Support GitLab CI_JOB_TOKEN #1431

Feature Request

Description

Please consider adding support for GitLab CI_JOB_TOKEN

Since version 18.4 GitLab supports writing back to repository using CI_JOB_TOKEN. Previously this token did not provide write access to repo.
I have tried swapping out Group Access Token (GAT) for CI_JOB_TOKEN in python-semantic-release config.toml file and observed the following:

• ✅Tags were created successfully
• ✅Release commit was created and successfully pushed back to repo
• ❌VCS release failed

Pipeline fails as python-semantic-release returns a non-zero error code due to vcs-release failure

Use cases

To run CI jobs that use python-semantic-release with CI_JOB_TOKEN. This reduces token exposure and is more secure option.

Possible implementation

I am not an expert, but it appears that python-semantic-release always treats provided token as private-token when constructing Gitlab client. In order to make VCS release CI_JOB_TOKEN, a different header needs to be set in requests.

In hvcs/gitlab.py I can see the following lines:

DEFAULT_ENV_TOKEN_NAME = "GITLAB_TOKEN"  # noqa: S105
# purposefully not CI_JOB_TOKEN as it is not a personal access token,
# It is missing the permission to push to the repository, but has all others (releases, packages, etc.)

^^ the above was definitely true before GL v18.4, but is no longer the case.

... and then later in the code:

self._client = gitlab.Gitlab(self.hvcs_domain.url, private_token=self.token)

Perhaps it is possible to specify type of token in config.toml?

Alternative solutions

At the moment, I was able to make pipelines run by disable VCS release (flag --no--vcs-release) and then triggering it separately with a curl request:
curl -H "JOB-TOKEN: $CI_JOB_TOKEN" .../projects/:id/releases