Add ability to provide token for private repo for requirements_git in container build (#15831) (#6830)

Add ability to provide auth to private repo for requirements_git

.github/actions/awx_devel_image/action.yml

@@ -4,6 +4,10 @@ inputs:
   github-token:
     description: GitHub Token for registry access
     required: true
+  private-github-token:
+    description: GitHub Token for private repositories
+    required: false
+    default: ''
 runs:
   using: composite
   steps:
@@ -22,6 +26,11 @@ runs:
       run: |
         echo "${{ inputs.github-token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
 
+    - name: Add Private github token to requirements_git.credentials.txt
+      shell: bash
+      run: echo "https://x-access-token:${{ inputs.private-github-token }}@github.com" >> requirements/requirements_git.credentials.txt
+      if: ${{ inputs.private-github-token != '' }}
+
     - name: Pre-pull latest devel image to warm cache
       shell: bash
       run: docker pull -q ghcr.io/${OWNER_LC}/awx_devel:${{ github.base_ref }}

.github/actions/run_awx_devel/action.yml

@@ -9,6 +9,10 @@ inputs:
     required: false
     default: false
     type: boolean
+  private-github-token:
+    description: GitHub Token for private repositories
+    required: false
+    default: ''
 outputs:
   ip:
     description: The IP of the tools_awx_1 container
@@ -23,6 +27,7 @@ runs:
       uses: ./.github/actions/awx_devel_image
       with:
         github-token: ${{ inputs.github-token }}
+        private-github-token: ${{ inputs.private-github-token}}
 
     - name: Upgrade ansible-core
       shell: bash

.github/workflows/ci.yml

@@ -3,6 +3,7 @@ name: CI
 env:
   LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
   CI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  CI_PRIVATE_GITHUB_TOKEN: ${{ secrets.PRIVATE_GITHUB_TOKEN }}
   DEV_DOCKER_OWNER: ${{ github.repository_owner }}
   COMPOSE_TAG: ${{ github.base_ref || 'devel' }}
 on:
@@ -46,6 +47,7 @@ jobs:
         uses: ./.github/actions/awx_devel_image
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
+          private-github-token: ${{ secrets.PRIVATE_GITHUB_TOKEN }}
 
       - name: Run check ${{ matrix.tests.name }}
         run: AWX_DOCKER_CMD='${{ matrix.tests.command }}' make docker-runner
@@ -67,6 +69,7 @@ jobs:
         with:
           build-ui: false
           github-token: ${{ secrets.GITHUB_TOKEN }}
+          private-github-token: ${{ secrets.PRIVATE_GITHUB_TOKEN }}
 
       - name: Run smoke test
         run: ansible-playbook tools/docker-compose/ansible/smoke-test.yml -v
@@ -103,6 +106,12 @@ jobs:
         run: |
           python3 -m pip install docker
 
+      - name: Add Private github token to requirements_git.credentials.txt
+        shell: bash
+        working-directory: awx
+        run: echo "https://x-access-token:${{ env.CI_PRIVATE_GITHUB_TOKEN }}@github.com" >> requirements/requirements_git.credentials.txt
+        if: ${{ env.CI_PRIVATE_GITHUB_TOKEN != '' }}
+
       - name: Build AWX image
         working-directory: awx
         run: |
@@ -208,6 +217,7 @@ jobs:
         with:
           build-ui: false
           github-token: ${{ secrets.GITHUB_TOKEN }}
+          private-github-token: ${{ secrets.PRIVATE_GITHUB_TOKEN }}
 
       - name: Install dependencies for running tests
         run: |

.github/workflows/devel_images.yml

@@ -3,6 +3,7 @@ name: Build/Push Development Images
 env:
   LC_ALL: "C.UTF-8" # prevent ERROR: Ansible could not initialize the preferred locale: unsupported locale setting
   DOCKER_CACHE: "--no-cache" # using the cache will not rebuild git requirements and other things
+  CI_PRIVATE_GITHUB_TOKEN: ${{ secrets.PRIVATE_GITHUB_TOKEN }}
 on:
   workflow_dispatch:
   push:
@@ -85,6 +86,11 @@ jobs:
           make ui-next
         if: matrix.build-targets.image-name == 'awx'
 
+      - name: Add private GitHub token to requirements_git.credentials.txt
+        shell: bash
+        run: echo "https://x-access-token:${{ secrets.PRIVATE_GITHUB_TOKEN }}@github.com"" >> requirements/requirements_git.credentials.txt
+        if: ${{ env.CI_PRIVATE_GITHUB_TOKEN != '' }}
+
       - name: Build and push AWX devel images
         run: |
           make ${{ matrix.build-targets.make-target }}

.gitignore

@@ -141,6 +141,7 @@ reports
 local/
 *.mo
 requirements/vendor
+requirements/requirements_git.credentials.txt
 .i18n_built
 .idea/*
 *credentials*.y*ml*

MANIFEST.in

@@ -31,3 +31,4 @@ include COPYING
 include Makefile
 prune awx/public
 prune awx/projects
+prune requirements/requirements_git.credentials.txt

requirements/requirements_git.credentials.txt

@@ -0,0 +1,2 @@
+# If sources in requirements_git.txt require authentication add git-credentials in this file, Example:
+# https://x-access-token:${PAT}@github.com"

tools/ansible/roles/dockerfile/templates/Dockerfile.j2

@@ -66,8 +66,10 @@ RUN mkdir /tmp/requirements
 ADD requirements/requirements.txt \
     requirements/requirements_tower_uninstall.txt \
     requirements/requirements_git.txt \
+    requirements/requirements_git.credentials.txt \
     /tmp/requirements/
 
+RUN git config --global credential.helper "store --file=/tmp/requirements/requirements_git.credentials.txt"
 RUN cd /tmp && make requirements_awx
 
 ARG VERSION
@@ -95,6 +97,8 @@ RUN DJANGO_SETTINGS_MODULE=awx.settings.defaults SKIP_SECRET_KEY_CHECK=yes SKIP_
 
 {% endif %}
 
+RUN rm /tmp/requirements/requirements_git.credentials.txt
+
 # Final container(s)
 FROM quay.io/centos/centos:stream9