title: How can gitlab-CI install private python packages from a gitlab dependency that also refers to gitlab repositories
body: <p>This question is about how to manage access for private gitlab python packages with nested dependencies on other private gitlab packages.  This assumes all the access is via direct git repository patterns and not a private package repository.</p>
  
  <p><code>package-a</code> is in a private gitlab repository and it depends on <code>package-b</code>, which depends on <code>package-c</code> and they are also in a private gitlab repository.</p>
  
  <p><code>package-a</code> has a <code>pyproject.toml</code> like this:</p>
  
  <pre><code>[tool.poetry]
  name = "package-a"
  repository = "https://gitlab.com/org/package_a.git"
  
  [tool.poetry.dependencies]
  python = "^3.6"
  package-b = {git = "ssh://git@gitlab.com/org/package_b.git", tag = "0.1.0"}
  </code></pre>
  
  <p><code>package-b</code> has a <code>pyproject.toml</code> like this:</p>
  
  <pre><code>[tool.poetry]
  name = "package-b"
  repository = "https://gitlab.com/org/package_b.git"
  
  [tool.poetry.dependencies]
  python = "^3.6"
  package-c = {git = "ssh://git@gitlab.com/org/package_c.git", tag = "0.1.0"}
  </code></pre>
  
  <p>Any user with the right <code>org</code> membership on gitlab and an ssh-key can use <code>poetry</code> to install <code>package-a</code> and it's dependency on <code>package-b</code> and then it's dependency on <code>package-c</code>, all into a python venv on a development laptop.  The <code>ssh</code> protocol access also works for docker builds (with experimental features for ssh mounts).</p>
  
  <p>However, the same projects with private dependencies are not installed in gitlab-CI runners, because they lack ssh access.  (Is there any secure way to enable that?)</p>
  
  <p>Assuming the gitlab-CI runners <em>must</em> use an access token to clone the private gitlab repositories, a <code>sed</code> script is applied to the <code>pyproject.toml</code> file for <code>project-a</code>, so the gitlab-CI runner can clone <code>package-b</code> to discover that it depends on <code>package-c</code>; the <code>sed</code> script changes the ssh to https access for <code>project-b</code> by editing the <code>project-a</code> dependency spec in <code>pyproject.toml</code>, i.e.</p>
  
  <pre><code>sed -i -e 's#ssh://git@gitlab.com/org#https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/org#g' pyproject.toml
  </code></pre>
  
  <p>The CI_JOB_TOKEN is an environment variable provided by the gitlab-CI runner.  It is securely managed by the gitlab-CI runner.  So, gitlab-CI runner can now clone the <code>project-b</code> repository <em>somewhere</em>.  The same sed trick might work if it could be applied to this <code>project-b</code> repository <em>somewhere</em>, but this is now in the hands of <code>poetry</code> and it cannot be touched.  So <code>project-b</code> has a git+ssh dependency on <code>project-c</code> and the gitlab-CI runner fails to install <code>project-c</code> because it has no git+ssh credentials to clone it.</p>
  
  <p>Thus, the private package dependency chain works for development and docker build on a laptop with git+ssh access, but it's all broken on gitlab-CI.  What's the better practice to manage this private package access across all these build environments?</p>