Python Pipenv project with multiple private Github-hosted dependencies

[mtr]

Hi,

I'm trying to set up Qodana for a Python project P, which uses Pipenv for dependency management. There are several private sub-dependencies, d1, d2, …. Each such dependency has a configuration line like the following in the Pipfile under [packages]

…
[packages]
d1 = {editable = true, git = "ssh://[email protected]/<user_a>/d1.git"}
…
d2 = {editable = true, git = "ssh://[email protected]/<user_b>/d2.git"}
…

Until now, Pipenv have retrieved these dependencies automatically during deployment using a separate deployment SSH-key. However, since Qodana strongly (and correctly) advices against storing secrets such as private keys in the Qodana configuration, I wonder how to best accommodate for this scenario?

[brichbash]

Hello,

Sorry for the delay.
Pipenv supports environment variables, so I would suggest you extract your token to a variable, e.g. $PIP_TOKEN1, and then add to your Qodana job configuration a GitHub secret:

env:
  PIP_TOKEN1: ${{ secrets.PIP_TOKEN1 }}