Import Private Github Repo via Environment Variables

[juansc]

You can use pip to pull a private Github repo using environment variables.

# requirements.txt
git+https://${AUTH_USER}:${AUTH_PASSWORD}@github.com/user/myproject.git@1.2.3#egg=myproject

Then run

> pip install -r requirements.txt

Is there a way to do this with Pipenv? I tried using the environment variable method described here, but it looks like it's not the right approach.

Could not find a version that matches myproject (from -r /var/folders/6r/719kpmn511l0ghtx4v1rbxdm0000gn/T/pipenv-5xvfp5mw-requirements/pipenv-wm4ivcah-constraints.txt (line 11))
No versions found
Were https://pypi.python.org/simple or git+https://${AUTH_USER}:${AUTH_PASSWORD}@github.com/user/myproject.git#egg=myproject reachable?

$ pipenv --support

Pipenv version: '2018.7.1'

Pipenv location: '/usr/local/lib/python2.7/site-packages/pipenv'

Python location: '/usr/local/opt/python@2/bin/python2.7'

Other Python installations in PATH:

• 2.7: /usr/local/bin/python2.7

• 2.7: /usr/local/bin/python2.7

• 2.7: /usr/bin/python2.7

• 3.6: /usr/local/bin/python3.6m

• 3.6: /usr/local/bin/python3.6

• 2.7.14: /usr/local/bin/python

• 2.7.10: /usr/bin/python

• 2.7.14: /usr/local/bin/python2

• 3.6.5: /usr/local/bin/python3

PEP 508 Information:

{'implementation_name': 'cpython',
 'implementation_version': '0',
 'os_name': 'posix',
 'platform_machine': 'x86_64',
 'platform_python_implementation': 'CPython',
 'platform_release': '17.6.0',
 'platform_system': 'Darwin',
 'platform_version': 'Darwin Kernel Version 17.6.0: Tue May  8 15:22:16 PDT 2018; root:xnu-4570.61.1~1/RELEASE_X86_64',
 'python_full_version': '2.7.14',
 'python_version': '2.7',
 'sys_platform': 'darwin'}

System environment variables:

• AUTH_USER
• AUTH_PASSWORD

Pipenv–specific environment variables:

Debug–specific environment variables:

• PATH: /Users/juansc/.local/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/go/bin:/opt/X11/bin:/Users/juansc/git/go/bin
• SHELL: /bin/zsh
• LANG: en_US.UTF-8
• PWD: /Users/juansc/git/project/

---

Contents of Pipfile ('/Users/juansc/git/project/Pipfile'):

[[source]]
url = "https://pypi.python.org/simple"
verify_ssl = true
name = "pypi"

[[source]]
url = "git+https://${AUTH_USER}:${AUTH_PASSWORD}@github.com/user/myproject.git#egg=myproject"
verify_ssl = true
name = "myproject-name"

[packages]
myproject = {'ref'='1.2.3', index="myproject-name"}

[requires]
python_version = "3.6"

Contents of Pipfile.lock ('/Users/juansc/git/project/Pipfile.lock'):

{
    "_meta": {
        "hash": {
            "sha256": "c4290d9b83dd0d70dc2972be0caa2eb452670ce057ca3b973290f5b618020783"
        },
        "pipfile-spec": 6,
        "requires": {
            "python_version": "3.6"
        },
        "sources": [
            {
                "name": "pypi",
                "url": "https://pypi.python.org/simple",
                "verify_ssl": true
            },
            {
                "name": "myproject-name",
                "url": "git+https://${AUTH_USER}:${AUTH_PASSWORD}@github.com/user/myproject.git#egg=myproject",
                "verify_ssl": true
            }
        ]
    },
    "default": {
    }
}

[matteius]

I just triaged this issue and opened a PR that fixes it, but the downside is if the user isn't use environment variables, and uses the actual credentials in the requirements.txt that will be brought into the Pipfile in plaintext. I am not sure there is a great way to prevent that.

[matteius]

Updates the PR to handle the cases of user defined variables, vs raw username and password values.