Provide info how to access private git dependencies via JWT access token (GitHub App)

[Gustl22]

Page URL

https://dart.dev/tools/pub/dependencies#git-packages

Page source

https://github.com/dart-lang/site-www/tree/main/src/content/tools/pub/dependencies.md

Describe the problem

For private git dependencies, it is recommended to use SSH. But GitHub themselves disengage SSH and also this is only feasable locally. On CIs for every private repo, a new SSH key has to be generated, which then can be entered in the repos as Deployment Key to allow fetching the dependency (one key CANNOT be used for multiple repos, unfortunately).

So we should give the hint to authenticate via access tokens, e.g. one generated with "GitHub App"s.

Here a common workflow:

    steps:
      - uses: actions/checkout@v4
      - uses: actions/create-github-app-token@v1
        id: app-token
        with:
          app-id: ${{ vars.APP_ID }}
          private-key: ${{ secrets.SSH_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
      - name: Set github url and credentials
        run: |
          git config --global --add url."https://x-access-token:${{ steps.app-token.outputs.token }}@github".insteadOf https://github
          git config --global --add url."https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/".insteadOf ssh://[email protected]:
          git config --global --add url."https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/".insteadOf [email protected]:

Would that be a valid approach to link in the docs?

Expected fix

Provide a link or add an example how to fetch private repository dependencies from git via access tokens.

Additional context

No response

I would like to fix this problem.

• I will try and fix this problem on dart.dev.