0

I want to run a scheduled pipeline on the shared runners that is able to open a merge request on my repository. I want to run a script that checks if updates for my pinned packages exists and if yes it should update these and open a merge request with a new branch. I am using https://gitlab.com and not a self hosted GitLab instance.

However pushing to my repository failed because whether using ssh or https the authentication is denied.

remote: You are not allowed to upload code.
fatal: unable to access 'https://gitlab-ci-token:[MASKED]@gitlab.com/<username>/example.git/': The requested URL returned error: 403

or

remote: HTTP Basic: Access denied
fatal: Authentication failed for 'https://<username>:@gitlab.com/<username>/example.git/'

My gitlab-ci.yml looks something like this

doSth:
      image: image

      script:
        - chmod 700 doSth.sh
        - chmod 700 autoUpgrade.sh
        - ./doSth.sh
        - ./autoUpgrade.sh

My autoUpgrade.sh looks something like this.

#!/bin/bash

if [[ `git status --porcelain` ]]; then
    git config --global user.email "email@example.com"
    git config --global user.name "example"
    export BRANCH_NAME=change-sth-`date +"%s"`
    git checkout -b ${BRANCH_NAME}
    git add -u
    git commit -m 'change sth.'
    # I tried using ssh and https
    # chmod 0400 $CI_DEPLOY_KEY
    # GIT_SSH_COMMAND="ssh -i ${CI_USER_TOKEN}" git push --set-upstream origin ${BRANCH_NAME}
    git push https://${CI_USER}:${CI_USER_TOKEN}@gitlab.com/${CI_PROJECT_PATH}.git ${BRANCH_NAME}
else

Is it possible to push to a new branch in my repository using the shared runners? And if yes do you know what I am doing wrong? echo "Nothing changed" fi

2

CI token used for code checkout is not allowed to do writes to the git repository (unlike GitHub Actions). You need to generate a new personal token and add it to secrets.

See our integration project here as a sample: https://gitlab.com/taleodor/sample-helm-cd

Note, if you search through StackOverflow, you may find several other ways to achieve this but in any case you need to explicitly pass valid credentials that are able to write to the repo.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.