Use CI_JOB_TOKEN for access in Gitlab using new token access feature in 15.9

[roemba]

Type of discussion.

I'm proposing an idea

Tell us more.

The Renovate documentation mentions a Gitlab issue that has now been closed and the feature it mentions is deployed in 15.9

It seems a relatively small change to make in Renovate where it will use the CI_JOB_TOKEN for API access if so configured. The CI_JOB_TOKEN for the project it is running in can then be used to access other projects by configuring some settings in Gitlab. See https://docs.gitlab.com/ee/ci/jobs/ci_job_token.html#add-a-project-to-the-inbound-job-token-scope-allowlist

This will allow running Renovate in Gitlab without creating a user for it which can be very useful if a user pays a license with limited seats.

[rarkins]

I'm not sure what you mean specifically. Renovate doesn't force which type of token you use today.

[Vringe]

Thank you for the hint. I managed to get alot further. Now Renovate wants to fetch the repository via /api/v4/projects/group/my-project which fails with a 404 because the CI_JOB_TOKEN does not have permission to access this endpoint. Did you find a way to get through this or am I at the same point you were stuck?

This is what I currently have:

    RENOVATE_PLATFORM: gitlab
    RENOVATE_ENDPOINT: $CI_API_V4_URL
    RENOVATE_TOKEN: $CI_JOB_TOKEN
    RENOVATE_USERNAME: $GITLAB_USER_LOGIN
    RENOVATE_GIT_AUTHOR: "Renovate Bot <$GITLAB_USER_EMAIL>"
    RENOVATE_X_PLATFORM_VERSION: $CI_SERVER_VERSION
    RENOVATE_REPOSITORIES: '["$CI_PROJECT_PATH"]'
    RENOVATE_DEFAULT_BRANCH: main

[viceice]

probably same point 😞

[Vringe]

It's a shame that you can't make renovate just use the already checked out repository inside the pipeline. That would make it alot easier. I know there is the local platform but it's experimental and does not look like it's designed for that.

[imdmahajankanika]

Hello! I also got 404 Repository is not found

INFO: Renovate started
      "renovateVersion": "43.256.1"
INFO: Repository started (repository=xxx/xxx-2022/back)
      "renovateVersion": "43.256.1"
ERROR: Repository is not found (repository=xxx/xxx-2022/back)
INFO: Repository finished (repository=xxx/xxx-2022/back)
      "cloned": undefined,
      "durationMs": 213,
      "result": "not-found",
      "status": "disabled",
      "enabled": false,
      "onboarded": undefined
INFO: Renovate was run at log level "info". Set LOG_LEVEL=debug in environment variables to see extended debug logs.
INFO: Renovate is exiting with a non-zero code due to the following logged errors
      "loggerErrors": [
        {
          "name": "renovate",
          "level": 50,
          "logContext": "c741f3de-9e4e-48a4-ab5d-97504261db49",
          "repository": "xxx/xxx-2022/back",
          "msg": "Repository is not found"
        }
      ]

[RahulGautamSingh]

@imdmahajankanika Please create a separate discussion with job logs.