24

I've seen this: `git clone project2` in gitlab-ci.yml? as well as a bunch of similar posts with similar answers implying that one should use Git submodules.

Without getting into arguments about whether submodules in Git work well, in my case, that just isn't an option at all (what other project to check out depends on the arguments passed to the trigger of the job, or, at least, it should).

Another requirement is that I need to be able to track the user who started the chain of triggers. I.e. hard-coding my personal token, or just any token will not do it: I need GitLab to use the permissions of the user who executed the job in order to clone other repositories.

Short of giving up GitLab and looking for a mature CI alternative, is there any way to get this done?

wvxvw
  • 8,089
  • 10
  • 32
  • 61
  • Does this answer your question? [how to access multiple repositories in CI build?](https://stackoverflow.com/questions/32995578/how-to-access-multiple-repositories-in-ci-build) – 030 Apr 28 '21 at 08:06

2 Answers2

36

As New CI job permissions model states that there are 2 options: use gitlab-ci-token:${CI_JOB_TOKEN} or write it to ~/.netrc (doesn't work for me).

But we have multiple dependent repositories defined in package.json so our solution is to overwrite git config

git config --global url."https://gitlab-ci-token:${CI_JOB_TOKEN}@your-gitlab.com/".insteadOf "ssh://git@your-gitlab.com/"
Simon A. Eugster
  • 4,114
  • 4
  • 36
  • 31
vladkras
  • 16,483
  • 4
  • 45
  • 55
  • 5
    Awesome @vladkras it work like a charm! I had to adjust it a bit to make it work with composer but it was a shot in the right direction: `git config --global url."https://gitlab-ci-token:${CI_JOB_TOKEN}@your-gitlab.com/".insteadOf "git://git@your-gitlab.com:"` (note the last `git@` and the `:`). – Adrian Antunez Apr 11 '19 at 22:11
  • Really nice solution that works for any tool that uses git cli. I've been able to use it to download some private terraform modules in our CI jobs. Works like a charm! – Gaëtan Lehmann Apr 09 '21 at 09:20
  • 2
    In my particular case it was: `git config --global url."https://gitlab-ci-token:${CI_JOB_TOKEN}@your-gitlab.com/".insteadOf "git@your-gitlab.com:`. This is a great solution! – amrox May 29 '21 at 13:29
15

This should be possible using the gitlab-ci-token variable as documented here:

git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.com/myuser/mydependentrepo

This issue discusses the permissions of the gitlab-ci-token, and in the proposal also mentions:

  1. We will authorize access to the resource by getting from Ci::Build information about a person who run this build, it could be: pusher of git push, person who did retry a build, person who did merge a changes
vvvvv
  • 25,404
  • 19
  • 49
  • 81
Rekovni
  • 6,319
  • 3
  • 39
  • 62
  • This almost gets me there, but I also need to have push permissions on other repositories (so, read-only won't be enough). A typical scenario: user submitted pull request, it was staged, tested, and now it needs to be rebased on master, but the master isn't in the repository against which the user submitted their PR. – wvxvw Nov 20 '18 at 16:38
  • @wvxvw didn't realise about the push permissions. This sounds like it's getting out of scope for what GitLab CI is capable of without as you said, personal tokens. Are you sure you couldn't do this the other way around? Instead of cloning said repository, trigger the repository from the one you want to clone, and so you can handle rebasing from that repository? Although this suggestion is a stab in the dark as I don't know your full requirements. – Rekovni Nov 20 '18 at 16:55
  • Nah, not really. The repository has at least these two projects (in reality there's more), which work as a client and server, and they need to be compiled (and updated) together, otherwise they won't work, but developers can contribute to either one of them. – wvxvw Nov 20 '18 at 18:49
  • Why use the curly braces, tho? Unless explicitly needed, it can be dangerous and lead to unwanted behavior. – solr Dec 28 '22 at 14:15