Hiding the token for a private repo in package.json

Question

I have a private repo that is used in my project something like "myPrivateRepo":"git+https://oauth2:SOMESECRET@git.github.com/privaterepo.git"

I will be deploying this project as a public repo. How can i hide the SOMESECRET ? I tried to use enviornmentVariable but did not work out.

"myPrivateRepo":"${PrivateRepoUrl}"

Please assist.

Maybe explain why environment variables didn't work out? They are the normal way to handle this, and most people are going to want to suggest that approach. — Jed Richards, May 09 '19 at 08:13
I have a react project created using create-react-app. Then added a .env file to the root location, within the file i added PrivateRepoUrl=someURL. When trying to do npm install; i get the following error - code EINVALIDTAGNAME npm ERR! Invalid tag name "${PrivateRepoUrl}": Tags may not have any characters that encodeURIComponent encodes. — Gaurav_soni, May 09 '19 at 08:18
Sorry I just realised that you're trying to use env vars inside package.json, yep you're right that isn't straightforward. Can you access the private repo via ssh instead? Like this comment: https://stackoverflow.com/a/34650617/1058314 — Jed Richards, May 09 '19 at 08:30
Yea , i can access via ssh also. Just saw another approach - https://stackoverflow.com/a/40312033/893217 , what do you think ? — Gaurav_soni, May 09 '19 at 08:37
I tried out the SSH option, and it worked well on local computer. Now the issue is i need to deploy on Heroku, and i dont think Heroku would provide the public key which i could whitelist on GIT — Gaurav_soni, May 09 '19 at 09:25
Helpful? https://elements.heroku.com/buildpacks/simon0191/custom-ssh-key-buildpack — Jed Richards, May 09 '19 at 13:25

score 0 · Answer 1 · answered May 09 '19 at 07:57

0

You should use Vault for this. You can download it from here: https://www.vaultproject.io/downloads.html

There are others tool as well which you can select as per your comfort.

answered May 09 '19 at 07:57

Shivang Agarwal

1 Answers1