<p>CI token used for code checkout is not allowed to do writes to the git repository (unlike GitHub Actions). You need to generate a new personal token and add it to secrets.</p>
<p>See our integration project here as a sample: <a href="https://gitlab.com/taleodor/sample-helm-cd" rel="nofollow noreferrer">https://gitlab.com/taleodor/sample-helm-cd</a></p>
<p>Note, if you search through StackOverflow, you may find several other ways to achieve this but in any case you need to explicitly pass valid credentials that are able to write to the repo.</p>

CC BY-SA 4.0
2020-07-03T11:47:30.763Z
2020-07-03T11:47:30.763Z
taleodor
<p>My solution is very similar to @taleodor's, but it 1) uses the predefined CI_REGISTRY_USER variable, and 2) just resets the existing origin's url:</p>
<pre><code>  before_script:
    - git remote set-url origin https://${CI_REGISTRY_USER}:${API_TOKEN}@${CI_REPOSITORY_URL#*@}
</code></pre>
<p>I'd also recommend you use an access token for the project, not the user. Create the token by going to {PROJECT} / Settings / Access Tokens. Then create one with read/write repository.</p>

CC BY-SA 4.0
2021-06-28T19:05:11.190Z
2021-06-28T19:05:11.190Z
Jess
<p>I want to run a scheduled pipeline on the shared runners that is able to open a merge request on my repository. I want to run a script that checks if updates for my pinned packages exists and if yes it should update these and open a merge request with a new branch. I am using <a href="https://gitlab.com" rel="nofollow noreferrer">https://gitlab.com</a> and not a self hosted GitLab instance.</p>
<p>However pushing to my repository failed because whether using ssh or https the authentication is denied.</p>
<pre><code>remote: You are not allowed to upload code.
fatal: unable to access 'https://gitlab-ci-token:[MASKED]@gitlab.com/&lt;username&gt;/example.git/': The requested URL returned error: 403
</code></pre>
<p>or</p>
<pre><code>remote: HTTP Basic: Access denied
fatal: Authentication failed for 'https://&lt;username&gt;:@gitlab.com/&lt;username&gt;/example.git/'
</code></pre>
<p>My gitlab-ci.yml looks something like this</p>
<pre><code>doSth:
      image: image

      script:
        - chmod 700 doSth.sh
        - chmod 700 autoUpgrade.sh
        - ./doSth.sh
        - ./autoUpgrade.sh
</code></pre>
<p>My <em>autoUpgrade.sh</em> looks something like this.</p>
<pre><code>#!/bin/bash

if [[ `git status --porcelain` ]]; then
    git config --global user.email &quot;email@example.com&quot;
    git config --global user.name &quot;example&quot;
    export BRANCH_NAME=change-sth-`date +&quot;%s&quot;`
    git checkout -b ${BRANCH_NAME}
    git add -u
    git commit -m 'change sth.'
    # I tried using ssh and https
    # chmod 0400 $CI_DEPLOY_KEY
    # GIT_SSH_COMMAND=&quot;ssh -i ${CI_USER_TOKEN}&quot; git push --set-upstream origin ${BRANCH_NAME}
    git push https://${CI_USER}:${CI_USER_TOKEN}@gitlab.com/${CI_PROJECT_PATH}.git ${BRANCH_NAME}
else
</code></pre>
<p>Is it possible to push to a new branch in my repository using the shared runners? And if yes do you know what I am doing wrong?
echo &quot;Nothing changed&quot;
fi</p>

<gitlab><gitlab-ci-runner>
GitLab: Make commit in (shared) CI runner and push to repository/open merge request
Greeneco
# GitLab: Make commit in (shared) CI runner and push to repository/open merge request

(Asked by: username_0 on 2020-07-02)

I want to run a scheduled pipeline on the shared runners that is able to open a merge request on my repository. I want to run a script that checks if updates for my pinned packages exists and if yes it should update these and open a merge request with a new branch. I am using https://gitlab.com and not a self hosted GitLab instance.
However pushing to my repository failed because whether using ssh or https the authentication is denied.
remote: You are not allowed to upload code.
fatal: unable to access 'https://gitlab-ci-token:[MASKED]@gitlab.com//example.git/': The requested URL returned error: 403

or
remote: HTTP Basic: Access denied
fatal: Authentication failed for 'https://:@gitlab.com//example.git/'

My gitlab-ci.yml looks something like this
doSth:
      image: image

      script:
        - chmod 700 doSth.sh
        - chmod 700 autoUpgrade.sh
        - ./doSth.sh
        - ./autoUpgrade.sh

My autoUpgrade.sh looks something like this.
#!/bin/bash

if [[ `git status --porcelain` ]]; then
    git config --global user.email "email@example.com"
    git config --global user.name "example"
    export BRANCH_NAME=change-sth-`date +"%s"`
    git checkout -b ${BRANCH_NAME}
    git add -u
    git commit -m 'change sth.'
    # I tried using ssh and https
    # chmod 0400 $CI_DEPLOY_KEY
    # GIT_SSH_COMMAND="ssh -i ${CI_USER_TOKEN}" git push --set-upstream origin ${BRANCH_NAME}
    git push https://${CI_USER}:${CI_USER_TOKEN}@gitlab.com/${CI_PROJECT_PATH}.git ${BRANCH_NAME}
else

Is it possible to push to a new branch in my repository using the shared runners? And if yes do you know what I am doing wrong?
echo "Nothing changed"
fi

**Tags:** gitlab, gitlab-ci-runner


---

## 2 answers

### Answer by username_1 on 2020-07-03. Score: 2 | Accepted answer

CI token used for code checkout is not allowed to do writes to the git repository (unlike GitHub Actions). You need to generate a new personal token and add it to secrets.

See our integration project here as a sample: <https://gitlab.com/username_1/sample-helm-cd>

Note, if you search through StackOverflow, you may find several other ways to achieve this but in any case you need to explicitly pass valid credentials that are able to write to the repo.


---

### Answer by username_2 on 2021-06-28. Score: 1

My solution is very similar to @username_1's, but it 1) uses the predefined CI_REGISTRY_USER variable, and 2) just resets the existing origin's url:
  before_script:
    - git remote set-url origin https://${CI_REGISTRY_USER}:${API_TOKEN}@${CI_REPOSITORY_URL#*@}

I'd also recommend you use an access token for the project, not the user. Create the token by going to {PROJECT} / Settings / Access Tokens. Then create one with read/write repository.


---

