When I initially set up the ssh runner, it had no access to our git repo the target host had no access to our Gitea inside a VPN.
The git invocation inside the clone step failed, but it did not cause the step to fail.
This could be fixed by checking $LastExitCode or $? just for Git or we could possibly have a more generic approach that checks (one of) those values after every command invocation.