GitLab CI/CD HTTP fetch/authentication issues after upgrade to 17.11 / 18.0 – possible root cause?

GitLab CI/CD
1

After upgrading our self-managed GitLab instance to 18.0, our CI/CD pipelines started failing when trying to clone or fetch the repository via HTTP. Prior to the upgrade everything worked without the need for deploy tokens or SSH setup.

What we’re seeing:

remote: HTTP Basic: Access denied.
fatal: Authentication failed for 'http://git.playcraftex.net/group/project.git/'

What we expected:
GitLab Runner should automatically be able to fetch the repository using the built-in CI_JOB_TOKEN, just like it did before.

We’ve reviewed the following:

Configuration

.gitlab-ci.yml:

stages:
  - test
  - deploy

test:
  stage: test
  script:
    - ./gradlew clean test --info --stacktrace

deploy-master:
  stage: deploy
  script:
    - rsync -avz --delete ./deploy/*.jar /home/minecraft/plugins/
  only:
    - mainssssss

deploy-develop:
  stage: deploy
  script:
    - rsync -avz --delete ./deploy/*.jar /var/lib/pterodactyl/volumes/aab5f19d-4ebb-47ec-89e8-0a42de4ac6fa
  only:
    - develop

Runner: Shell executor
GitLab: HTTP only, no SSH used
Repo is private

Versions

GitLab version:

GitLab-ce: 18.0.0

Runner version:

gitlab-runner 18.0.2 (4d7093e1)

Let us know if we missed anything obvious. Or how we can fix this Problem. because I have no Idea.

Thank you!

2

We’re seeing a similar thing, since the upgrade the CI can’t seem to checkout the submodules for the project

remote: Authentication by CI/CD job token not allowed from {project} to {submodule}.

Worked fine on Friday, updated yesterday…

3

There looks like there might be a new setting in the CI/CD section of a project

-/settings/ci_cd#js-token-access

Job token permissions

Control which projects can use CI/CD job tokens to authenticate with this project.

4

So, our fix was to to into the 3 submodules that the project uses, go to the CI/CD settings page, then expand the Job token permissions section. You can then, from the drop-down Add button/menu on the right Add all projects in Authentication log

That will then allow those projects to pull during CI that project.