heroku_san uses wrong heroku account only when pushing git

[justin808]

Possibly related to: https://github.com/fastestforward/heroku_san/pull/86.

I can run this command with problem:

 git push heroku-staging develop:master

But if I try to run

rake staging deploy

I get this error below.

So I run the manual command to deploy above. And then I run

rake staging migrate

git update-ref refs/heroku_san/deploy HEAD^{commit}
git push [email protected]:staging-someapp.git  refs/heroku_san/deploy:refs/heads/master

 !  Your account [email protected] does not have access to staging-someapp.
 !
 !  SSH Key Fingerprint: blah blah

fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
git update-ref -d refs/heroku_san/deploy
rake aborted!
Command failed with status (128): [git push [email protected]:staging-someapp....]
/Users/justin/.rvm/gems/ruby-2.0.0-p451@someapp/gems/heroku_san-4.3.2/lib/heroku_san/git.rb:23:in `git_push'

[kmayer]

Hmmm. heroku_san just shells out to git, so anything that you do with git should work with heroku_san. It is possible that there's an environment variable inconsistency that would cause git to fail to find the proper credentials in a sub-shell.

Also, in the second example, rake staging migrate it is still trying to do a git push, while migrate should only need to run rake db:migrate on the dyno.

When git whines at me about access rights, I try running ssh -v [email protected] to see if I can authenticate, at all. You'll see a lot of gibberish, but at the very bottom, you'll see a line with 'public key accepted' and then a diagnostic message telling you that you can't run a remote shell (that's okay, I didn't want to run anything, I just want to see if I can connect). Usually this also tells me which ssh key git is trying to use, and usually, I discover that I'm using the wrong one.

On Mon, Mar 31, 2014 at 11:05 PM, Justin Gordon [email protected] wrote:

Possibly related to: #86https://github.com/fastestforward/heroku_san/pull/86 .

I can run this command with problem:

git push heroku-staging develop:master

But if I try to run

rake staging deploy

I get this error below.

So I run the manual command to deploy above. And then I run

rake staging migrate

git update-ref refs/heroku_san/deploy HEAD^{commit} git push [email protected]:staging-someapp.git refs/heroku_san/deploy:refs/heads/master

! Your account [email protected] does not have access to staging-someapp. ! ! SSH Key Fingerprint: blah blah

fatal: Could not read from remote repository.

Please make sure you have the correct access rights and the repository exists. git update-ref -d refs/heroku_san/deploy rake aborted! Command failed with status (128): [git push [email protected]:staging-someapp....] /Users/justin/.rvm/gems/ruby-2.0.0-p451@someapp/gems/heroku_san-4.3.2/lib/heroku_san/git.rb:23:in `git_push'

Reply to this email directly or view it on GitHubhttps://github.com/fastestforward/heroku_san/issues/165 .

[email protected] | (808) 722-6142 (c)

On Mon, Mar 31, 2014 at 11:05 PM, Justin Gordon [email protected]:

Possibly related to: #86https://github.com/fastestforward/heroku_san/pull/86 .

I can run this command with problem:

git push heroku-staging develop:master

But if I try to run

rake staging deploy

I get this error below.

So I run the manual command to deploy above. And then I run

rake staging migrate

git update-ref refs/heroku_san/deploy HEAD^{commit} git push [email protected]:staging-someapp.git refs/heroku_san/deploy:refs/heads/master

! Your account [email protected] does not have access to staging-someapp. ! ! SSH Key Fingerprint: blah blah

fatal: Could not read from remote repository.

Please make sure you have the correct access rights and the repository exists. git update-ref -d refs/heroku_san/deploy rake aborted! Command failed with status (128): [git push [email protected]:staging-someapp....] /Users/justin/.rvm/gems/ruby-2.0.0-p451@someapp/gems/heroku_san-4.3.2/lib/heroku_san/git.rb:23:in `git_push'

Reply to this email directly or view it on GitHubhttps://github.com/fastestforward/heroku_san/issues/165 .

[email protected] | (808) 722-6142 (c)

[justin808]

Thanks for the advice. When I run ssh -v [email protected], I get this: debug1: Authentication succeeded (publickey). Authenticated to heroku.com ([50.19.85.154]:22).

So I can't really blame heroku, as the basic commands work. How can I debug where heroku_san is going wrong? Any way to force the key? Note, I'm using https://github.com/ddollar/heroku-accounts.

[kmayer]

this is probably why:

To clone a git repository from Heroku, change 'heroku.com' to the Host of

the desired account defined in your .ssh/config:

$ git clone [email protected]:repository.git

i bet that heroku_san is using 'heroku.com' as a constant to construct the repos uri

On Tue, Apr 1, 2014 at 10:35 PM, Justin Gordon [email protected]:

Thanks for the advice. When I run ssh -v [email protected], I get this: debug1: Authentication succeeded (publickey). Authenticated to heroku.com([50.19.85.154]:22).

So I can't really blame heroku, as the basic commands work. How can I debug where heroku_san is going wrong? Any way to force the key? Note, I'm using https://github.com/ddollar/heroku-accounts.

Reply to this email directly or view it on GitHubhttps://github.com/fastestforward/heroku_san/issues/165#issuecomment-39290420 .

[email protected] | (808) 722-6142 (c)

[justin808]

@kmayer What does that imply for my .git/config file or my heroku.yml files?

[heroku]
  account = my_client
[remote "heroku-production"]
  url = [email protected]_client:my_client.git
  fetch = +refs/heads/*:refs/remotes/heroku-prod/*
[remote "heroku-staging"]
  url = [email protected]_client:staging-my_client.git
  fetch = +refs/heads/*:refs/remotes/heroku-dev/*

[kmayer]

The only remote that will work is heroku.com -- we'll need to write some code to handle this new "API"

On Wed, Apr 2, 2014 at 4:30 PM, Justin Gordon [email protected]:

@kmayer https://github.com/kmayer What does that imply for my .git/config file or my heroku.yml files?

[heroku] account = my_client [remote "heroku-production"] url = [email protected]_client:my_client.git fetch = +refs/heads/:refs/remotes/heroku-prod/ [remote "heroku-staging"] url = [email protected]_client:staging-my_client.git fetch = +refs/heads/:refs/remotes/heroku-dev/

Reply to this email directly or view it on GitHubhttps://github.com/fastestforward/heroku_san/issues/165#issuecomment-39396966 .

[email protected] | (808) 722-6142 (c)

[justin808]

If you can point me to the place, I can put together a pull request.

[kmayer]

Looks like it's already in there: https://github.com/fastestforward/heroku_san/blob/master/lib/heroku_san/stage.rb#L27

So all you need to do is add a "repo" attribute to each of your stage configurations, and that should do it.

https://github.com/fastestforward/heroku_san/blob/master/lib/templates/heroku.example.yml#L8

On Wed, Apr 2, 2014 at 9:31 PM, Justin Gordon [email protected]:

If you can point me to the place, I can put together a pull request.

Reply to this email directly or view it on GitHubhttps://github.com/fastestforward/heroku_san/issues/165#issuecomment-39411861 .

[email protected] | (808) 722-6142 (c)

[ashanbrown]

A problem with this approach is that the heroku.yml file (at least in my project) is checked into my repo, whereas my .gitconfig file is not and would ideally refer to Host entries in my .ssh/config file. Fortunately, heroku.yml is parsed as ERB, so you can do something like this:

<%
  repo_name = -> (name) { "[email protected]#{ENV['HEROKU_SUFFIX']}:#{name}.git" }
  %>

and then I have lines that look like:

  repo: repo_name.call('myapp-staging')

[Jaco-Pretorius]

I'm having the same issue as @justin808 (due to using multiple heroku accounts and heroku_san assuming the git remote is heroku.com). Is the suggestion by @dontfidget still the only suggested answer?

[kmayer]

afaik.

heroku_san is trying to keep things simple, but once you have a more complicated environment, it doesn't have all of the answers. You have to ask yourself whether you're trying too hard to make things work inside the gem's boundaries.

On Sun, Aug 10, 2014 at 2:40 PM, Jaco Pretorius [email protected] wrote:

I'm having the same issue as @justin808 https://github.com/justin808 (due to using multiple heroku accounts and heroku_san assuming the git remote is heroku.com). Is the suggestion by @dontfidget https://github.com/dontfidget still the only suggested answer?

— Reply to this email directly or view it on GitHub https://github.com/fastestforward/heroku_san/issues/165#issuecomment-51728251 .

[email protected] | (808) 722-6142 (c)

[Jaco-Pretorius]

Well, I think is probably an issue for everyone who has more than one Heroku account...

[justin808]

@kmayer @Jaco-Pretorius, I tried the approach of @dontfidget, as well as copy, pasting from my .git/config file. None of them work. I still get the error:

body: "{\"id\":\"forbidden\",\"error\":\"You do not have access to the app [[APP NAME]].\"}"
Excon::Errors::Forbidden: Expected(200) <=> Actual(403 Forbidden)

[justin808]

@kmayer @Jaco-Pretorius Any updates on this issue? I'd like to recommend this gem to a few projects.

[hiattp]

I've been using this with multiple accounts for a while, it seems to work fine except an auth error-out after the migration (which doesn't seem to have any negative consequence besides being annoying). You just need to make sure the heroku.yml file has the correct remote:

production:                                                                      
  app: myapp                                                                
  repo: [email protected]:myapp.git                                     
staging:                                                                         
   app: myapp-staging                                                        
   repo: [email protected]:myapp-staging.git

[justin808]

@hiattp Having an error on a deployment and "don't worry about it" would be a tough sell to team members.

[Jaco-Pretorius]

@justin808 I constantly use the solution suggested by @dontfidget and I don't have any problems (or error messages)

[kmayer]

Okay, I finally have some time to look at this bug and #173. I don't see any suggestions for change, though, which makes it hard for me to decide what would be helpful.