How to Use Private Repo A in Repo B via Composer Without Requiring a Token Every Time?

[inandi]

I have two private repositories on GitHub:

1. Repo A
2. Repo B (main project)

I want to use Repo A as a dependency in Repo B using Composer. Currently, I am using the VCS method in Composer to include Repo A. However, every time I do this, I need to provide a GitHub token, which is not ideal for my use case.

Is there a way to set up these repositories so that if a user has access to Repo B, they can pull Repo A via Composer without needing to provide a token each time? Essentially, I want Repo A to be accessible internally or via some method that doesn't require extra authentication steps if the user already has access to Repo B.

Any suggestions or best practices for setting this up would be greatly appreciated!

Thanks in advance!

[gabrielfrimodig]

To use Repo A as a dependency in Repo B via Composer without requiring a GitHub token every time, you should try SSH authentication instead of HTTPS.

Try this:

1. Update composer.json in Repo B: Change the URL for Repo A to use SSH:

{
  "repositories": [
    {
      "type": "vcs",
      "url": "git@github.com:your-org/repo-a.git"
    }
  ],
  "require": {
    "your-org/repo-a": "*"
  }
}

2. Make sure each user generates an SSH key pair (id_rsa and id_rsa.pub) on their machine using:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Add the public key (id_rsa.pub) to their GitHub account under Settings>SSH and GPG keys.

3. Use SSH agent for automatic authentication.
   Start the SSH agent:

eval "$(ssh-agent -s)"

Add the SSH key to the agent:

ssh-add ~/.ssh/id_rsa

4. Set Git to always use SSH by running this:

git config --global url."git@github.com:".insteadOf "https://github.com/"

Hope that helps!

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[DenisShagi]

1. Use SSH URLs in composer.json: In Repo B's composer.json, specify Repo A using its SSH URL. Replace yourusername and repo-a with your actual GitHub username and repository name.
   {
   "repositories": [
   {
   "type": "vcs",
   "url": "git@github.com:yourusername/repo-a.git",
   "no-api": true
   }
   ],
   "require": {
   "yourusername/repo-a": "dev-master"
   },
   "config": {
   "github-protocols": ["ssh"]
   }
   }
   "url": Use the SSH URL (git@github.com:...) instead of HTTPS.
   "no-api": true: Prevents Composer from accessing the GitHub API, which requires authentication.
   "github-protocols": ["ssh"]: Tells Composer to prefer SSH when accessing GitHub repositories.
   Ensure Users Have SSH Access:

2. All users should have their SSH keys added to their GitHub accounts. This allows seamless SSH authentication without needing to provide a token.

3. Users must have read access to both Repo A and Repo B.
   Avoid GitHub API Authentication: By setting "no-api": true, you instruct Composer not to use the GitHub API, which would otherwise require an OAuth token for private repositories.

4. Set Up Correct Package Names

5. Update Composer Configuration (Optional): If you prefer to set the GitHub protocol globally for all projects, you can run:
   composer config --global github-protocols ssh