Problem installing Github-hosted library in requirements

[acarril]

I have no problem deploying the app with PyPI-hosted requirements. However, I'm trying to deploy a Chalice app that utilizes a Github-hosted library. My requirements.txt file looks like this:

chalice==1.27.1
git+https://github.com/acarril/cb-wrapper-dynamodb@ad48e0f#egg=dynamodb==0.5.2

When using this action in my workflow, it throws the following error:

Collecting dynamodb==0.5.2
  Cloning https://github.com/acarril/cb-wrapper-dynamodb (to revision ad48e0f) to /tmp/pip-install-xk83mepl/dynamodb_b9c4ae713d074bdc8d4613b7eba65dc1
  Running command git clone --filter=blob:none --quiet https://github.com/acarril/cb-wrapper-dynamodb /tmp/pip-install-xk83mepl/dynamodb_b9c4ae713d074bdc8d4613b7eba65dc1
  fatal: could not read Username for 'https://github.com/': No such device or address
  error: subprocess-exited-with-error
  
  × git clone --filter=blob:none --quiet https://github.com/acarril/cb-wrapper-dynamodb /tmp/pip-install-xk83mepl/dynamodb_b9c4ae713d074bdc8d4613b7eba65dc1 did not run successfully.
  │ exit code: 128
  ╰─> See above for output.

I think this might be a bug, since it it is not correctly reading the username from the clone URL?

[jayef0]

Hello @acarril

The problem is, as far as I can see, related to pip and not directly related to the chalice action.
But I want to provide solutions which are suitable for you.

Other places where the problem was discussed or is still in discussion:

• (PIP) Please add support for credentials via environment variables Please add support for credentials via environment variables pypa/pip#4789 (still open)
• https://docs.readthedocs.io/en/stable/guides/private-python-packages.html
• https://www.shellhacks.com/pip-install-from-private-pypi-repository/

Possible solution:

To prevent leaking your credentials or GitHub token, I think, the best solution would be to use environment variables.
These environment variables can be set without changing the action itself.

PIP_INDEX_URL = "https://user:secret@example.com"
PIP_EXTRA_INDEX_URL = "https://user:secret@example2.com"

The values of the environment variables behave like passed as arguments to Pip (--index-url --extra-index-url) and like defined in pip.conf.

It seems that, pip has since a few versions also support for the keyring system. I need to take a closer whether this would be a better solution for the chalice action.

[acarril]

I see, that makes sense. Thank you so much for pointing out those resources; I'll try the environment variables approach you mention.