How can I specify a gem to pull from a private github repository?

A

9

69

I have a private repository on Github that I want to use. I deploy my app to Heroku. How can I specify a private repository as the source on my gemfile? I imagine it wouldn't be enough to simply say

gem "mygem", :git=>"my github address"

Amphistylar answered 30/1, 2011 at 1:57 Comment(0)

T

41

As per suggestion from Heroku tech support, the easiest way to do this is by putting the username and password into the URL, as in Basic HTTP Auth, e.g.

gem 'my_gem', :git => 'https://my_username:[email protected]/my_github_account/my_repo.git', :ref => 'revision_no'

This worked for us. This is still somewhat dissatisfying as we had to put a password into the Gemfile. We dealt with this by adding a new github user account and adding that account as collaborator on the gem project. Still not foolproof security, but the impact is more narrow.

Other options I read about are to set up your own gem server or to vendor the gem.

Update 5/16/2012: Another way to get around putting the password into the Gemfile is to put the password into an environment variable; on Heroku you do this with heroku config:add VAR=value, and then in the Gemfile you'd use this variable, e.g.:

gem 'my_gem',
  :git => "https://#{ENV['var_private_gem_username']}:#{ENV['var_private_gem_password']}@github.com/my_github_account.git",
  :ref => 'rev'

This is the standard on Heroku to avoid putting passwords, API keys and any credentials into the code. For local development/test, you can set these environment variables. Or, assuming your development machine is set up for SSH access to github, you won't need the credentials for local development (the SSH credentials will be in effect already). So you could set up some conditional logic:

private_repo_credentials = %w(var_private_gem_username var_private_gem_password).
  map { |var| ENV[var] }.compact.join(':')
private_repo_credentials << '@' unless private_repo_credentials.empty?
# private_repo_credentials will be "" if neither var is set
# private_repo_credentials will be "username:password@" if they are set
gem 'my_gem',
  :git => "https://#{private_repo_credentials}github.com/my_github_account.git",
  :ref => 'rev'

I've not tested this last part. Please provide feedback.

Thorncombe answered 21/1, 2012 at 1:27 Comment(10)

For the ENV approach to work, you'll have to enable a labs addon: heroku labs:enable user_env_compile. Unfortunately, there are still issues with matching the Gemfile.lock. – Elver 7/7, 2012 at 21:59

You might also consider using Gemfury devcenter.heroku.com/articles/gemfury – Clyburn 30/8, 2012 at 16:20

github has rolled out a new feature for this: github.com/blog/… – Twoup 22/12, 2012 at 3:12

@WolframArnold...can we do this with unfuddle ? – Backrest 9/12, 2013 at 5:26

@Backrest if Unfuddle accepts credentials via HTTP Simple Auth, e.g. https://@<username>:<password>/<url> then you should get it to work. If they don't support simple auth over HTTPS you should definitely ask for that. They may also have a custom feature, like github now, see preceding comment. – Thorncombe 9/12, 2013 at 6:41

There's an issue with user-env-compile and using the ENV in Gemfile - your password / token will still be in the Gemfile.lock Any way out? – Holoblastic 4/3, 2014 at 1:50

I think the answer is using github's native feature. – Thorncombe 11/3, 2014 at 0:20

I'm seeing my password in the Gemfile.lock even with the ENV variables. Dangerous solution – Lawful 6/4, 2014 at 5:52

Ain't this why Github has deploy keys? Shouldn't we be using those? – Keon 8/4, 2014 at 10:36

Please don't do this. Don't put your credentials in the Gemfile. Even if you use environment variables, they will end up in the Gemfile.lock. See my answer below. – Herr 27/1, 2021 at 11:11

S

121

The best way I've found to deploy a gem pulled from a private repo is to use GitHub's OAuth access. To do so:

Create a GitHub user with access to the repo in question (best for teams – if you're okay exposing your personal access tokens, you can simply use your own account).
Create an GitHub OAuth token for the user. It's dead simple to do this over the GitHub API just using curl; see the OAuth API for more.
Add the token to the git url in your Gemfile. Example:

gem 'mygem', git: 'https://xxx123abc:[email protected]/user_or_team/mygem.git'

I'm currently using this method on Heroku and it works great. The beauty is that you don't have to expose your own personal information, and you can revoke or regenerate the token at any point if something is compromised.

Shaun answered 6/11, 2012 at 23:59 Comment(6)

This worked for me. For more information on how to create the OAuth token, visit: help.github.com/articles/… – Biquadratic 1/4, 2013 at 5:36

Not sure why everyone is upvoting the answer that instructs you to put your password in plaintext into version control, then deploy it to a third-party website instead of this one. – Handclasp 19/12, 2013 at 20:4

You can now create personal OAuth tokens on the GitHub site: github.com/settings/tokens/new – Vassili 17/7, 2014 at 9:41

This should be the accepted answer @picardo. Could you change it? – Winnick 1/8, 2017 at 8:25

@Amphistylar can you update the question to use this answer instead of the one you selected? – Evaleen 19/4, 2020 at 4:45

Take the time to create a new GitHub account that has nothing but read access to the Gem repo and scope the token to repo. Do not use access tokens for your own account, they will have all of your access. – Shallot 11/4, 2021 at 10:33

T

41

As per suggestion from Heroku tech support, the easiest way to do this is by putting the username and password into the URL, as in Basic HTTP Auth, e.g.

gem 'my_gem', :git => 'https://my_username:[email protected]/my_github_account/my_repo.git', :ref => 'revision_no'

This worked for us. This is still somewhat dissatisfying as we had to put a password into the Gemfile. We dealt with this by adding a new github user account and adding that account as collaborator on the gem project. Still not foolproof security, but the impact is more narrow.

Other options I read about are to set up your own gem server or to vendor the gem.

Update 5/16/2012: Another way to get around putting the password into the Gemfile is to put the password into an environment variable; on Heroku you do this with heroku config:add VAR=value, and then in the Gemfile you'd use this variable, e.g.:

gem 'my_gem',
  :git => "https://#{ENV['var_private_gem_username']}:#{ENV['var_private_gem_password']}@github.com/my_github_account.git",
  :ref => 'rev'

This is the standard on Heroku to avoid putting passwords, API keys and any credentials into the code. For local development/test, you can set these environment variables. Or, assuming your development machine is set up for SSH access to github, you won't need the credentials for local development (the SSH credentials will be in effect already). So you could set up some conditional logic:

private_repo_credentials = %w(var_private_gem_username var_private_gem_password).
  map { |var| ENV[var] }.compact.join(':')
private_repo_credentials << '@' unless private_repo_credentials.empty?
# private_repo_credentials will be "" if neither var is set
# private_repo_credentials will be "username:password@" if they are set
gem 'my_gem',
  :git => "https://#{private_repo_credentials}github.com/my_github_account.git",
  :ref => 'rev'