Recommended way to pass credentials

[ckipp01]

I just tried porting one of my work Ammonite scripts to scala-cli and hit on this and I thought it introduced a few interesting questions.

Passing credentials to the various tooling in Scala is a giant headache. If I have an sbt build, an Ammonite script, and Coursier locally, they all have their own ways to define repositories and credentials. This isn't just confusing for newcomers either. Search the Scala tools issue list for "credentials" and you'll get a ton of issues both solved and open. It'd be amazing for scala-cli if this was made easier somehow.

From what I can tell, this should require COURSIER_REPOSITORIES and COURSIER_CREDENTIALS to be set in order to pull a dependency from a private repo. If this is the recommended way, you already hit on issues since the COURSIER_CREDENTIALS seems to not really work? I submitted an issue for this a while back, and it seems others have hit on it as well: coursier/coursier#1826. For example I have this set for a script locally and when I try to run it with scala-cli compile . I can see it search through my COURSIER_REPOSITORIES, but not authenticate. The same happens with coursier cli unless I explicitly pass it the credentials. The same with creating a credentials.properties file, yet another way to do this.

So a few points/questions:

1. If the current way to do this is outlined correctly above, does it work or am I and a handful of others having issues with COURSIER_CREDENTIALS outliers?
2. What's the plan for this with scala-cli? Is there a way we could make this easier for a person at company X to grab a script and run it when it requires an artifact from a private repository without asking them to set those two variables?
3. None of this is currently in the docs and requires knowledge of coursier, so it might be good to mention this.

EDIT: I found the issue with 1 and shot in a pr to fix it. coursier/coursier#2242

[przemek-pokrywka]

I think that there will be generally two cases:

1. security-difficult, when the script will be also visible to people who are not allowed to access the private repository
2. security-easy, where one is free to put private repository's credentials into the script

For the second case, scala-cli is simply missing the relevant directives, perhaps we should create an appropriate issue.

For the first case though, one simply needs to store or type the credentials somewhere outside the script.
One needs either environment variables or command-line directive overrides or global configuration, which everybody tunes on their own so it contains the required credentials.

[ches]

Cross-referencing #293, I suggested making the using repository directive the prevailing recommendation for enabling custom repos, it seems idiomatic and good for reproducibility. COURSIER_REPOSITORIES could still be an advanced option for people and orgs who really want to make them implicit.

Credentials though, I think you're right, the ecosystem lacks a really good solution currently. It would be nice if perhaps Coursier could support platform keychains along the lines of sbt-keychain-credentials, and Scala CLI docs might simply point to a reference of how to set those by repo URL in the keychains. Or better yet have a scala-cli (and cs) subcommand to wrap entering them.

I could create a feature request on Coursier, maybe @alexarchambault won't mind being pinged here to see if that'd make sense and be welcome, since he's active in Scala CLI too.