Pip install package from private github repo in google cloud appengine

Question

I am using google cloud appengine and deploying with gcloud app deploy and a standard app.yaml file. My requirements.txt file has one private package that is fetched from github (git+ssh://[email protected]/...git). This install works locally, but when I run the deploy I get

Host key verification failed.
fatal: Could not read from remote repository.

This suggests there is no ssh key when installing. Reading docs (https://cloud.google.com/appengine/docs/standard/python3/specifying-dependencies) it appears that this just isn't an option???

Dependencies are installed in a Cloud Build environment that does not provide access to SSH keys. Packages hosted on repositories that require SSH-based authentication must be copied into your project directory and uploaded alongside your project's code using the pip package manager.

To me this seems severely not-optimal - the whole point of factoring out code into a package was to be able to avoid duplication in repos. Now, if I want to use appengine, you're telling me this not possible?

Is there really no workaround?

Answer 1

See:

https://cloud.google.com/appengine/docs/standard/python3/specifying-dependencies#private_dependencies

The App Engine service does not (and should not) have access to your private repo.

One alternative (that you don't want) is to upload your public key to the App Engine service.

The other -- as documented -- is that you must provide the content of your private repo to the service as part of your upload.