1

I'm trying to setup a GitLab CI pipeline which runs a script (convert-inventory-format.sh) that update a yaml file. I would then like to commit that file to a Git repository and push it.

However, the pipeline fails with the error:

remote: You are not allowed to upload code.

The user provided works when trying this process outside of a CI pipeline

this is my gitlab-ci file:

stages:
  - update_yaml

update_yaml:
  tags:
    - git
  stage: update_yaml
  script:
    - chmod +x $CI_PROJECT_DIR/convert-inventory-format.sh
    - $CI_PROJECT_DIR/convert-inventory-format.sh
    - ls
    - echo "Deploying to Git repository"
    - git config user.email "xxx"
    - git config user.name "xxx"
    - git add $CI_PROJECT_DIR/wiki_inventory.yaml
    - git status
    - git commit -m "Update formatted YAML"
    - git push origin InventoriesWiki
  variables:
    GIT_STRATEGY: fetch
    GIT_CHECKOUT: "false"
    GIT_PUSH_OPTS: "--force"
    GIT_USER: XXX
    GIT_PASSWORD: xxx

i'm not sure why this pipeline fails, what is the best practice for running git commits in a gitlab ci pipeline?

I appericiate your help

2 Answers 2

1

Are you attempting to push to the same git repo that the CI is running against? If so, GitLab CI jobs do not have permission to write to their respective repo, at least not by default.

If you really need to do this, you can add the necessary credentials to a CI variable. Go to Settings → CI/CD → Variables in either the Project or Group — you need to be a Maintainer or owner to do this. In your script you'll then need to apply these credentials when you run git (they'll be passed in as environment variables).

Beware of infinite recursion: if pushing to the repo causes CI to run again and push to the repo again... it would be bad.

1

From https://docs.gitlab.com/ee/ci/jobs/ci_job_token.html:

You can’t use a job token to push to a repository, but issue 389060 proposes to change this behavior.

Project/group scoped access tokens are popular solutions for the problem.

Also, as Laurence mentioned look into using git push -o ci-skip ... or [skip ci] in the commit message to avoid triggering CI again.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.