Pipeline help - Remote You are not allowed to upload code 403, best practices?

Hey,

I believe you’re on the right path. But, what you didn’t configure here is authentication. GitLab Runner by default cannot make changes to the repo (push branches) - and this is exactly what is missing here.

To make sure - this part:

- git config --global user.email "${GITLAB_USER_EMAIL}"
- git config --global user.name "${GITLAB_USER_NAME}"

is just git config, not authentication. Authentication is defined by origin URL, which GitLab does for us behind the scenes and uses when cloning, etc. But now we need to change it.

What I do is change authentication method by defining new origin URL. And as authentication method, I use here https with OAuth.

Firstly, you need to decide which user will do the push - it can be you (as person), or a bot. In any case, you need to create an access token. I created a Project Access token (read_repo, write_repo permissions) and saved it on project level as CI/CD Variable OAUTH_TOKEN. This will basically result in a Bot pushing your branch. If you don’t want a Bot user, then you can also create your Personal Access Token and also store it as CI/CD variable in your project.

Then, you can use that variable to define a new origin:

before_script:
  - git remote remove origin
  - git remote add origin https://oauth2:$OAUTH_TOKEN@$CI_SERVER_HOST/$CI_PROJECT_PATH.git

After that you should be able to do what you are doing in your script part.

I’m not sure if this is the “best practice”, but this worked for me very well and I didn’t have time to further investigate. TBH I have no idea anymore where did I take this option from, probably some StackOverflow

I believe there are other ways as well, e.g. using Deploy Keys… have a look at inspiration here.

Hope this helps!

2 Likes