Azure 管道在 npm 安装上失败，因为 package.Z466DEEC76ECDF5FCA6D38571FZ34 引用另一个存储库没有访问权限

Question

Hello I have added a javascript component to our project. This component lives in a common ui repo. When I added this component to the package.json it built fine locally since I have permission through SSH to pull it down. But in azure dev ops where we have the pipelines it is not building because the pipeline doesn't have access.

For example:

Main application: sits at https://visualstudio.com/app/_git/app/ Component library sits at https://visualstudio.com/library/_git/Common-Library#tag-v1.0.3-gitpkg

So when I add the library to my package.json and push this to the repository, the MVN build fails in Dev Ops on npm install

[INFO] npm ERR! 
[INFO] npm ERR! Host key verification failed.
[INFO] npm ERR! fatal: Could not read from remote repository.
[INFO] npm ERR! 

The MVN build does not have access to pull down the custom component from its repository.

package.json example

 "devDependencies": {
    "customComponent": "git+ssh://git@vs-ssh.visualstudio.com:v3/path/to/component-v1.1.0-gitpkg",
    "@babel/core": "^7.11.6",
    "@babel/preset-env": "^7.11.5",
    "@babel/preset-react": "^7.10.4",

My understanding is that I can add an SSH key to azure to allow it to pull down the repo but our Dev ops guys dont want that because then that SSH key is tied to that person.

Is there an alternative way of doing this so that the MVN build can access the repository?

Answer 1

An alternative workaround is to add credentials(https and oauth) directly in url, for example like this:

"dependencies": {
    "another-dependency": "git+https://<username>:<password>@bitbucket.org/xxx/repo.git"
}

It has disadvantage since we store the credential directly as plain-text in package.json file, which lacks security if someone else can access your package.json file. So it depends on you whether to use this workaround.

If you don't want to use plaintext, you can add a File Transform task to replace the old url with new certified url before your npm install steps.

Define a dependencies.another-dependency variable with value git+https://<username>:<password>@xxx.org/... , set it as secret.

Use File Transform task to replace the url in package.json file.