67

I have a private repository on Github that I want to use. I deploy my app to Heroku. How can I specify a private repository as the source on my gemfile? I imagine it wouldn't be enough to simply say

gem "mygem", :git=>"my github address"
picardo
  • 24,530
  • 33
  • 104
  • 151

9 Answers9

122

The best way I've found to deploy a gem pulled from a private repo is to use GitHub's OAuth access. To do so:

  1. Create a GitHub user with access to the repo in question (best for teams – if you're okay exposing your personal access tokens, you can simply use your own account).

  2. Create an GitHub OAuth token for the user. It's dead simple to do this over the GitHub API just using curl; see the OAuth API for more.

  3. Add the token to the git url in your Gemfile. Example:

gem 'mygem', git: 'https://xxx123abc:x-oauth-basic@github.com/user_or_team/mygem.git'

I'm currently using this method on Heroku and it works great. The beauty is that you don't have to expose your own personal information, and you can revoke or regenerate the token at any point if something is compromised.

Makoto
  • 104,088
  • 27
  • 192
  • 230
Seth Bro
  • 2,537
  • 3
  • 19
  • 15
  • 3
    This worked for me. For more information on how to create the OAuth token, visit: https://help.github.com/articles/creating-an-oauth-token-for-command-line-use – John Apr 01 '13 at 05:36
  • 26
    Not sure why everyone is upvoting the answer that instructs you to put your password in plaintext into version control, then deploy it to a third-party website instead of this one. – Brett Bender Dec 19 '13 at 20:04
  • 3
    You can now create personal OAuth tokens on the GitHub site: https://github.com/settings/tokens/new – Andy Waite Jul 17 '14 at 09:41
  • 1
    This should be the accepted answer @picardo. Could you change it? – Per Lundberg Aug 01 '17 at 08:25
  • @picardo can you update the question to use this answer instead of the one you selected? – danielsmith1789 Apr 19 '20 at 04:45
  • Take the time to create a new GitHub account that has nothing but read access to the Gem repo and scope the token to repo. Do not use access tokens for your own account, they will have all of your access. – JuJoDi Apr 11 '21 at 10:33
42

As per suggestion from Heroku tech support, the easiest way to do this is by putting the username and password into the URL, as in Basic HTTP Auth, e.g.

gem 'my_gem', :git => 'https://my_username:my_password@github.com/my_github_account/my_repo.git', :ref => 'revision_no'

This worked for us. This is still somewhat dissatisfying as we had to put a password into the Gemfile. We dealt with this by adding a new github user account and adding that account as collaborator on the gem project. Still not foolproof security, but the impact is more narrow.

Other options I read about are to set up your own gem server or to vendor the gem.

Update 5/16/2012: Another way to get around putting the password into the Gemfile is to put the password into an environment variable; on Heroku you do this with heroku config:add VAR=value, and then in the Gemfile you'd use this variable, e.g.:

gem 'my_gem',
  :git => "https://#{ENV['var_private_gem_username']}:#{ENV['var_private_gem_password']}@github.com/my_github_account.git",
  :ref => 'rev'

This is the standard on Heroku to avoid putting passwords, API keys and any credentials into the code. For local development/test, you can set these environment variables. Or, assuming your development machine is set up for SSH access to github, you won't need the credentials for local development (the SSH credentials will be in effect already). So you could set up some conditional logic:

private_repo_credentials = %w(var_private_gem_username var_private_gem_password).
  map { |var| ENV[var] }.compact.join(':')
private_repo_credentials << '@' unless private_repo_credentials.empty?
# private_repo_credentials will be "" if neither var is set
# private_repo_credentials will be "username:password@" if they are set
gem 'my_gem',
  :git => "https://#{private_repo_credentials}github.com/my_github_account.git",
  :ref => 'rev'

I've not tested this last part. Please provide feedback.

Wolfram Arnold
  • 7,159
  • 5
  • 44
  • 64
  • 5
    For the ENV approach to work, you'll have to enable a labs addon: `heroku labs:enable user_env_compile`. Unfortunately, there are still issues with matching the Gemfile.lock. – Peter Wagenet Jul 07 '12 at 21:59
  • 3
    You might also consider using Gemfury https://devcenter.heroku.com/articles/gemfury – Schneems Aug 30 '12 at 16:20
  • 4
    github has rolled out a new feature for this: https://github.com/blog/1270-easier-builds-and-deployments-using-git-over-https-and-oauth – kanzure Dec 22 '12 at 03:12
  • @WolframArnold...can we do this with unfuddle ? – rubyprince Dec 09 '13 at 05:26
  • @rubyprince if Unfuddle accepts credentials via HTTP Simple Auth, e.g. https://@:/ then you should get it to work. If they don't support simple auth over HTTPS you should definitely ask for that. They may also have a custom feature, like github now, see preceding comment. – Wolfram Arnold Dec 09 '13 at 06:41
  • 3
    There's an issue with user-env-compile and using the ENV in Gemfile - your password / token will still be in the Gemfile.lock Any way out? – pcv Mar 04 '14 at 01:50
  • I think the answer is using github's native feature. – Wolfram Arnold Mar 11 '14 at 00:20
  • 3
    I'm seeing my password in the Gemfile.lock even with the ENV variables. Dangerous solution – James Lin Apr 06 '14 at 05:52
  • 1
    Ain't this why Github has deploy keys? Shouldn't we be using those? – Augustin Riedinger Apr 08 '14 at 10:36
  • Please don't do this. Don't put your credentials in the Gemfile. Even if you use environment variables, they will end up in the Gemfile.lock. See my answer below. – coorasse Jan 27 '21 at 11:11
25

This question deserves a better answer since both the accepted answer and the most voted ones ARE NOT SAFE if you want to avoid putting your credentials or oauth token in the repository.

Please don't do:

gem 'my_private_gem', git: 'https://my_username:my_password@github.com/my_github_account/my_private_gem.git'

or

gem 'my_private_gem', git: 'https://xxx123abc:x-oauth-basic@github.com/my_github_account/my_private_gem.git'

even if you move them as environment variables, they will still be written in your Gemfile.lock.

the correct solution is to put the following on the Gemfile:

gem 'my_private_gem', git: 'https://github.com/my_github_account/my_private_gem.git'

and configure bundler to use your oauth key via:

export MY_OAUTH_KEY=abcd
bundle config github.com $MY_OAUTH_KEY

Create the oauth key here with the repo scope.

You can now set the env variable MY_OAUTH_KEY on you machine, on the CI and on Heroku so that they can all download the gem.

On Heroku, you will set the following environment variable:

BUNDLE_GITHUB__COM: <your_oauth_key>
coorasse
  • 5,278
  • 1
  • 34
  • 45
  • I didn't understand some things. In which file I need to configure the bundler? I need to set both BUNDLE_GITHUB__COM and MY_OAUTH_KEY on Heroku? – Wes Guirra Jun 01 '21 at 15:20
  • On Heroku you can set the environment variable BUNDLE_GITHUB__COM with your oauth key. You can set this env variable also locally if you want – coorasse Oct 13 '21 at 12:36
  • This is best solid solution it should be accepted answer – Asnad Atta Jan 26 '22 at 12:21
  • This is the safest answer. Is there any security issues with `export MY_OAUTH_KEY=abcd`, should you unset `$MY_OAUTH_KEY` after doing the `bundle config` – Obromios Aug 30 '22 at 04:16
  • For anyone trying to use GitHub's new **fine-grained personal access tokens**, I got this to work by adding the **Contents** read-only repository permission, and then you need to prefix the token with `oauth2:` as described [here](https://stackoverflow.com/a/74532853/6728018) – Jeff Manian Apr 25 '23 at 16:42
7

I found that if I have access from my terminal to github (by uploading an ssh key to github), I can simply do:

gem 'my_gem', :git => 'git@github.com:my_user/my_repo.git', :ref => 'revision_no'

without polluting my code with my git username or password

gardenofwine
  • 1,344
  • 2
  • 15
  • 24
  • @KhoaNguyen It won't work out of the box, since the Heroku server would try to access the git repository directly. I think it may be possible to add your Heroku server's ssh key to your github repository, thus allowing this access - **but I'm not sure its possible** – gardenofwine Jul 15 '14 at 07:38
  • @gardenofwine, This approach may work if you have one or two servers on Heroku. On a larger scale, you cannot add keys from all your servers to Github. – Virtual Sep 19 '18 at 13:22
4
itsnikolay
  • 17,415
  • 4
  • 65
  • 64
2

In addition to @seth-bro's answer, we can also use bundle config to configure the credentials using bundler, so that we need not expose the oAuth token on the Gemfile.

Syntax: bundle config github.com <your_github_oauth_token>

Refer: https://gist.github.com/sebboh/f1dfe4f096746c45f3e9ea06a09743a0 https://bundler.io/v1.16/bundle_config.html

Virtual
  • 2,111
  • 5
  • 17
  • 27
0

Hopefully still relevant in 2015, you can use https://github.com/siassaj/heroku-buildpack-git-deploy-keys with a deploy key from github.

This way you avoid putting the username and pass into Gemfile, which will end up as plain text in the Gemfile.lock

sia
  • 1
0

The most secure way to do this is to configure the github personal token the following way. After you create your github personal access token by following their official documentation, do the following:

  1. In your local machine, do:

bundle config github.com YOUR_GITHUB_PERSONAL_TOKEN:x-oauth-basic

  1. In heroku, set BUNDLE_GITHUB__COM ENV variable:

BUNDLE_GITHUB__COM = YOUR_GITHUB_PERSONAL_TOKEN

You can also do this from your terminal by doing:

heroku config:set BUNDLE_GITHUB__COM=YOUR_GITHUB_PERSONAL_TOKEN

K M Rakibul Islam
  • 33,760
  • 12
  • 89
  • 110
-3

I found that when using the env approach and heroku labs:enable user_env_compile then there is no problem with the Gemfile.lock

doro
  • 35
  • 4