How can I specify a gem to pull from a private github repository?

Question

I have a private repository on Github that I want to use. I deploy my app to Heroku. How can I specify a private repository as the source on my gemfile? I imagine it wouldn\

Answer 1

Hopefully still relevant in 2015, you can use https://github.com/siassaj/heroku-buildpack-git-deploy-keys with a deploy key from github.

This way you avoid putting the username and pass into Gemfile, which will end up as plain text in the Gemfile.lock

Answer 2

I found that when using the env approach and heroku labs:enable user_env_compile then there is no problem with the Gemfile.lock

Answer 3

• Create a ssh keys
• Make sure those keys under ~/.ssh directory
• Copy content of ~/.ssh/id_rsa.pub into https://github.com/MY_COMPANY/MY_GEM/settings/keys
• In your Gemfile use: gem 'mygem', github: 'MY_COMPANY/MY_GEM'
• run bundle install

Answer 4

As per suggestion from Heroku tech support, the easiest way to do this is by putting the username and password into the URL, as in Basic HTTP Auth, e.g.

gem 'my_gem', :git => 'https://my_username:my_password@github.com/my_github_account/my_repo.git', :ref => 'revision_no'

This worked for us. This is still somewhat dissatisfying as we had to put a password into the Gemfile. We dealt with this by adding a new github user account and adding that account as collaborator on the gem project. Still not foolproof security, but the impact is more narrow.

Other options I read about are to set up your own gem server or to vendor the gem.

Update 5/16/2012: Another way to get around putting the password into the Gemfile is to put the password into an environment variable; on Heroku you do this with heroku config:add VAR=value, and then in the Gemfile you'd use this variable, e.g.:

gem 'my_gem',
  :git => "https://#{ENV['var_private_gem_username']}:#{ENV['var_private_gem_password']}@github.com/my_github_account.git",
  :ref => 'rev'

This is the standard on Heroku to avoid putting passwords, API keys and any credentials into the code. For local development/test, you can set these environment variables. Or, assuming your development machine is set up for SSH access to github, you won't need the credentials for local development (the SSH credentials will be in effect already). So you could set up some conditional logic:

private_repo_credentials = %w(var_private_gem_username var_private_gem_password).
  map { |var| ENV[var] }.compact.join(':')
private_repo_credentials << '@' unless private_repo_credentials.empty?
# private_repo_credentials will be "" if neither var is set
# private_repo_credentials will be "username:password@" if they are set
gem 'my_gem',
  :git => "https://#{private_repo_credentials}github.com/my_github_account.git",
  :ref => 'rev'

I've not tested this last part. Please provide feedback.

Answer 5

In addition to @seth-bro's answer, we can also use bundle config to configure the credentials using bundler, so that we need not expose the oAuth token on the Gemfile.

Syntax: bundle config github.com <your_github_oauth_token>

Refer: https://gist.github.com/sebboh/f1dfe4f096746c45f3e9ea06a09743a0 https://bundler.io/v1.16/bundle_config.html

Answer 6

This question deserves a better answer since both the accepted answer and the most voted ones are not secure if you don't want to put your credentials or oauth token in the repository.

Please don't do:

gem 'my_private_gem', git: 'https://my_username:my_password@github.com/my_github_account/my_private_gem.git'

or

gem 'my_private_gem', git: 'https://xxx123abc:x-oauth-basic@github.com/my_github_account/my_private_gem.git'

even if move them as environment variables, they will still be in your Gemfile.lock.

the correct solution is to put the following on the Gemfile:

gem 'my_private_gem', git: 'https://github.com/my_github_account/my_private_gem.git'

and configure bundler to use your oauth key via:

export MY_OAUTH_KEY=abcd
bundle config github.com $MY_OAUTH_KEY

Create the oauth key here with the repo scope.

You can now set the env variable MY_OAUTH_KEY on you machine, on the CI and on Heroku so that they can all download the gem.

On Heroku, you will set the following environment variable:

BUNDLE_GITHUB__COM: <your_oauth_key>