How can I specify a gem to pull from a private github repository?

This question deserves a better answer since both the accepted answer and the most voted ones ARE NOT SAFE if you want to avoid putting your credentials or oauth token in the repository.

Please don't do:

gem 'my_private_gem', git: 'https://my_username:[email protected]/my_github_account/my_private_gem.git'

or

gem 'my_private_gem', git: 'https://xxx123abc:[email protected]/my_github_account/my_private_gem.git'

even if you move them as environment variables, they will still be written in your Gemfile.lock.

the correct solution is to put the following on the Gemfile:

gem 'my_private_gem', git: 'https://github.com/my_github_account/my_private_gem.git'

and configure bundler to use your oauth key via:

export MY_OAUTH_KEY=abcd
bundle config github.com $MY_OAUTH_KEY

Create the oauth key here with the repo scope.

You can now set the env variable MY_OAUTH_KEY on you machine, on the CI and on Heroku so that they can all download the gem.

On Heroku, you will set the following environment variable:

BUNDLE_GITHUB__COM: <your_oauth_key>

The best way I've found to deploy a gem pulled from a private repo is to use GitHub's OAuth access. To do so:

1. Create a GitHub user with access to the repo in question (best for teams – if you're okay exposing your personal access tokens, you can simply use your own account).

2. Create an GitHub OAuth token for the user. It's dead simple to do this over the GitHub API just using curl; see the OAuth API for more.

3. Add the token to the git url in your Gemfile. Example:

gem 'mygem', git: 'https://xxx123abc:[email protected]/user_or_team/mygem.git'

I'm currently using this method on Heroku and it works great. The beauty is that you don't have to expose your own personal information, and you can revoke or regenerate the token at any point if something is compromised.

As per suggestion from Heroku tech support, the easiest way to do this is by putting the username and password into the URL, as in Basic HTTP Auth, e.g.

gem 'my_gem', :git => 'https://my_username:[email protected]/my_github_account/my_repo.git', :ref => 'revision_no'

This worked for us. This is still somewhat dissatisfying as we had to put a password into the Gemfile. We dealt with this by adding a new github user account and adding that account as collaborator on the gem project. Still not foolproof security, but the impact is more narrow.

Other options I read about are to set up your own gem server or to vendor the gem.

Update 5/16/2012: Another way to get around putting the password into the Gemfile is to put the password into an environment variable; on Heroku you do this with heroku config:add VAR=value, and then in the Gemfile you'd use this variable, e.g.:

gem 'my_gem',
  :git => "https://#{ENV['var_private_gem_username']}:#{ENV['var_private_gem_password']}@github.com/my_github_account.git",
  :ref => 'rev'

This is the standard on Heroku to avoid putting passwords, API keys and any credentials into the code. For local development/test, you can set these environment variables. Or, assuming your development machine is set up for SSH access to github, you won't need the credentials for local development (the SSH credentials will be in effect already). So you could set up some conditional logic:

private_repo_credentials = %w(var_private_gem_username var_private_gem_password).
  map { |var| ENV[var] }.compact.join(':')
private_repo_credentials << '@' unless private_repo_credentials.empty?
# private_repo_credentials will be "" if neither var is set
# private_repo_credentials will be "username:password@" if they are set
gem 'my_gem',
  :git => "https://#{private_repo_credentials}github.com/my_github_account.git",
  :ref => 'rev'

I've not tested this last part. Please provide feedback.