for transformation, it is possible to have private repo (so I have to use token/user+pass)?

for the moment in the docs, we recommend using token/user+pass yes: https://docs.airbyte.io/operator-guides/transformation-and-normalization/transformations-with-airbyte#private-git-repository

Yeah, we wouldn't need to tunnel so should be relatively straight forward, e.g.

GIT_SSH_COMMAND='ssh -i <path_to_key_file> -o IdentitiesOnly=yes' git clone git@github.com:<private_repo>

where user provides the ssh key in UI and we temp save to

<path_to_key_file>

to run that command