git@github.com: Permission denied (publickey). with fatal: Could not read from remote repository. means the SSH connection reached GitHub but no key that GitHub accepts was offered. Create an SSH key, add its public half to your GitHub account, and clone again.

The first half runs on your machine: ssh-keygen writes a private key and a .pub file. The second half, pasting the .pub file into your account's SSH keys settings, is yours to do in GitHub; it could not be run in this test.

The error

$ git clone git@github.com:octocat/Hello-World.git < /dev/null
Cloning into 'Hello-World'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
exit=128

Why it happens

The clone ran in a fresh container whose known_hosts already held GitHub's host key (fetched with ssh-keyscan), so the server was trusted, but there was no ~/.ssh key to present. Over SSH, GitHub asks for a key even for a public repository like octocat/Hello-World, and with none to offer the server refused with Permission denied (publickey). The repository exists and is public; the lines about access rights are Git's generic text for a failed transport.

Generating a key alone does not change the answer. In the same container, a key was created and the clone was run again with the identical result: the key had not been added to any GitHub account.

The fix

$ ssh-keygen -t ed25519 -C "maria.garcia@example.test" -N "" -f ~/.ssh/id_ed25519 2>&1 | sed 's/SHA256:[A-Za-z0-9+/]*/SHA256:(fingerprint)/'
Generating public/private ed25519 key pair.
Your identification has been saved in /root/.ssh/id_ed25519
Your public key has been saved in /root/.ssh/id_ed25519.pub
...
$ ls ~/.ssh
id_ed25519
id_ed25519.pub
known_hosts
$ git clone git@github.com:octocat/Hello-World.git < /dev/null
Cloning into 'Hello-World'...
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.
...

The sed in the test only hides the new key's fingerprint; drop it on your own machine. The file to upload is id_ed25519.pub; the file without the suffix is the private key and stays on the machine. The last clone above still fails because the key was not added to any account in this test. Adding the contents of id_ed25519.pub under your GitHub account's SSH keys settings is the step that remains, and it is the reader's step.

For a public repository you only want to read, a second route is the HTTPS URL, https://github.com/octocat/Hello-World.git, which was not run here.

How it was reproduced

In a throwaway alpine container with git 2.54.0 and OpenSSH_10.3p1 installed by apk add --no-cache git openssh-client: GitHub's ED25519 host key fetched with ssh-keyscan and appended to known_hosts, no SSH key, then git clone of octocat/Hello-World over SSH with input closed; then a key generated with ssh-keygen and the clone repeated. No credential was sent and no account was used; the container was removed afterwards.

Frequently asked

How do I fix git@github.com: Permission denied (publickey)?
Create a key with ssh-keygen -t ed25519, add the contents of the .pub file to your GitHub account's SSH keys, and run the clone again.
Why do I get Permission denied (publickey) cloning a public repository?
In this test GitHub refused an SSH clone of a public repository because no key was offered. Over SSH a key is needed; the HTTPS URL is the other route for reading a public repository.
I generated an SSH key but still get Permission denied (publickey). Why?
In this test a freshly generated key gave the same error, because the public key had not been added to a GitHub account. Upload the .pub file, not the private key.

The error that comes before this one in a fresh environment is Host key verification failed. More decoded errors in the Fixes category.