How can I specify a gem to pull from a private github repository?

I have a private repository on Github that I want to use. I deploy my app to Heroku. How can I specify a private repository as the source on my gemfile? I imagine it wouldn't be enough to simply say

gem "mygem", :git=>"my github address" 

The best way I've found to deploy a gem pulled from a private repo is to use GitHub's OAuth access. To do so:

1. Create a GitHub user with access to the repo in question (best for teams – if you're okay exposing your personal access tokens, you can simply use your own account).

2. Create an GitHub OAuth token for the user. It's dead simple to do this over the GitHub API just using curl; see the OAuth API for more.

3. Add the token to the git url in your Gemfile. Example:

gem 'mygem', git: 'https://xxx123abc:[email protected]/user_or_team/mygem.git'

I'm currently using this method on Heroku and it works great. The beauty is that you don't have to expose your own personal information, and you can revoke or regenerate the token at any point if something is compromised.

As per suggestion from Heroku tech support, the easiest way to do this is by putting the username and password into the URL, as in Basic HTTP Auth, e.g.

gem 'my_gem', :git => 'https://my_username:[email protected]/my_github_account/my_repo.git', :ref => 'revision_no'

This worked for us. This is still somewhat dissatisfying as we had to put a password into the Gemfile. We dealt with this by adding a new github user account and adding that account as collaborator on the gem project. Still not foolproof security, but the impact is more narrow.

Other options I read about are to set up your own gem server or to vendor the gem.

Update 5/16/2012: Another way to get around putting the password into the Gemfile is to put the password into an environment variable; on Heroku you do this with heroku config:add VAR=value, and then in the Gemfile you'd use this variable, e.g.:

gem 'my_gem',
  :git => "https://#{ENV['var_private_gem_username']}:#{ENV['var_private_gem_password']}@github.com/my_github_account.git",
  :ref => 'rev'

This is the standard on Heroku to avoid putting passwords, API keys and any credentials into the code. For local development/test, you can set these environment variables. Or, assuming your development machine is set up for SSH access to github, you won't need the credentials for local development (the SSH credentials will be in effect already). So you could set up some conditional logic:

private_repo_credentials = %w(var_private_gem_username var_private_gem_password).
  map { |var| ENV[var] }.compact.join(':')
private_repo_credentials << '@' unless private_repo_credentials.empty?
# private_repo_credentials will be "" if neither var is set
# private_repo_credentials will be "username:password@" if they are set
gem 'my_gem',
  :git => "https://#{private_repo_credentials}github.com/my_github_account.git",
  :ref => 'rev'

I've not tested this last part. Please provide feedback.

This question deserves a better answer since both the accepted answer and the most voted ones ARE NOT SAFE if you want to avoid putting your credentials or oauth token in the repository.

Please don't do:

gem 'my_private_gem', git: 'https://my_username:[email protected]/my_github_account/my_private_gem.git'

or

gem 'my_private_gem', git: 'https://xxx123abc:[email protected]/my_github_account/my_private_gem.git'

even if you move them as environment variables, they will still be written in your Gemfile.lock.

the correct solution is to put the following on the Gemfile:

gem 'my_private_gem', git: 'https://github.com/my_github_account/my_private_gem.git'

and configure bundler to use your oauth key via:

export MY_OAUTH_KEY=abcd
bundle config github.com $MY_OAUTH_KEY

Create the oauth key here with the repo scope.

You can now set the env variable MY_OAUTH_KEY on you machine, on the CI and on Heroku so that they can all download the gem.

On Heroku, you will set the following environment variable:

BUNDLE_GITHUB__COM: <your_oauth_key>

I found that if I have access from my terminal to github (by uploading an ssh key to github), I can simply do:

gem 'my_gem', :git => '[email protected]:my_user/my_repo.git', :ref => 'revision_no'

without polluting my code with my git username or password

• Create a ssh keys

• Make sure those keys under ~/.ssh directory

• Copy content of ~/.ssh/id_rsa.pub into https://github.com/MY_COMPANY/MY_GEM/settings/keys

• In your Gemfile use: gem 'mygem', github: 'MY_COMPANY/MY_GEM'

• run bundle install

In addition to @seth-bro's answer, we can also use bundle config to configure the credentials using bundler, so that we need not expose the oAuth token on the Gemfile.

Syntax: bundle config github.com <your_github_oauth_token>

Refer: https://gist.github.com/sebboh/f1dfe4f096746c45f3e9ea06a09743a0 https://bundler.io/v1.16/bundle_config.html

Hopefully still relevant in 2015, you can use https://github.com/siassaj/heroku-buildpack-git-deploy-keys with a deploy key from github.

This way you avoid putting the username and pass into Gemfile, which will end up as plain text in the Gemfile.lock

I found that when using the env approach and heroku labs:enable user_env_compile then there is no problem with the Gemfile.lock