Recently I encountered an issue where a CI tool could not fetch certain dependencies as the SSH key used for cloning the main project did not have access to the other repositories.
To work around this, I opted to clone the private dependencies via https, passing the credentials in the URI.
The magic to force this without changing composer.json
:
# Set the COMPOSER_USER and COMPOSER_TOKEN environment variables to a user which has access to clone these repos.
git config --global url."https://${COMPOSER_USER}:${COMPOSER_TOKEN}@gitlab.example.com/".insteadOf "git@gitlab.example.com:"
You can also clone public repos via the https endpoint rather than ssh like this:
git config --global url."https://github.com/".insteadOf 'git@github.com:'
In context of a GitLab CI .gitlab-ci.yml
file, it looks like this:
build:
script:
# Use https clone URLs.
- git config --global url."https://${COMPOSER_USER}:${COMPOSER_TOKEN}@gitlab.example.com/".insteadOf "git@gitlab.example.com:"
- git config --global url."https://github.com/".insteadOf 'git@github.com:'
- composer --no-progress install
Of course this can also be reversed, if you have a https clone URL, you can change it to a ssh or git uri.
Interestingly CircleCI uses this method to force cloning github repos via ssh - https://discuss.circleci.com/t/github-forced-through-ssh-protocol/5332/2