Cloning private github repository within organisation in actions

Question

I have 2 private GitHub repositories (say A and B) in the organization (say ORG). Repository A has repository B in requirements.txt:

-e git+git@github.com:ORG/B.git#egg=B

And I have the following workflow for A (in .github/workflows/test.yml):

name: Python package

on: push

jobs:
  build:

    runs-on: ubuntu-latest

    steps:
    - uses: actions/checkout@v1

    - name: Install requirements
      run: |
        pip install -r requirements.txt

    - name: Test with pytest
      run: |
        pytest ./tests

As B is private, it fails on installing it.

Is it possible to install B while testing A in this workflow if they are in the same organization? How?

Answer 1

Since access tokens are bound to an account and have write access to all its private repos, it's a very bad solution.

Instead, use deploy keys.

Deploy keys are simply SSH keys that you can use to clone a repo.

1. Create a new SSH key pair on your computer
2. Put the public key in the private dependency repo's Deploy keys
3. Put the private key in the app repo's Actions secrets
4. Delete the keys from your computer

Once it's set, you can set the private key in the GitHub Action's SSH Agent. There's no need to import a third-party GitHub Action, a 2-liner will suffice.

eval `ssh-agent -s`
ssh-add - <<< '${{ secrets.PRIVATE_SSH_KEY }}'
pip install -r requirements.txt

---

I found that ssh-add command here.

Answer 2

I did this way!

- uses: actions/checkout@v1  
  with:
    repository: organization_name/repo_name
    token: ${{ secrets.ACCESS_TOKEN }}

You need to provide a valid token, you can generate it following this guide

Answer 3

Instead of check out twice, all you need is provided the TOKEN for pip to access repo B.

    - name: Install requirements
      run: |
        git config --global url."https://${{ secrets.ACESS_TOKEN }}@github".insteadOf https://github
        pip install -r requirements.txt

Answer 4

Using deployment keys you can do

- uses: actions/checkout@v2
  with:
    ssh-key: ${{ secrets.SSH_PRIVATE_KEY }}
    repository: organization_name/repo_name

For this to work you need to

• generate ssh keys locally
• add pub key as deployment key to the private repo
• add private key as a secret named SSH_PRIVATE_KEY

Answer 5

Either use an SSH key with no passphrase to access repo B, or create an access token for that repo and then use the access token as your password to access that repo over HTTPS: https://USERNAME:TOKEN@github.com/ORG/B.git.

Answer 6

There is safety way to do this in Github Actions (without storing ssh-key). You have dedicated lib for that in Github Actions

- uses: webfactory/ssh-agent@v0.7.0
    with:
      ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY_VOW_SHARED }}

When you use docker you have to create ssh tunneling:

docker build --ssh default=${SSH_AUTH_SOCK} .

or docker-compose.yaml:

build:
  ssh:
    default: ${SSH_AUTH_SOCK}

And after that in Dockerfile:

RUN mkdir -p -m 0600 ~/.ssh && ssh-keyscan github.com >> ~/.ssh/known_hosts
RUN --mount=type=ssh pip install -r requirements.txt

Remember to set DOCKER_BUILDKIT flag in ci.yaml:

env:
  DOCKER_BUILDKIT: 1

Answer 7

Disclaimer: your secret will be in clear text with this solution.

I added this line

git+https://YOUR_TOKEN_HERE@github.com/ORG/REPO_NAME.git@master#egg=REPO_NAME

to my requirements.txt and it worked. But your token will be exposed to anyone having access to this repository. It is probably best to use a secret in your repository.

Answer 8

If we like to access one repository from another, we could have a Github level secret (let's say ORG_GITHUB_TOKEN and ORG_GITHUB_USERNAME). If we need to have fine grained access control, we could create multiple tokens with restricted access.

In Github action, we could save them in .git-credentials and use credentials store git config. This combination can help in this situation.

Here is an example github action, where we install python dependency from another private repository.

Example is python unittest. But the approach is generic.

name: UnitTest

on:
  workflow_dispatch:
  push:

jobs:
  unittest:
    name: Unit Test
    env:
      ORG_GITHUB_USERNAME: ${{ secrets.ORG_GITHUB_USERNAME }}
      ORG_GITHUB_TOKEN: ${{ secrets.ORG_GITHUB_TOKEN }}
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@v3

    - name: Setup Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.10'
    - name: Install dependencies
      run: |
        echo "https://$ORG_GITHUB_USERNAME:$ORG_GITHUB_TOKEN@github.com" >> $HOME/.git-credentials
        git config --global credential.helper store
        pip install poetry
        poetry config virtualenvs.create false
        poetry install --all-extras --no-root --with dev --no-interaction
        rm -rf ${HOME}/.git-credentials
    - name: Run pytest
      run: |
        python -m pytest

permissions:
  id-token: write
  contents: write
  pages: write
  repository-projects: write