Authorizing the Shift Build

Some Shifts perform analysis in order to provide more intelligent and precise automation. This requires building your projects by installing your dependencies and running scripts like artisan.

Currently, the following Shifts attempt to build your project:

• Laravel Linter
• Laravel Fixer
• Dependency Updater
• Test Generator

If you run one of these Shifts against a project with private dependencies, you may need to configure Shift.

Note: Shift has access to all first-party Laravel packages such as Spark and Nova, as well as some popular community packages from Spatie. As such, you are not required to configure authorization for these packages.

Fortunately, there are a two quick ways to authorize Shift.

1. Through Composer authentication
2. Granting Laravel Shift additional access to the private package

Composer Authentication

The easiest way to allow Shift to install private dependencies is to configure Composer. You may do so using an auth.json file, or, if you have a Shifty Plan, you may add this configuration to your plan settings.

Creating an auth.json file not only allows Shift to build your project, but other services like Forge and Chipper CI as well as other developers working with your code.

To configure an auth.json file, first add one to your project at the same level of your composer.json file. This file contains credentials for composer to download dependencies from private sources. While these credentials may be a user account, it's better to generate a token. You should treat these tokens like passwords.

The process for generating a token will vary. To generating a token for common sources, review the documentation from GitHub, Bitbucket, or GitLab.

Once you have obtained this token, use it as the credentials for that source within your auth.json file. The following auth.json file serves as an example for setting a token for each of the common Git services, as well as a commercial package like Nova:

{
    "http-basic": {
        "nova.laravel.com" : {
            "username": "nova-username",
            "password": "nova-password"
        }
    },
    "github-oauth": {
        "github.com": "ghp_1234567890"
    },
    "gitlab-oauth": {
        "gitlab.com": "gitlab-token-1234567890"
    },
    "bitbucket-oauth": {
        "bitbucket.org": {
            "consumer-key": "bitbucket-consumer-key-1234567890",
            "consumer-secret": "bitbucket-consumer-secret-1234567890"
        }
    }
}

Note: If you commit your composer.lock file, you should also run composer update to regenerate the download URLs within your composer.lock.

Granting Additional Access

If you own the private dependency, you may grant additional access to Shift. To do so, invite the Laravel Shift user to the repository with read only access. On all Git services, the username is laravel-shift with an email address of shift@laravelshift.com.

Since accepting this invitation is a manual process, you should also email support to follow-up on this request.