How to install private github repository via npm in github actions workflow ci

问题

I am trying to install npm dependencies within a github workflow ci by running npm install. However i get the following error:

npm ERR! Error while executing:
npm ERR! /usr/bin/git ls-remote -h -t ssh://git@github.com/private-org/private-repo.git
npm ERR! 
npm ERR! Warning: Permanently added the RSA host key for IP address 'removed' to the list of known hosts.
npm ERR! git@github.com: Permission denied (publickey).
npm ERR! fatal: Could not read from remote repository.

ci.yml

name: CI

on:
  push:
    branches: [master ]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    - name: Use Node.js
      uses: actions/setup-node@v1
      with:
        node-version: '12.x'
    - run: node --version
    - run: npm install

package.json

  ...
  "dependencies": {
    "some-pacakage": "git+ssh://git@github.com/private-org/private-repo.gitt",
  },
  ...

This some-package is being installed via github by npm. The repo is within the same organization as which the workflow is running in. To solve this problem locally you setup ssh key on your github account tied to the organization.

But how can i solve this issue so that its able to install that package via github repo within the workfow ci where im not using my personal github account.

回答1:

The standard token doesn't have sufficient permissions:

The token's permissions are limited to the repository that contains your workflow. For more information, see "Permissions for the GITHUB_TOKEN".

You have to manually create a personal access token that gives access to packages:

If you need a token that requires permissions that aren't available in the GITHUB_TOKEN, you can create a personal access token and set it as a secret in your repository:

Use or create a token with the appropriate permissions for that repository. For more information, see "Creating a personal access token for the command line".

Add the token as a secret in your workflow's repository, and refer to it using the ${{ secrets.SECRET_NAME }} syntax. For more information, see "Creating and using encrypted secrets".

Source: https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token

回答2:

The private repository is being installed via ssh. If you set an ssh key in the pipeline it will use that ssh key when attempting to install.

Fortunately there is a github action that allows us to do that https://github.com/webfactory/ssh-agent

Above npm install add the following:

  - uses: webfactory/ssh-agent@v0.2.0
  with:
    ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}

Setup / Pre-requisites

https://github.com/webfactory/ssh-agent#usage

Create an SSH key with sufficient access privileges. For security reasons, don't use your personal SSH key but set up a dedicated one for use in GitHub Actions. See below for a few hints if you are unsure about this step.

Make sure you don't have a passphrase set on the private key.

In your repository, go to the Settings > Secrets menu and create a new secret. In this example, we'll call it SSH_PRIVATE_KEY. Put the contents of the private SSH key file into the contents field. This key should start with -----BEGIN ... PRIVATE KEY-----, consist of many lines and ends with -----END ... PRIVATE KEY-----.

来源：https://stackoverflow.com/questions/61877681/how-to-install-private-github-repository-via-npm-in-github-actions-workflow-ci

标签

node.js

git

github

github-actions