如何避免在开发小组中仅使用的宝石中的Bundler身份验证来调用生产中的呼叫？

发布于 2025-01-26 02:53:01 字数 1375 浏览 2 评论 0原文

目前，我们在私人GitHub存储库中托管了一个GEM（自定义版本的Rubocop），用于我们的Rails应用程序之一。为了成功地Bundle install GEM，Bundler需要具有对该存储库的读取权限的凭据。我们仅将此宝石用于本地开发，因此该宝石在我们项目的Gemfile的开发组下列出：

group :development do
 ...

 source 'https://rubygems.pkg.github.com/<org>' do
   gem '<custom-gem>'
 end
end

gemfile.lock in

GEM
  remote: https://rubygems.pkg.github.com/<org>/
  specs:
    <org>-rubocop (0.1.2)
      rubocop (= 0.77.0)
      rubocop-rails (= 2.4.0)

for Production for Production，我们不需要此宝石，但是我们在部署阶段遇到了错误捆绑包仍在要求凭证，即使宝石将不使用。

在将Bundler从2.2.28升级到2.3.7之后，此错误可能已经表现出来，但我们对此并不积极。

是否可以配置Bundler以避免对不使用的GEM进行身份验证？如果我们可以避免此身份验证调用，那么我们可以避免在生产环境中指定敏感的凭据，这将少得多...任何捆绑的文档或现有的GitHub问题回答这个问题，都将不胜感激！

其他详细信息：

Ruby 3.1.1

Rails 7.0.2.3

在生产构建中，我们指定了以下命令：

bundle config set --local without 'development test' && bundle install

构建日志将我们分配到问题：

Step #1 - "build-push": Authentication is required for rubygems.pkg.github.com.
Step #1 - "build-push": Please supply credentials for this source. You can do this by running:
Step #1 - "build-push": `bundle config set --global rubygems.pkg.github.com username:password`
Step #1 - "build-push": or by storing the credentials in the `BUNDLE_RUBYGEMS__PKG__GITHUB__COM`

原文

We currently host a gem (custom version of rubocop) in a private Github repo for one of our rails applications. In order to successfully bundle install that gem, bundler needs to have credentials with read permissions to that repo. We only use this gem for local development, and so the gem is listed under the development group in our project's Gemfile:

group :development do
 ...

 source 'https://rubygems.pkg.github.com/<org>' do
   gem '<custom-gem>'
 end
end

Associated entry in Gemfile.lock

GEM
  remote: https://rubygems.pkg.github.com/<org>/
  specs:
    <org>-rubocop (0.1.2)
      rubocop (= 0.77.0)
      rubocop-rails (= 2.4.0)

For production, we do not need this gem, however we encountered an error during the deploy phase where bundle is still asking for the credentials, even though the gem will not be in use.

This error may have manifested itself after upgrading bundler from 2.2.28 to 2.3.7, but we're not positive about that.

Is it possible to configure bundler to avoid making the authentication call for a gem that will not be in use? If we can avoid this authentication call, then we can avoid specifying sensitive credentials in our production environment, which would be a lot less work...Any bundler documentation or existing Github issue that answers this question would be greatly appreciated!

Other details:

Ruby 3.1.1

Rails 7.0.2.3

In production build, we are specifying the following command:

bundle config set --local without 'development test' && bundle install

Build Logs tipping us off to the issue:

Step #1 - "build-push": Authentication is required for rubygems.pkg.github.com.
Step #1 - "build-push": Please supply credentials for this source. You can do this by running:
Step #1 - "build-push": `bundle config set --global rubygems.pkg.github.com username:password`
Step #1 - "build-push": or by storing the credentials in the `BUNDLE_RUBYGEMS__PKG__GITHUB__COM`

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

三月梨花 2025-02-02 02:53:01

如果我不得不猜测，我认为您需要更新您的命令才能跳过结肠分离的小组列表。

来自文档

没有（bundle_without）：a： - 分开gems bundler不应安装的组的列表。

因此，请尝试将您的命令更新为以下内容，然后查看会发生什么：

Bundle config set -lotemal nove''development：test'＆amp;＆amp;捆绑安装

回复收藏 0 原文

第几種人 2025-02-02 02:53:01

不确定这是否是该问题的无所不能的答案，但是以下更改似乎可以解决问题。我很想听听任何可能有一些想法的人可能会解释为什么此解决方案有效或认为我的假设的想法的人：）

我们的gemfile.lock.lock具有以下条目：

PLATFORMS
  x86_64-darwin-21

添加以下平台条目：
捆绑锁-ADD-PLATFORM X86_64-LINUX

导致Platforms输入

PLATFORMS
  x86_64-darwin-21
  x86_64-linux

此次更新后要更新到此更新后，Bundler似乎尊重Gem group托管我们自定义宝石的私人回购的身份验证请求。

Not sure if this is an all-encompassing answer to the issue, but the following changes seem to resolve the problem. I'd love to hear from anyone who might have some thoughts that might explain why this solution works or thoughts disproving my hypothesis : )

Our Gemfile.lock had the following entry:

PLATFORMS
  x86_64-darwin-21

Adding the following platform entry:
bundle lock --add-platform x86_64-linux

Results in a the Platforms entry to be updated to

PLATFORMS
  x86_64-darwin-21
  x86_64-linux

After this update, bundler seems to be respecting the gem groups and does not make an authentication request to the private repo hosting our custom gem.

回复收藏 0 原文