GitLab: Make commit in (shared) CI runner and push to repository/open merge request

Question

I want to run a scheduled pipeline on the shared runners that is able to open a merge request on my repository. I want to run a script that checks if updates for my pinned packages exists and if yes it should update these and open a merge request with a new branch. I am using https://gitlab.com and not a self hosted GitLab instance.

However pushing to my repository failed because whether using ssh or https the authentication is denied.

remote: You are not allowed to upload code.
fatal: unable to access 'https://gitlab-ci-token:[MASKED]@gitlab.com/<username>/example.git/': The requested URL returned error: 403

or

remote: HTTP Basic: Access denied
fatal: Authentication failed for 'https://<username>:@gitlab.com/<username>/example.git/'

My gitlab-ci.yml looks something like this

doSth:
      image: image

      script:
        - chmod 700 doSth.sh
        - chmod 700 autoUpgrade.sh
        - ./doSth.sh
        - ./autoUpgrade.sh

My autoUpgrade.sh looks something like this.

#!/bin/bash

if [[ `git status --porcelain` ]]; then
    git config --global user.email "[email protected]"
    git config --global user.name "example"
    export BRANCH_NAME=change-sth-`date +"%s"`
    git checkout -b ${BRANCH_NAME}
    git add -u
    git commit -m 'change sth.'
    # I tried using ssh and https
    # chmod 0400 $CI_DEPLOY_KEY
    # GIT_SSH_COMMAND="ssh -i ${CI_USER_TOKEN}" git push --set-upstream origin ${BRANCH_NAME}
    git push https://${CI_USER}:${CI_USER_TOKEN}@gitlab.com/${CI_PROJECT_PATH}.git ${BRANCH_NAME}
else

Is it possible to push to a new branch in my repository using the shared runners? And if yes do you know what I am doing wrong? echo "Nothing changed" fi

Answer 1

CI token used for code checkout is not allowed to do writes to the git repository (unlike GitHub Actions). You need to generate a new personal token and add it to secrets.

See our integration project here as a sample: https://gitlab.com/taleodor/sample-helm-cd

Note, if you search through StackOverflow, you may find several other ways to achieve this but in any case you need to explicitly pass valid credentials that are able to write to the repo.

Answer 2

My solution is very similar to @taleodor's, but it 1) uses the predefined CI_REGISTRY_USER variable, and 2) just resets the existing origin's url:

  before_script:
    - git remote set-url origin https://${CI_REGISTRY_USER}:${API_TOKEN}@${CI_REPOSITORY_URL#*@}

I'd also recommend you use an access token for the project, not the user. Create the token by going to {PROJECT} / Settings / Access Tokens. Then create one with read/write repository.