([email protected]:<org>/<repo>)
App type: Compose and Application (shared cloneGitRepository path)

Which area(s) are affected? (Select all that apply)

Application, Docker Compose, Remote server

Are you deploying the applications where Dokploy is installed or on a remote server?

Both (the affected cloneGitRepository path is shared)

Additional context

docker service logs dokploy shows Error getting git commit info: exit 128, but that is a red herring — git log -1 running on a code directory that was never cloned. HF publishes static known_hosts entries precisely because scanning hf.co does not work: https://huggingface.co/docs/hub/security-git-ssh#huggingfaces-ssh-key-fingerprints

Will you send a PR to fix it?

Yes