Is it possible to push to gitlab from a gitlab job

user_119925 0
Viewed 130

I'd like to push tags to the gitlab repository for which a job is running. I'm using the Gradle plugin reckon which is using the grgit/JGit API. Reckon is managing semantic versioning and is able to create and push a tag to a Git repository.

First I want to run in GitLab SaaS. And I assume I need a kind of token so I don't have to pass my personal credentials for security reasons? Then I also have to work on running it in GitLab hosted environment. But I would expect that in both environments it should work the same way.

There is some thing like a deploy key but I really can't find any references on how to use them. But maybe deploy key is not really made for that kind of operation.

.release-template:
  stage:
    release
  image: adoptopenjdk:11-jdk-hotspot
  dependencies:
    - deliver
  script:
    - |
      ./gradlew reckonTagPush -Preckon.scope=$scope -Preckon.stage=$stage \
        -Dorg.ajoberstar.grgit.auth.username=${???} \
        -Dorg.ajoberstar.grgit.auth.password=${???}
    artifacts:
      paths:
        - build/
  #only:
  #  - master
  when: manual #ONLY MANUAL RELEASES, ONLY FROM MASTER

release-major:
  extends: .release-template
  variables:
    scope: major
    stage: final

release-minor:
  extends: .release-template
  variables:
    scope: minor
    stage: final

release-patch:
  extends: .release-template
  variables:
    scope: patch
    stage: final
gitlab gitlab-ci gradle git-push
1 Answers

If all you're doing is adding a git tag to the repo, and not adding commits, merging branches, etc. you can simply use the Tags API to create a new tag:

curl --request POST --header "PRIVATE-TOKEN: $(CI_JOB_TOKEN)" "https://gitlab.example.com/api/v4/projects/:project_id:/repository/tags?tag_name=test&ref=master"

The $CI_JOB_TOKEN variable is a Predefined Variable automatically provided to running jobs by Gitlab. The $CI_JOB_TOKEN specifically will hold a non-admin API token, which should be fine for the Tags API.

If you were using other API's that requires Admin permissions, you'd have to use a personal access token of an Admin.

user_23078730
Related