What is the right/secure way to pip install a private git repo on a Heroku app?

问题

App structure (Python FastAPI):

-my_app
  -server.py
  -Procfile
  -requirements.txt

In order to install a private git repo required by my Heroku app, I added the following line to my requirements.txt:

git+https://<github-token>@github.com/me/my-private-repo.git

However on pushing, Github emailed me to say that since I had exposed my token in a commit it had revoked the token. (My app repo is private.) Totally fair! However, my Heroku build now fails, since it prompts for a password when attempting to install the private repo.

I've searched SO/the internet many times re: private repos, but have always come across conflicting suggestions.

Would be grateful to hear what is best practice in this case, for safely installing a private repo in an automated build.

What I've tried so far:

• git+git://username:password@github.com/me/myrepo.git instead of token obviously has the same issue
• git+ssh://git@github.com/me/myrepo.git - yields error Host key verification failed.
• Store username:password (or token) as Heroku environment variables - seems from here that this isn't possible with pip

To expand on the ssh option, the following work on my local machine:

• pip3 install git+ssh://git@github.com/me/my_private-repo.git
• git clone https://github.com/me/my_private-repo.git

However when my requirements.txt contains git+ssh://git@github.com/me/my_private-repo.git, my Heroku build returns Host key verification failed. fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.

回答1:

Finally got it to work. I'm indebted to Michel Blancard's answer and associated gist, and Bo Jeanes' custom buidpack:

In requirements.txt:

git+ssh://git@github.com/me/my-private-repo.git

Convert my private SSH key to the (old) PEM format for Heroku(!):

ssh-keygen  -f ~/.ssh/id_rsa -m PEM -p

(Credit due to this answer)

Add private SSH key as Heroku variable:

heroku config:set SSH_KEY="$(cat ~/.ssh/id_rsa)"

Add this custom buildpack to run before the Python buildpack which enables a private SSH key:

heroku buildpacks:add --index 1 https://github.com/heroku/heroku-buildpack-ssh-key.git

Deploy!

来源：https://stackoverflow.com/questions/62243433/what-is-the-right-secure-way-to-pip-install-a-private-git-repo-on-a-heroku-app