gitlab CI install R package from private repository

Question

I am trying to build a gitlab CI file for an R package which lives in a private repository. This package depends on another R package in another private repository. To install the dependency package I am using the following approach which I am sure is not the best since the username/password details are exposed.

Is there an alternative way to install the dependency package from a private gitlab repository?

image: rocker/rstudio

stages:
- build

build_job:
  stage: build
  before_script:
    - apt-get update

  script:
    - Rscript -e "install.packages(c('covr','testthat','devtools'))"
    - Rscript -e "devtools::install_git('https://username:password@gitlab.com/project.git')"
    - Rscript -e "devtools::test()"
    - R CMD build . --no-build-vignettes --no-manual
    - PKG_FILE_NAME=$(ls -1t *.tar.gz | head -n 1)
    - R CMD check "${PKG_FILE_NAME}" --no-build-vignettes --no-manual
    - mkdir build
    - mv "${PKG_FILE_NAME}" $CI_PROJECT_DIR/build
  artifacts:
    paths:
      - build/
    expire_in: 1 week

Answer 1

After some more tries I found a way it could be done, you can create a group token for your project and use this instead of the username/password https://docs.gitlab.com/ee/user/project/deploy_tokens/

- Rscript -e "devtools::install_git('https://gitlab+deploy-token-891150:gH-QQZ3BHJuioZfZkl1M@gitlab.com/project.git')"