Answers: <p>CI token used for code checkout is not allowed to do writes to the git repository (unlike GitHub Actions). You need to generate a new personal token and add it to secrets.</p>
  <p>See our integration project here as a sample: <a href="https://gitlab.com/taleodor/sample-helm-cd" rel="nofollow noreferrer">https://gitlab.com/taleodor/sample-helm-cd</a></p>
  <p>Note, if you search through StackOverflow, you may find several other ways to achieve this but in any case you need to explicitly pass valid credentials that are able to write to the repo.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-07-03T11:47:30.763Z
Answers: 2020-07-03T11:47:30.763Z
Answers: taleodor
Answers: <p>My solution is very similar to @taleodor's, but it 1) uses the predefined CI_REGISTRY_USER variable, and 2) just resets the existing origin's url:</p>
  <pre><code>  before_script:
      - git remote set-url origin https://${CI_REGISTRY_USER}:${API_TOKEN}@${CI_REPOSITORY_URL#*@}
  </code></pre>
  <p>I'd also recommend you use an access token for the project, not the user. Create the token by going to {PROJECT} / Settings / Access Tokens. Then create one with read/write repository.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-06-28T19:05:11.190Z
Answers: 2021-06-28T19:05:11.190Z
Answers: Jess
Body: <p>I want to run a scheduled pipeline on the shared runners that is able to open a merge request on my repository. I want to run a script that checks if updates for my pinned packages exists and if yes it should update these and open a merge request with a new branch. I am using <a href="https://gitlab.com" rel="nofollow noreferrer">https://gitlab.com</a> and not a self hosted GitLab instance.</p>
  <p>However pushing to my repository failed because whether using ssh or https the authentication is denied.</p>
  <pre><code>remote: You are not allowed to upload code.
  fatal: unable to access 'https://gitlab-ci-token:[MASKED]@gitlab.com/&lt;username&gt;/example.git/': The requested URL returned error: 403
  </code></pre>
  <p>or</p>
  <pre><code>remote: HTTP Basic: Access denied
  fatal: Authentication failed for 'https://&lt;username&gt;:@gitlab.com/&lt;username&gt;/example.git/'
  </code></pre>
  <p>My gitlab-ci.yml looks something like this</p>
  <pre><code>doSth:
        image: image
  
        script:
          - chmod 700 doSth.sh
          - chmod 700 autoUpgrade.sh
          - ./doSth.sh
          - ./autoUpgrade.sh
  </code></pre>
  <p>My <em>autoUpgrade.sh</em> looks something like this.</p>
  <pre><code>#!/bin/bash
  
  if [[ `git status --porcelain` ]]; then
      git config --global user.email &quot;email@example.com&quot;
      git config --global user.name &quot;example&quot;
      export BRANCH_NAME=change-sth-`date +&quot;%s&quot;`
      git checkout -b ${BRANCH_NAME}
      git add -u
      git commit -m 'change sth.'
      # I tried using ssh and https
      # chmod 0400 $CI_DEPLOY_KEY
      # GIT_SSH_COMMAND=&quot;ssh -i ${CI_USER_TOKEN}&quot; git push --set-upstream origin ${BRANCH_NAME}
      git push https://${CI_USER}:${CI_USER_TOKEN}@gitlab.com/${CI_PROJECT_PATH}.git ${BRANCH_NAME}
  else
  </code></pre>
  <p>Is it possible to push to a new branch in my repository using the shared runners? And if yes do you know what I am doing wrong?
  echo &quot;Nothing changed&quot;
  fi</p>
  
Tags: <gitlab><gitlab-ci-runner>
Title: GitLab: Make commit in (shared) CI runner and push to repository/open merge request
UserDisplayName: Greeneco
ThreadText: # GitLab: Make commit in (shared) CI runner and push to repository/open merge request
  
  (Asked by: username_0 on 2020-07-02)
  
  I want to run a scheduled pipeline on the shared runners that is able to open a merge request on my repository. I want to run a script that checks if updates for my pinned packages exists and if yes it should update these and open a merge request with a new branch. I am using <https://gitlab.com> and not a self hosted GitLab instance.
  
  However pushing to my repository failed because whether using ssh or https the authentication is denied.
  
  ```
  remote: You are not allowed to upload code.
  fatal: unable to access 'https://gitlab-ci-token:[MASKED]@gitlab.com/<username>/example.git/': The requested URL returned error: 403
  
  ```
  
  or
  
  ```
  remote: HTTP Basic: Access denied
  fatal: Authentication failed for 'https://<username>:@gitlab.com/<username>/example.git/'
  
  ```
  
  My gitlab-ci.yml looks something like this
  
  ```
  doSth:
        image: image
  
        script:
          - chmod 700 doSth.sh
          - chmod 700 autoUpgrade.sh
          - ./doSth.sh
          - ./autoUpgrade.sh
  
  ```
  
  My *autoUpgrade.sh* looks something like this.
  
  ```
  #!/bin/bash
  
  if [[ `git status --porcelain` ]]; then
      git config --global user.email "email@example.com"
      git config --global user.name "example"
      export BRANCH_NAME=change-sth-`date +"%s"`
      git checkout -b ${BRANCH_NAME}
      git add -u
      git commit -m 'change sth.'
      # I tried using ssh and https
      # chmod 0400 $CI_DEPLOY_KEY
      # GIT_SSH_COMMAND="ssh -i ${CI_USER_TOKEN}" git push --set-upstream origin ${BRANCH_NAME}
      git push https://${CI_USER}:${CI_USER_TOKEN}@gitlab.com/${CI_PROJECT_PATH}.git ${BRANCH_NAME}
  else
  
  ```
  
  Is it possible to push to a new branch in my repository using the shared runners? And if yes do you know what I am doing wrong?
  echo "Nothing changed"
  fi
  
  **Tags:** gitlab, gitlab-ci-runner
  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_1 on 2020-07-03. Score: 2 | Accepted answer
  
  CI token used for code checkout is not allowed to do writes to the git repository (unlike GitHub Actions). You need to generate a new personal token and add it to secrets.
  
  See our integration project here as a sample: <https://gitlab.com/username_1/sample-helm-cd>
  
  Note, if you search through StackOverflow, you may find several other ways to achieve this but in any case you need to explicitly pass valid credentials that are able to write to the repo.
  
  
  ---
  
  ### Answer by username_2 on 2021-06-28. Score: 1
  
  My solution is very similar to @username_1's, but it 1) uses the predefined CI\_REGISTRY\_USER variable, and 2) just resets the existing origin's url:
  
  ```
    before_script:
      - git remote set-url origin https://${CI_REGISTRY_USER}:${API_TOKEN}@${CI_REPOSITORY_URL#*@}
  
  ```
  
  I'd also recommend you use an access token for the project, not the user. Create the token by going to {PROJECT} / Settings / Access Tokens. Then create one with read/write repository.
  
  
  ---
  
  