Using Composer and Private Repository on GitHub using VCS on Build Server

Question

My compsoser.json uses 2 private repositories from our Organisation Github Account and is as follows.

{     "name": "API",     "repositories": [       {         "type": "vcs",         "url": "[email protected]/company/private.git"       },       {         "type": "vcs",         "url": "[email protected]/company/private2.git"       }     ],     "require": {         "php": ">=5.3.3",         "zendframework/zendframework": ">2.1.3",         "doctrine/mongodb-odm": "dev-master",         "doctrine/doctrine-mongo-odm-module": "dev-master",         "company/private": "dev-master",         "company/private2": "dev-master"     } } 

We've setup SSH keys and added them to the authorized keys on our staging server. When we run git clone it works perfectly and isn't asking for any credentials.

However, when we run composer update the fetching of the repositories fails because composer doesn't have access to the repositories.

Since this is ran in a non-interactive way as this is part of a build script we can't enter credentials and like to have this automated.

What can we do to let composer have access to our private repo's during the build?

Answer 1

I understand the question title specifically mentions using type 'vcs' but this is an alternate method of using private git repos to deploy a project as a package.

"repositories": [   {     "type": "package",     "package": {       "name": "company/private",       "version": "0.1.0",       "type": "package",       "source": {         "url": "[email protected]:/company/private.git",         "type": "git",         "reference": "master"       }     }   } ], "require": {   "company/private": "*" } 

The limitation is that you must manually change the version number every time you deploy if you want the latest version. However, this is also its advantage.

Defining a repo in this way will allow you to pull a specific tagged version. In this case the commit with tag 0.1.0 will be pulled on composer update.

You will need to add the SSH keys of the server you are deploying to in your github account.

Answer 2

You can configure composer to use key files to access private repository.

More info: https://getcomposer.org/doc/articles/handling-private-packages-with-satis.md#security