Answers: <p>One method to do this is to generate a Project Access Token and store it as a protected environmental variable. You can do this like this,</p>
  <ul>
  <li>From the project page, add <code>/-/settings/access_tokens</code> to the end of the URL</li>
  <li>You need to create a token with
  <ul>
  <li>At least the role of <code>Developer</code> or greater (<a href="https://gitlab.com/gitlab-org/gitlab/-/issues/407725" rel="nofollow noreferrer"><strong>the default of Guest will NOT work</strong></a>)</li>
  <li>Add to the token a scope of <code>write_repository</code></li>
  </ul>
  </li>
  </ul>
  <p>Now you need to set this this token up in the project,</p>
  <ul>
  <li><p>With the <code>glab</code> tool use a command like this</p>
  <pre><code>glab variable set --protected REPO_WRITE_TOKEN myToken
  </code></pre>
  </li>
  <li><p>With the UI</p>
  <ul>
  <li>From the project page, add <code>/-/settings/ci_cd</code> to the end of the URL</li>
  <li>Under Variables click Expand</li>
  <li>Click &quot;Add Variable&quot;</li>
  </ul>
  </li>
  </ul>
  <p>Now all of your jobs have access to <code>REPO_WRITE_TOKEN</code> and can push up using,</p>
  <pre><code>git remote add merge_request &quot;https://does_not_mattter:${REPO_WRITE_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git&quot;
  </code></pre>
  <hr />
  <p>Unfortunately, the <a href="https://devops.stackexchange.com/q/19061/18965">Project Access Token UI page can't be pre-populated yet with query parameters and you can't currently make a Project Access Token from <code>glab</code> (the GitLab CLI tool)</a></p>
  
Answers: CC BY-SA 4.0
Answers: 2024-03-20T11:07:47.447Z
Answers: Shouldn't `SSH_REPO_KEY` be `REPO_WRITE_TOKEN` in the remote URL?
Answers: AlexV
Answers: CC BY-SA 4.0
Answers: 2024-03-20T15:14:23.623Z
Answers: @AlexV keen eye, and yes. That was a mistake on my part. =) thanks
Answers: Evan Carroll
Answers: CC BY-SA 4.0
Answers: 2024-03-19T23:36:22.500Z
Answers: 2024-03-20T15:14:10.403Z
Answers: 2024-03-20T15:14:10.403Z
Answers: Evan Carroll
Answers: <p>Sorry for long read...
  You could try that solution:
  <a href="https://docs.gitlab.com/ee/ci/docker/authenticate_registry.html#option-3-use-docker_auth_config" rel="nofollow noreferrer">https://docs.gitlab.com/ee/ci/docker/authenticate_registry.html#option-3-use-docker_auth_config</a>.</p>
  <p>That authentication approach can be defined in several ways:</p>
  <blockquote>
  <ul>
  <li>In pre_build_script in the runner configuration file.</li>
  <li>In before_script.</li>
  <li>In script.</li>
  </ul>
  </blockquote>
  <ol>
  <li><p>Set DOCKER_AUTH_CONFIG CI\CD variable on project\group\instance level (don't forget to check Expand option).
  Once you have DOCKER_AUTH_CONFIG set up correctly, Docker commands like docker push or docker pull in your GitLab CI/CD pipeline will be able to authenticate with the registry automatically.</p>
  </li>
  <li><p>Set variables REGISTRY_PULL_AUTH_BASE64 and REGISTRY_URL. REGISTRY_PULL_AUTH_BASE64 should contain base64 encoded login:password. Or use direct values registry.example.com and encoded login:password.</p>
  </li>
  </ol>
  <pre><code>echo -n 'login:password' | base64
  bG9naW46cGFzc3dvcmQ=
  </code></pre>
  <p>DOCKER_AUTH_CONFIG with nested variables.</p>
  <pre><code>{
      &quot;auths&quot;: {
          &quot;$REGISTRY_URL&quot;: {
              &quot;auth&quot;: &quot;$REGISTRY_PULL_AUTH_BASE64&quot;
          },
          &quot;$REGISTRY_URL&quot;: {
              &quot;auth&quot;: &quot;$REGISTRY_PUSH_AUTH_BASE64&quot;
          }
      }
  }
  </code></pre>
  <p>That's it. During pipeline execution variable will authenticate in docker automatically.</p>
  <p>.gitlab-ci.yml example before_script and script blocks:</p>
  <pre><code>before_script:
    - docker info
  
  build:
    script:
      - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG .
      - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-03-28T22:30:44.990Z
Answers: 2024-03-28T22:30:44.990Z
Answers: stalk3rr
Body: <p>Currently, <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/389060" rel="nofollow noreferrer"><code>CI_JOB_TOKEN</code> doesn't allow you to push to a repo</a>. When I try I get,</p>
  <blockquote>
  <p>remote: You are not allowed to upload code.</p>
  </blockquote>
  <p>How can I work around this if I need to push to the repo in the CI?</p>
  <p>The <code>CI_REPOSITORY_URL</code> which has the <code>CI_JOB_TOKEN</code> can not be used.</p>
  
Tags: <gitlab><gitlab-ci>
Title: How can I push to a repo when CI_JOB_TOKEN doesn't permit it?
UserDisplayName: Evan Carroll
ThreadText: # How can I push to a repo when CI_JOB_TOKEN doesn't permit it?
  
  (Asked by: username_0 on 2024-03-19)
  
  Currently, [`CI_JOB_TOKEN` doesn't allow you to push to a repo](https://gitlab.com/gitlab-org/gitlab/-/issues/389060). When I try I get,
  
  > remote: You are not allowed to upload code.
  
  How can I work around this if I need to push to the repo in the CI?
  
  The `CI_REPOSITORY_URL` which has the `CI_JOB_TOKEN` can not be used.
  
  **Tags:** gitlab, gitlab-ci
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_0 on 2024-03-19. Score: 1 | Accepted answer
  
  One method to do this is to generate a Project Access Token and store it as a protected environmental variable. You can do this like this,
  
  * From the project page, add `/-/settings/access_tokens` to the end of the URL
  * You need to create a token with
    + At least the role of `Developer` or greater ([**the default of Guest will NOT work**](https://gitlab.com/gitlab-org/gitlab/-/issues/407725))
    + Add to the token a scope of `write_repository`
  
  Now you need to set this this token up in the project,
  
  * With the `glab` tool use a command like this
  
    ```
    glab variable set --protected REPO_WRITE_TOKEN myToken
  
    ```
  * With the UI
  
    + From the project page, add `/-/settings/ci_cd` to the end of the URL
    + Under Variables click Expand
    + Click "Add Variable"
  
  Now all of your jobs have access to `REPO_WRITE_TOKEN` and can push up using,
  
  ```
  git remote add merge_request "https://does_not_mattter:${REPO_WRITE_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
  
  ```
  
  ---
  
  Unfortunately, the [Project Access Token UI page can't be pre-populated yet with query parameters and you can't currently make a Project Access Token from `glab` (the GitLab CLI tool)](https://devops.stackexchange.com/q/19061/18965)
  
  > **Comments:**
  > **username_1**: Shouldn't `SSH_REPO_KEY` be `REPO_WRITE_TOKEN` in the remote URL?  
  > **username_0**: @username_1 keen eye, and yes. That was a mistake on my part. =) thanks  
  
  ---
  
  ### Answer by username_2 on 2024-03-28. Score: 0
  
  Sorry for long read...
  You could try that solution:
  <https://docs.gitlab.com/ee/ci/docker/authenticate_registry.html#option-3-use-docker_auth_config>.
  
  That authentication approach can be defined in several ways:
  
  > * In pre\_build\_script in the runner configuration file.
  > * In before\_script.
  > * In script.
  
  1. Set DOCKER\_AUTH\_CONFIG CI\CD variable on project\group\instance level (don't forget to check Expand option).
     Once you have DOCKER\_AUTH\_CONFIG set up correctly, Docker commands like docker push or docker pull in your GitLab CI/CD pipeline will be able to authenticate with the registry automatically.
  2. Set variables REGISTRY\_PULL\_AUTH\_BASE64 and REGISTRY\_URL. REGISTRY\_PULL\_AUTH\_BASE64 should contain base64 encoded login:password. Or use direct values registry.example.com and encoded login:password.
  
  ```
  echo -n 'login:password' | base64
  bG9naW46cGFzc3dvcmQ=
  
  ```
  
  DOCKER\_AUTH\_CONFIG with nested variables.
  
  ```
  {
      "auths": {
          "$REGISTRY_URL": {
              "auth": "$REGISTRY_PULL_AUTH_BASE64"
          },
          "$REGISTRY_URL": {
              "auth": "$REGISTRY_PUSH_AUTH_BASE64"
          }
      }
  }
  
  ```
  
  That's it. During pipeline execution variable will authenticate in docker automatically.
  
  .gitlab-ci.yml example before\_script and script blocks:
  
  ```
  before_script:
    - docker info
  
  build:
    script:
      - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG .
      - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
  
  ```
  
  
  ---
  
  