Composer require private repository from gitlab ssh ignored - ssh

Question

I'm trying to pull a private repository from gitlab with composer without any success.
This is what I have in my composer.json file under repositories:
"repositories": [
{
"type": "vcs",
"url": "git#gitlab.com:the-vendor/dashboard-api.git"
}
]
When I clone the project like this: git#gitlab.com:the-vendor/dashboard-api.git manually, everything works fine.
Now when I require the project like so:
"require": {
"the-vendor/dashboard": "dev-orchestrate"
}
I also tried: "dev-main", "dev-main#dev", "dev-orchestrate#dev".
And run: composer update the-vendor/dashboard I get the following error:
Failed to download the-vendor/dashboard-api:The "https://gitlab.com/api/v4/projects/joij%2Fdashboard-api" file could not be downloaded (HTTP/2 404 ):
{"message":"404 Project Not Found"}
Your credentials are required to fetch private repository metadata (git#gitlab.com:the-vendor/dashboard-api.git)
A token will be created and stored in "/root/.composer/auth.json", your password will never be stored
To revoke access to this token you can visit https://gitlab.com/-/profile/personal_access_tokens
Username:
Installation failed, reverting ./composer.json and ./composer.lock to their original content.
I'm not sure what to make of this. Composer should be able to clone the project through ssh. But instead I get that vague 404 and then I have to give my username and password.
I also tried this:
"repositories": [
{
"type": "git",
"url": "git#gitlab.com:the-vendor/dashboard-api.git"
}
]
But then it behaves as if there is no "repositories" in the composer json at all, and I get this error:
Problem 1
- Root composer.json requires the-vendor/dashboard, it could not be found in any version, there may be a typo in the package name.
Potential causes:
- A typo in the package name
- The package is not available in a stable-enough version according to your minimum-stability setting
see <https://getcomposer.org/doc/04-schema.md#minimum-stability> for more details.
- It's a private package and you forgot to add a custom repository to find it
Read <https://getcomposer.org/doc/articles/troubleshooting.md> for further common problems.
This is the composer.json of the dashboard-api:
{
"name": "the-vendor/dashboard",
"type": "project",
"description": "TheVendor Dashboards",
"keywords": ["framework", "laravel"],
"license": "proprietary",
"require": {
"php": "^8.1",
"elasticsearch/elasticsearch": "v7.17.0",
"guzzlehttp/guzzle": "^7.2",
"laravel/framework": "^9.2",
"laravel/sanctum": "^2.14.1",
"laravel/tinker": "^2.7",
"ext-pdo": "*"
},
"require-dev": {
"fakerphp/faker": "^1.9.1",
"laravel/sail": "^1.0.1",
"mockery/mockery": "^1.4.4",
"nunomaduro/collision": "^6.1",
"phpunit/phpunit": "^9.5.10",
"phpspec/prophecy": "1.15.0",
"spatie/laravel-ignition": "^1.0"
},
"autoload": {
"psr-4": {
"TheVendor\\Dashboard\\": "app/",
"Database\\Factories\\": "database/factories/",
"Database\\Seeders\\": "database/seeders/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\\": "tests/"
}
},
"scripts": {
"post-autoload-dump": [
"Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
"#php artisan package:discover --ansi"
],
"post-update-cmd": [
"#php artisan vendor:publish --tag=laravel-assets --ansi --force"
],
"post-root-package-install": [
"#php -r \"file_exists('.env') || copy('.env.example', '.env');\""
],
"post-create-project-cmd": [
"#php artisan key:generate --ansi"
]
},
"extra": {
"laravel": {
"providers": [
"TheVendor\\Dashboard\\Providers\\AppServiceProvider",
"TheVendor\\Dashboard\\Providers\\ESClientServiceProvider",
"TheVendor\\Dashboard\\Providers\\ESCreateIndexesServiceProvider"
],
"dont-discover": []
}
},
"config": {
"optimize-autoloader": true,
"preferred-install": "dist",
"sort-packages": true
},
"minimum-stability": "dev",
"prefer-stable": true
}
I wonder if anyone knows what I'm missing.

Answer 1

Alright! I found the problem. There is no need to go for an auth.json with an API Token. This is where I went wrong:
The main branch had a different package name! The branch I was trying to pull had the right one, but if the main composer.json has a different package name you get this error:
Root composer.json requires the-vendor/dashboard, it could not be found in any version, there may be a typo in the package name.
Once you have that, and require the package like this:
"require": [
"the-vendor/dashboard": "dev-orchestrate"
]
With this in the root of composer.json
"repositories": [
{
"type": "git",
"url": "git#gitlab.com:the-vendor/dashboard-api.git"
}
]
It will simply use ssh to clone the private repository