GIT_AUTH_TOKEN cannot be used with GitLab CI_JOB_TOKEN

[Habile2019]

Is this a docs issue?

• My issue is about the documentation content or website

Type of issue

Information is incorrect

Description

Could a note be added that GIT_AUTH_HEADER and GIT_AUTH_TOKEN cannot be used with a GitLab CI_JOB_TOKEN. A GitLab CI_JOB_TOKEN MUST use basic authentication and use a username of gitlab-ci-token.

Buildkit appears to hard code a username for basic auth which causes the CI_JOB_TOKEN authentication to fail.

In short this functionality is only compatible with Personal Access Tokens (which should include group/project access tokens also).

See also moby/buildkit#5703

Location

https://docs.docker.com/build/building/secrets/

Suggestion

Either update the doc or consider allowing override of the hardcoded x-access-token.

[detly]

I'll add a note that x-access-token appears to be a non-standard, but commonly used, header for this kind of use-case. Not really a username. I haven't been able to find much on it, but this SO answer summarises it a bit and has some useful references.

[Habile2019]

Just to complete the loop - https://gitlab.com/gitlab-org/gitlab/-/issues/550508

[pcuriel]

As I detailed in this issue, the problem is with the documentation.

GIT_AUTH_HEADER can actually be used with a GitLab CI Token. Here is how you need to compute it

GIT_BASIC_AUTH="$(echo -n "gitlab-ci-token:${CI_JOB_TOKEN}" | base64)"
GIT_AUTH_HEADER="Basic ${GIT_BASIC_AUTH}"

[Habile2019]

As I detailed in this issue, the problem is with the documentation.

Thanks @pcuriel - I (thought) I faced some challenges with buildkit ADD when I tested in a CI/CD pipeline. I'll re-visit next week to check the sanity of my tests.

I re-tested and it totally works, thank you. Not sure how I messed up first time.

[dvdksn]

Fixed in #23460