55

I have a project with a Node dependency on a private Git repository. I need to be able to run npm install without being prompted to enter a password or allow an SSH connection, so I'm using an access token that I created on GitHub in my package.json:

  "dependencies": {
    "sass-theme": "git+https://[token]:x-oauth-basic@github.com/MyOrg/sass-theme.git#v1.0.2",
    "node-sass": "^4.5.0"
  }

This project is shared with dozens of other people, so obviously I don't want to keep my token in source control. I know I can create a read-only deployment key on GitHub, but I believe that would require other developers to import the SSH key to build the project locally.

Is it possible to create an access token that can be shared but that has read-only access to clone the repository?

2

5 Answers 5

35

The most straightforward way I can think of to create a token that provides read-only access to a private repo is to:

  1. Have a user who has read-only access to the given private repo (and ideally, not much else)
  2. As that user create a Personal Access Token with the "repo" scope

It would be best if they didn't have access to other orgs/repos, since the "repo" scope grants the user total control over any repos that user has write access to.

I know in an Enterprise solution we would do that with a System ID, but on GitHub you can instead create a Machine User.

6
  • 1
    This does seem pretty straightforward. In combination, we might need to set an environment variable on each developer's machine containing the key (in order to keep it out of source control). Mar 7, 2017 at 17:52
  • Right, because the token could still do mischief to some other project that added it as a contributor, and you can login with with the token essentially.
    – Al Neill
    Mar 7, 2017 at 19:59
  • 7
    collaborators can't have read-only access to private repositories, you have to give them write-access.
    – Herbert
    Mar 18, 2021 at 8:30
  • 2
    Clarification on Herbert's comment: You can specify what kind of access you want to give to collaborators in a private repo if the repo is within an organization. Here's the documentation: docs.github.com/en/rest/reference/…
    – monfresh
    Jan 14, 2022 at 19:36
  • 3
    The fact that github doesn't have a default read only access to private repo is quite ridiculous. I now have to pay for an additional user to grant this type of access.
    – shoke
    Aug 3, 2022 at 21:38
16

Deploy keys are the way to go. By default they don't allow write access and they are scoped to the specific repository (unlike the GitHub personal access token). So you can now generate a private/public key pair, set one as read/pull only deploy key on a single repository in GitHub and use the private key in your CI.

For instance run a bash script:

eval "$(ssh-agent -s)";
ssh-add <your private deploy key>;

Now your CI has rights to access private repo's during the build.

You can add a Deploy key by going to your repository on Github and then clicking Settings > Deploy keys > Add deploy key

2
  • 11
    Deploy keys are great but unfortunately as far as I know they can be used only for SSH access - not HTTPS access. This would be useless in environments where only HTTPS communication is allowed. Mar 31, 2021 at 12:21
  • 4
    @pabouk good point, the deploy key is an SSH key.
    – Sebastiaan
    Apr 5, 2021 at 6:46
1

If you think it's a bad idea to put your credentials in your source code (as you should!) then you have few options:

  1. Keep it hosted in a private GitHub repo but add those dozens of other people as collaborators to this repo (with read only access).

  2. Keep it hosted in a private GitHub repo but owned as an organization and add those people to the organization.

  3. Publish it as a private npm module.

  4. Publish it in a private npm registry.

  5. Include the dependency in the source code of the program that needs it.

The last one is basically like including the node_modules in the original code that uses that module so of course it's not pretty. Hosting your own npm registry is not trivial but you can automate adding users that way. Publishing private npm module is not free. Maintaining an organization full of people who should be able to access your repo is annoying.

Keep in mind one thing: if you share your credentials with more than one person, expect everyone to eventually have access to it, it's just a matter of time. The credentials could have a limited scope, it can be a read only deploy key or a machine user with restricted access, but if it is distributed it will leak eventually as it always does, especially when you share it with dozens of people. It's much better to keep a list of people who can access the code, and you can automate keeping that list up to date using the GitHub API.

I would never recommend distributing credentials in the source code of the project, no matter how limited access those credentials provide.

1
  • 2
    1) Even collaborators are prompted to enter a password or allow an SSH connection. I'd like to avoid that if possible. 2) This is how it's currently set up. See 1. 3-5) You already touched on why none of these are ideal and I agree. Mar 7, 2017 at 17:48
1

It's ugly that there are no scope for Read-only access to private repo.

What I suggest is to create a new token even with read/write as a Temporary token. Then pull/fetch the changes and delete the Token directly.

1

Apparently, GitHub has heard you and added a new beta feature called "Fine-Grained Tokens"!

https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/

"Create a fine-grained, repository-scoped token suitable for personal API use and for using Git over HTTPS"

Go to setting/developer settings/Personal Access Tokens/Fine grained token

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.