Skip to content

Unable to use $CI_JOB_TOKEN for private taskfile includes that live in GitLab #213

Description

@RothAndrew

Environment

Device and OS:
App version:
Kubernetes distro being used:
Other:

Steps to reproduce

  1. Make an Internal repo in GitLab with a task file in it.
  2. Make another repo in GitLab that has a tasks.yaml file that includes: the internal repo's task file
  3. In the latter repo try to run a maru task in .gitlab-ci.yml after setting the MARU_AUTH env var to
  variables:
    MARU_AUTH: '{"gitlab.example.com": "$CI_JOB_TOKEN"}'

$CI_JOB_TOKEN is a GitLab Built-In variable. Read more about it here.

Expected result

It works

Actual Result

It doesn't work, because Maru uses the GitLab Files API, which $CI_JOB_TOKEN isn't allowed to use

Visual Proof (screenshots, videos, text, etc)

Severity/Priority

Medium I'd say? We're having to do some suuuuuper gross things with Group Tokens to get around this major limitation, but it isn't an immediate show-stopper.

Additional Context

This doesn't work only because $CI_JOB_TOKEN isn't allowed to use the Files API. It IS allowed to git clone. So, the likely route forward is changing Maru's includes: logic so that it does a git clone rather than using an API.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions