Swift Package Manager and private github repos

The last couple of days I have been exploring the possibilities of building a REST API in Swift for a pet project of mine. I have been trying to deploy it to Heroku, following the instructions in this post.

Now, I want to share some code, that I want to deploy as a Swift package, between my client side and server side projects. And that shared code lives in a private repo in github.

So, there are two ways to do that (there might be more, but I am only aware of these two).

First, expose the username and password in the Package declaration.

import PackageDescription

let package = Package(
    name: "MyPackage",
    dependencies: [
        .Package(url: "https://github.com/loganwright/vapor.git", majorVersion: 0),
        .Package(url: "https://username:password@github.com/ctarda/MyPackage.git", majorVersion: 0)     
    ]
)

Obviously, this is not good.

The second one, is by authenticating with a personal access token. Personal access token are available in github’s Personal Settings > Personal access tokens. What seems to work for me is selecting “repo” as scope (which includes repo:status, repodeployment and publicrepo)

Adding the token to the Package manifest like this:

import PackageDescription

let package = Package(
    name: "MyPackage",
    dependencies: [
        .Package(url: "https://github.com/loganwright/vapor.git", majorVersion: 0),
        .Package(url: "https://XXXXX_token_XXX:x-oauth-basic@github.com/ctarda/MyPackage.git", majorVersion: 0)     
    ]
)

allows Heroku to check my private repo out and build my project every time I trigger a new deployment.

If you know of a better way to do this, please sound off in the comments!