feat(gitlab): authenticate CI job tokens with JOB-TOKEN and gitlab-ci-token (#1120)

Author: BryanFRD

docs/site/docs-en/ci/gitlab-ci.md

@@ -45,6 +45,12 @@ release:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 ```
 
+## Using `CI_JOB_TOKEN`
+
+The examples above pass the job token as `GITLAB_TOKEN: $CI_JOB_TOKEN`. FerrFlow recognises it because its value equals `CI_JOB_TOKEN`, and authenticates the way GitLab expects for a job token: API calls carry a `JOB-TOKEN` header and git pushes as `gitlab-ci-token`. The same applies when the job token is passed as `FERRFLOW_TOKEN`. Any other token (project, group or personal access token) is sent as `PRIVATE-TOKEN` and pushes as `oauth2`.
+
+What a job token may do is set per project under **Settings > CI/CD > Job token permissions**. Pushing the release commit and tags needs **Allow Git push requests to the repository**. When GitLab refuses one of the API calls FerrFlow makes with a job token, use a project access token with the `api` scope instead.
+
 ## Using a deploy token
 
 If `CI_JOB_TOKEN` doesn't have permission to push tags, create a project deploy token with `write_repository` access and store it as a CI variable:

docs/site/docs-fr/ci/gitlab-ci.md

@@ -45,6 +45,12 @@ release:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
 ```
 
+## Utiliser `CI_JOB_TOKEN`
+
+Les exemples ci-dessus passent le token du job via `GITLAB_TOKEN: $CI_JOB_TOKEN`. FerrFlow le reconnaît parce que sa valeur est égale à `CI_JOB_TOKEN`, et s'authentifie comme GitLab l'attend pour un token de job : les appels d'API portent un en-tête `JOB-TOKEN` et git pousse en tant que `gitlab-ci-token`. C'est aussi le cas quand le token du job est passé dans `FERRFLOW_TOKEN`. Tout autre token (token d'accès de projet, de groupe ou personnel) est envoyé en `PRIVATE-TOKEN` et pousse en tant que `oauth2`.
+
+Ce qu'un token de job a le droit de faire se règle par projet dans **Settings > CI/CD > Job token permissions**. Pousser le commit et les tags de release nécessite **Allow Git push requests to the repository**. Quand GitLab refuse un des appels d'API que FerrFlow fait avec un token de job, utilisez plutôt un token d'accès de projet avec le scope `api`.
+
 ## Utiliser un deploy token
 
 Si `CI_JOB_TOKEN` n'a pas les permissions pour pousser des tags, créez un deploy token de projet avec l'accès `write_repository` et stockez-le comme variable CI :

src/bot_token.rs

@@ -324,9 +324,7 @@ fn configure_bot_git_identity_in(repo_dir: &std::path::Path) {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::sync::Mutex;
-
-    static ENV_LOCK: Mutex<()> = Mutex::new(());
+    use crate::test_utils::ENV_LOCK;
 
     fn with_env<F: FnOnce()>(vars: &[(&str, Option<&str>)], f: F) {
         let _guard = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner());

src/forge/gitlab.rs

@@ -7,8 +7,42 @@ use crate::error_code::{self, ErrorCodeExt};
 const PER_PAGE: u32 = 100;
 const MAX_PAGES: u32 = 100;
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum GitLabToken {
+    Private,
+    Job,
+}
+
+impl GitLabToken {
+    pub fn of(token: &str) -> Self {
+        Self::matching(token, std::env::var("CI_JOB_TOKEN").ok().as_deref())
+    }
+
+    fn matching(token: &str, ci_job_token: Option<&str>) -> Self {
+        match ci_job_token {
+            Some(job) if !job.is_empty() && job == token => Self::Job,
+            _ => Self::Private,
+        }
+    }
+
+    pub fn header(self) -> &'static str {
+        match self {
+            Self::Private => "PRIVATE-TOKEN",
+            Self::Job => "JOB-TOKEN",
+        }
+    }
+
+    pub fn git_username(self) -> &'static str {
+        match self {
+            Self::Private => "oauth2",
+            Self::Job => "gitlab-ci-token",
+        }
+    }
+}
+
 pub struct GitLabForge {
     pub token: String,
+    pub token_kind: GitLabToken,
     pub slug: String,
     pub api_base: String,
     pub agent: ureq::Agent,
@@ -26,7 +60,7 @@ impl GitLabForge {
             let body: serde_json::Value = self
                 .agent
                 .get(&url)
-                .header("PRIVATE-TOKEN", &self.token)
+                .header(self.token_kind.header(), &self.token)
                 .header("User-Agent", "ferrflow")
                 .call()
                 .with_context(|| format!("Failed to list {what}"))?
@@ -80,7 +114,7 @@ impl Forge for GitLabForge {
         let response: serde_json::Value = self
             .agent
             .post(&url)
-            .header("PRIVATE-TOKEN", &self.token)
+            .header(self.token_kind.header(), &self.token)
             .header("User-Agent", "ferrflow")
             .send_json(payload)
             .with_context(|| format!("Failed to create GitLab release for {tag}"))
@@ -123,7 +157,7 @@ impl Forge for GitLabForge {
         let response: serde_json::Value = self
             .agent
             .post(&url)
-            .header("PRIVATE-TOKEN", &self.token)
+            .header(self.token_kind.header(), &self.token)
             .header("User-Agent", "ferrflow")
             .send_json(payload)
             .with_context(|| format!("Failed to create MR from {head} to {base}"))
@@ -159,7 +193,7 @@ impl Forge for GitLabForge {
         let result = self
             .agent
             .put(&url)
-            .header("PRIVATE-TOKEN", &self.token)
+            .header(self.token_kind.header(), &self.token)
             .header("User-Agent", "ferrflow")
             .send_json(payload);
 
@@ -174,7 +208,7 @@ impl Forge for GitLabForge {
 
         self.agent
             .put(&url)
-            .header("PRIVATE-TOKEN", &self.token)
+            .header(self.token_kind.header(), &self.token)
             .header("User-Agent", "ferrflow")
             .send_json(payload)
             .with_context(|| format!("Failed to merge MR !{}", mr.id))
@@ -219,7 +253,7 @@ impl Forge for GitLabForge {
         );
         self.agent
             .post(&url)
-            .header("PRIVATE-TOKEN", &self.token)
+            .header(self.token_kind.header(), &self.token)
             .header("User-Agent", "ferrflow")
             .send_json(serde_json::json!({ "body": body }))
             .with_context(|| "Failed to create MR note")?;
@@ -236,7 +270,7 @@ impl Forge for GitLabForge {
         );
         self.agent
             .put(&url)
-            .header("PRIVATE-TOKEN", &self.token)
+            .header(self.token_kind.header(), &self.token)
             .header("User-Agent", "ferrflow")
             .send_json(serde_json::json!({ "body": body }))
             .with_context(|| "Failed to update MR note")?;
@@ -252,7 +286,7 @@ impl Forge for GitLabForge {
         let response: serde_json::Value = self
             .agent
             .get(&url)
-            .header("PRIVATE-TOKEN", &self.token)
+            .header(self.token_kind.header(), &self.token)
             .header("User-Agent", "ferrflow")
             .call()
             .with_context(|| format!("Failed to list open MRs for {head}"))
@@ -273,7 +307,7 @@ impl Forge for GitLabForge {
         let url = format!("{}/projects/{project}/merge_requests/{id}", self.api_base);
         self.agent
             .put(&url)
-            .header("PRIVATE-TOKEN", &self.token)
+            .header(self.token_kind.header(), &self.token)
             .header("User-Agent", "ferrflow")
             .send_json(serde_json::json!({ "title": title, "description": body }))
             .with_context(|| format!("Failed to update MR !{id}"))
@@ -290,10 +324,40 @@ impl Forge for GitLabForge {
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_token_equal_to_ci_job_token_is_a_job_token() {
+        assert_eq!(
+            GitLabToken::matching("job-abc", Some("job-abc")),
+            GitLabToken::Job
+        );
+    }
+
+    #[test]
+    fn any_other_token_stays_a_private_token() {
+        assert_eq!(
+            GitLabToken::matching("glpat-abc", Some("job-abc")),
+            GitLabToken::Private
+        );
+        assert_eq!(
+            GitLabToken::matching("glpat-abc", None),
+            GitLabToken::Private
+        );
+        assert_eq!(GitLabToken::matching("", Some("")), GitLabToken::Private);
+    }
+
+    #[test]
+    fn job_tokens_use_the_job_token_header_and_the_ci_git_user() {
+        assert_eq!(GitLabToken::Job.header(), "JOB-TOKEN");
+        assert_eq!(GitLabToken::Job.git_username(), "gitlab-ci-token");
+        assert_eq!(GitLabToken::Private.header(), "PRIVATE-TOKEN");
+        assert_eq!(GitLabToken::Private.git_username(), "oauth2");
+    }
+
     #[test]
     fn encoded_project_id_simple() {
         let forge = GitLabForge {
             token: String::new(),
+            token_kind: GitLabToken::Private,
             slug: "owner/repo".to_string(),
             api_base: "https://gitlab.com/api/v4".to_string(),
             agent: ureq::Agent::new_with_defaults(),
@@ -305,6 +369,7 @@ mod tests {
     fn encoded_project_id_subgroup() {
         let forge = GitLabForge {
             token: String::new(),
+            token_kind: GitLabToken::Private,
             slug: "group/subgroup/repo".to_string(),
             api_base: "https://gitlab.com/api/v4".to_string(),
             agent: ureq::Agent::new_with_defaults(),
@@ -316,6 +381,7 @@ mod tests {
     fn mr_noun_returns_mr() {
         let forge = GitLabForge {
             token: String::new(),
+            token_kind: GitLabToken::Private,
             slug: "owner/repo".to_string(),
             api_base: "https://gitlab.com/api/v4".to_string(),
             agent: ureq::Agent::new_with_defaults(),
@@ -327,6 +393,7 @@ mod tests {
     fn release_noun_returns_gitlab_release() {
         let forge = GitLabForge {
             token: String::new(),
+            token_kind: GitLabToken::Private,
             slug: "owner/repo".to_string(),
             api_base: "https://gitlab.com/api/v4".to_string(),
             agent: ureq::Agent::new_with_defaults(),
@@ -338,6 +405,7 @@ mod tests {
     fn find_draft_release_always_none() {
         let forge = GitLabForge {
             token: String::new(),
+            token_kind: GitLabToken::Private,
             slug: "owner/repo".to_string(),
             api_base: "https://gitlab.com/api/v4".to_string(),
             agent: ureq::Agent::new_with_defaults(),
@@ -349,6 +417,7 @@ mod tests {
     fn publish_release_noop() {
         let forge = GitLabForge {
             token: String::new(),
+            token_kind: GitLabToken::Private,
             slug: "owner/repo".to_string(),
             api_base: "https://gitlab.com/api/v4".to_string(),
             agent: ureq::Agent::new_with_defaults(),
@@ -389,6 +458,7 @@ mod tests {
     fn api_base_self_hosted() {
         let forge = GitLabForge {
             token: String::new(),
+            token_kind: GitLabToken::Private,
             slug: "team/project".to_string(),
             api_base: "https://gitlab.internal/api/v4".to_string(),
             agent: ureq::Agent::new_with_defaults(),

src/forge/mod.rs

@@ -292,6 +292,7 @@ pub fn build_forge(kind: ForgeKind, token: String, slug: String, host: String) -
         ForgeKind::Gitlab => {
             let api_base = format!("https://{host}/api/v4");
             Box::new(gitlab::GitLabForge {
+                token_kind: gitlab::GitLabToken::of(&token),
                 token,
                 slug,
                 api_base,
@@ -329,9 +330,7 @@ pub fn build_forge(kind: ForgeKind, token: String, slug: String, host: String) -
 #[cfg(test)]
 mod tests {
     use super::*;
-    use std::sync::Mutex;
-
-    static ENV_LOCK: Mutex<()> = Mutex::new(());
+    use crate::test_utils::ENV_LOCK;
 
     #[test]
     fn detect_github_https() {

src/git/auth.rs

@@ -1,6 +1,7 @@
 use std::process::Command;
 
 use super::repo::Repository;
+use crate::forge::gitlab::GitLabToken;
 
 #[cfg(test)]
 pub(super) fn extract_url_password(url: &str) -> Option<(String, String)> {
@@ -34,15 +35,16 @@ fn is_gitlab(url: &str) -> bool {
 pub(super) fn token_for_url(url: &str) -> Option<(String, String)> {
     if let Ok(token) = std::env::var("FERRFLOW_TOKEN") {
         let user = if is_gitlab(url) {
-            "oauth2"
+            GitLabToken::of(&token).git_username()
         } else {
             "x-access-token"
         };
         return Some((user.to_string(), token));
     }
     if is_gitlab(url) {
         if let Ok(token) = std::env::var("GITLAB_TOKEN") {
-            return Some(("oauth2".to_string(), token));
+            let user = GitLabToken::of(&token).git_username();
+            return Some((user.to_string(), token));
         }
     } else if let Ok(token) = std::env::var("GITHUB_TOKEN") {
         return Some(("x-access-token".to_string(), token));

src/git/tests.rs

@@ -988,6 +988,37 @@ fn token_for_url_picks_gitlab_user_for_gitlab_urls() {
     assert_eq!(user, "oauth2");
 }
 
+#[test]
+fn a_ci_job_token_pushes_as_gitlab_ci_token() {
+    let _guard = EnvGuard::new()
+        .unset("FERRFLOW_TOKEN")
+        .set("CI_JOB_TOKEN", "job_secret")
+        .set("GITLAB_TOKEN", "job_secret");
+    assert_eq!(
+        token_for_url("https://gitlab.com/group/project.git"),
+        Some(("gitlab-ci-token".to_string(), "job_secret".to_string()))
+    );
+}
+
+#[test]
+fn a_ci_job_token_passed_as_ferrflow_token_pushes_as_gitlab_ci_token() {
+    let _guard = EnvGuard::new()
+        .set("CI_JOB_TOKEN", "job_secret")
+        .set("FERRFLOW_TOKEN", "job_secret");
+    let (user, _) = token_for_url("https://gitlab.com/group/project.git").expect("token");
+    assert_eq!(user, "gitlab-ci-token");
+}
+
+#[test]
+fn a_personal_token_in_a_ci_job_still_pushes_as_oauth2() {
+    let _guard = EnvGuard::new()
+        .unset("FERRFLOW_TOKEN")
+        .set("CI_JOB_TOKEN", "job_secret")
+        .set("GITLAB_TOKEN", "glpat_secret");
+    let (user, _) = token_for_url("https://gitlab.com/group/project.git").expect("token");
+    assert_eq!(user, "oauth2");
+}
+
 #[test]
 fn token_for_url_falls_back_to_provider_env() {
     let _guard = EnvGuard::new()
@@ -1273,7 +1304,7 @@ fn configure_git_command_skips_helper_without_token() {
     assert!(args.is_empty(), "no flags should be added, got {args:?}");
 }
 
-static ENV_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+use crate::test_utils::ENV_LOCK;
 
 struct EnvGuard {
     _lock: std::sync::MutexGuard<'static, ()>,

src/lib.rs

@@ -37,6 +37,7 @@ pub mod test_utils {
     use std::sync::Mutex;
 
     pub static CWD_LOCK: Mutex<()> = Mutex::new(());
+    pub static ENV_LOCK: Mutex<()> = Mutex::new(());
 
     pub fn with_cwd<F: FnOnce() -> anyhow::Result<()>>(
         dir: &std::path::Path,

src/main.rs

@@ -73,6 +73,7 @@ mod test_utils {
     use std::sync::Mutex;
 
     pub static CWD_LOCK: Mutex<()> = Mutex::new(());
+    pub static ENV_LOCK: Mutex<()> = Mutex::new(());
 
     pub fn with_cwd<F: FnOnce() -> anyhow::Result<()>>(
         dir: &std::path::Path,

src/publishers/npm.rs

@@ -331,7 +331,7 @@ mod tests {
         }
     }
 
-    static ENV_LOCK: std::sync::Mutex<()> = std::sync::Mutex::new(());
+    use crate::test_utils::ENV_LOCK;
 
     fn with_token<T>(f: impl FnOnce() -> T) -> T {
         let _guard = ENV_LOCK.lock().unwrap_or_else(|e| e.into_inner());