<p>One method to do this is to generate a Project Access Token and store it as a protected environmental variable. You can do this like this,</p>
<ul>
<li>From the project page, add <code>/-/settings/access_tokens</code> to the end of the URL</li>
<li>You need to create a token with
<ul>
<li>At least the role of <code>Developer</code> or greater (<a href="https://gitlab.com/gitlab-org/gitlab/-/issues/407725" rel="nofollow noreferrer"><strong>the default of Guest will NOT work</strong></a>)</li>
<li>Add to the token a scope of <code>write_repository</code></li>
</ul>
</li>
</ul>
<p>Now you need to set this this token up in the project,</p>
<ul>
<li><p>With the <code>glab</code> tool use a command like this</p>
<pre><code>glab variable set --protected REPO_WRITE_TOKEN myToken
</code></pre>
</li>
<li><p>With the UI</p>
<ul>
<li>From the project page, add <code>/-/settings/ci_cd</code> to the end of the URL</li>
<li>Under Variables click Expand</li>
<li>Click &quot;Add Variable&quot;</li>
</ul>
</li>
</ul>
<p>Now all of your jobs have access to <code>REPO_WRITE_TOKEN</code> and can push up using,</p>
<pre><code>git remote add merge_request &quot;https://does_not_mattter:${REPO_WRITE_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git&quot;
</code></pre>
<hr />
<p>Unfortunately, the <a href="https://devops.stackexchange.com/q/19061/18965">Project Access Token UI page can't be pre-populated yet with query parameters and you can't currently make a Project Access Token from <code>glab</code> (the GitLab CLI tool)</a></p>

CC BY-SA 4.0
2024-03-20T11:07:47.447Z
Shouldn't `SSH_REPO_KEY` be `REPO_WRITE_TOKEN` in the remote URL?
AlexV
CC BY-SA 4.0
2024-03-20T15:14:23.623Z
@AlexV keen eye, and yes. That was a mistake on my part. =) thanks
Evan Carroll
CC BY-SA 4.0
2024-03-19T23:36:22.500Z
2024-03-20T15:14:10.403Z
2024-03-20T15:14:10.403Z
Evan Carroll
<p>Sorry for long read...
You could try that solution:
<a href="https://docs.gitlab.com/ee/ci/docker/authenticate_registry.html#option-3-use-docker_auth_config" rel="nofollow noreferrer">https://docs.gitlab.com/ee/ci/docker/authenticate_registry.html#option-3-use-docker_auth_config</a>.</p>
<p>That authentication approach can be defined in several ways:</p>
<blockquote>
<ul>
<li>In pre_build_script in the runner configuration file.</li>
<li>In before_script.</li>
<li>In script.</li>
</ul>
</blockquote>
<ol>
<li><p>Set DOCKER_AUTH_CONFIG CI\CD variable on project\group\instance level (don't forget to check Expand option).
Once you have DOCKER_AUTH_CONFIG set up correctly, Docker commands like docker push or docker pull in your GitLab CI/CD pipeline will be able to authenticate with the registry automatically.</p>
</li>
<li><p>Set variables REGISTRY_PULL_AUTH_BASE64 and REGISTRY_URL. REGISTRY_PULL_AUTH_BASE64 should contain base64 encoded login:password. Or use direct values registry.example.com and encoded login:password.</p>
</li>
</ol>
<pre><code>echo -n 'login:password' | base64
bG9naW46cGFzc3dvcmQ=
</code></pre>
<p>DOCKER_AUTH_CONFIG with nested variables.</p>
<pre><code>{
    &quot;auths&quot;: {
        &quot;$REGISTRY_URL&quot;: {
            &quot;auth&quot;: &quot;$REGISTRY_PULL_AUTH_BASE64&quot;
        },
        &quot;$REGISTRY_URL&quot;: {
            &quot;auth&quot;: &quot;$REGISTRY_PUSH_AUTH_BASE64&quot;
        }
    }
}
</code></pre>
<p>That's it. During pipeline execution variable will authenticate in docker automatically.</p>
<p>.gitlab-ci.yml example before_script and script blocks:</p>
<pre><code>before_script:
  - docker info

build:
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG
</code></pre>

CC BY-SA 4.0
2024-03-28T22:30:44.990Z
2024-03-28T22:30:44.990Z
stalk3rr
<p>Currently, <a href="https://gitlab.com/gitlab-org/gitlab/-/issues/389060" rel="nofollow noreferrer"><code>CI_JOB_TOKEN</code> doesn't allow you to push to a repo</a>. When I try I get,</p>
<blockquote>
<p>remote: You are not allowed to upload code.</p>
</blockquote>
<p>How can I work around this if I need to push to the repo in the CI?</p>
<p>The <code>CI_REPOSITORY_URL</code> which has the <code>CI_JOB_TOKEN</code> can not be used.</p>

<gitlab><gitlab-ci>
How can I push to a repo when CI_JOB_TOKEN doesn't permit it?
Evan Carroll
# How can I push to a repo when CI_JOB_TOKEN doesn't permit it?

(Asked by: username_0 on 2024-03-19)

Currently, [`CI_JOB_TOKEN` doesn't allow you to push to a repo](https://gitlab.com/gitlab-org/gitlab/-/issues/389060). When I try I get,

> remote: You are not allowed to upload code.

How can I work around this if I need to push to the repo in the CI?

The `CI_REPOSITORY_URL` which has the `CI_JOB_TOKEN` can not be used.

**Tags:** gitlab, gitlab-ci


---

## 2 answers

### Answer by username_0 on 2024-03-19. Score: 1 | Accepted answer

One method to do this is to generate a Project Access Token and store it as a protected environmental variable. You can do this like this,

From the project page, add /-/settings/access_tokens to the end of the URL
You need to create a token with

At least the role of Developer or greater (the default of Guest will NOT work)
Add to the token a scope of write_repository



Now you need to set this this token up in the project,

With the glab tool use a command like this
glab variable set --protected REPO_WRITE_TOKEN myToken


With the UI

From the project page, add /-/settings/ci_cd to the end of the URL
Under Variables click Expand
Click "Add Variable"



Now all of your jobs have access to REPO_WRITE_TOKEN and can push up using,
git remote add merge_request "https://does_not_mattter:${REPO_WRITE_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"


Unfortunately, the Project Access Token UI page can't be pre-populated yet with query parameters and you can't currently make a Project Access Token from glab (the GitLab CLI tool)

> **Comments:**
> **username_1**: Shouldn't `SSH_REPO_KEY` be `REPO_WRITE_TOKEN` in the remote URL?  
> **username_0**: @username_1 keen eye, and yes. That was a mistake on my part. =) thanks  

---

### Answer by username_2 on 2024-03-28. Score: 0

Sorry for long read...
You could try that solution:
https://docs.gitlab.com/ee/ci/docker/authenticate_registry.html#option-3-use-docker_auth_config.
That authentication approach can be defined in several ways:


In pre_build_script in the runner configuration file.
In before_script.
In script.



Set DOCKER_AUTH_CONFIG CI\CD variable on project\group\instance level (don't forget to check Expand option).
Once you have DOCKER_AUTH_CONFIG set up correctly, Docker commands like docker push or docker pull in your GitLab CI/CD pipeline will be able to authenticate with the registry automatically.

Set variables REGISTRY_PULL_AUTH_BASE64 and REGISTRY_URL. REGISTRY_PULL_AUTH_BASE64 should contain base64 encoded login:password. Or use direct values registry.example.com and encoded login:password.


echo -n 'login:password' | base64
bG9naW46cGFzc3dvcmQ=

DOCKER_AUTH_CONFIG with nested variables.
{
    "auths": {
        "$REGISTRY_URL": {
            "auth": "$REGISTRY_PULL_AUTH_BASE64"
        },
        "$REGISTRY_URL": {
            "auth": "$REGISTRY_PUSH_AUTH_BASE64"
        }
    }
}

That's it. During pipeline execution variable will authenticate in docker automatically.
.gitlab-ci.yml example before_script and script blocks:
before_script:
  - docker info

build:
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG


---

