Overcoming CI_JOB_TOKEN Limitations for Pushing to Repository in GitLab CICD Setup

You’re encountering an issue when pushing code during a job run on GitHub Actions or other similar platforms, where your CI_JOB_TOKEN is not authorized. This occurs because the token provided by these CI systems doesn’t grant upload permissions to private repositories for security reasons. However, there’s still room for you to push code within a GitLab repository using alternative methods under controlled conditions:

Generating and Using Project Access Tokens in Your Job Scripts

1. Create the Token: Firstly head over to your project page on GitLab by appending /-/settings at the end of URL if you’re not already there, navigate to Access tokens. Here, create a new token with:
   • Role set as Developer or higher (since Guest won’t suffice).
   • A scope including both read and write permissions for repositories. This can be labeled under ‘Write repository’.
2. Set the Token Environmentally in your Job Scripts: Depending on whether you’re using a command-line interface (glab) or GitLab’s UI, follow these steps to set up REPO_WRITE_TOKEN with token value as environment variable for use within job scripts executed by CI systems.
   • CLI Approach (with glab): Use the following command:

     glab variable set --protected REPO_WRITE_TOKEN myTokenValueHere
     # Here 'myTokenValueHere' is your generated token which should be used without quotations. Ensure to store this securely and not expose it within scripts directly for security reasons.
     git remote add merge-request "https://does_not_matter:${REPO_WRITE_TOKEN}@gitlabserver/projectpath.git" # Please replace with your actual server URL & project path, remove spaces around the colon and ensure token is properly referenced in script environment variable
     

   • GitLab UI Approach (using glab or other CI tool): Navigate to /-/settings, then select ‘CI / CD’ settings. Expand this section by clicking on it, add a new Variable with the name set as something like “REPO_WRITE_TOKEN”, and input your newly generated token thereafter referencing ${VARIABLE} in script commands accordingly for pushing upstream code changes:

     git remote add merge-request https://does_not_matter:${REPO_WRITE_TOKEN}@gitlabserver/projectpath.git # Remember to substitute placeholders with actual project path and token name as required by your CI system's syntax for referencing environment variables in scripts
     

Remember, these tokens are sensitive; keep them securely managed within the confines of job execution only where necessary due to their privileged access.