Skip to Content

Rails - Bundle a private gem

Posted on

I wrote a port about how to use a private repo as a dependency with yarn or npm here. But how we do the same using bundler?

In Gemfile, there are many ways to install a gem.

# git
gem 'rails', git: 'git://github.com/rails/rails.git'

# ssh
gem 'rails', git: '[email protected]:rails/rails.git'

# https
gem 'rails', git: 'https://github.com/rails/rails.git'

# github keyword
gem 'rails', github: 'rails/rails.git'

But please don’t use git:// protocol. It’s insecure and allows a man-in-the-middle attach.

You could use SSH (give your ssh_key to CI so it could make a request) or use HTTPS (enter your github username and password each time bundle install) to pull gem code. However, that’s quite annoying.

Solution

1. Directly in the Gemfile

gem 'private', git: 'https://<username>:<password>@github.com/mycompany/private.git'
gem 'private', git: 'https://x-access-token:<token>@github.com/mycompany/private.git'

-> That is not a great idea. Cause you put sensitive information in source code.

2. Use bundle config

Ref: Config bundler

$ bundle config GITHUB__COM username:password
$ bundle config --local GITHUB__COM username:password

-> Take username/password out of the source code.

3. Use bundle config with environment variables

$ export BUNDLE_GITHUB__COM=username:password
$ export BUNDLE_GITHUB__COM=x-access-token:<token>

Reference:

comments powered by Disqus