Skip to content

Support CI_JOB_TOKEN now that Gitlab added the option for it to push to its own repository which will be released in 17.2 (July 18th) #977

Description

@fcinqmars

Description

Currently, semantic-release expects an Access Token to be used with Gitlab because the CI_JOB_TOKEN would not allow pushing to the repository. Now that Gitlab has enabled that, it would nice to leverage the CI_JOB_TOKEN instead of having to manage expiring tokens per project or group.

Allow CI_JOB_TOKEN to push to its own repository #389060

Use cases

  • Every project requires an access token with write_repository which creates a new bot user every time
  • Group access tokens can be used to limit the number of bots mentioned above, but then security takes a hit
  • CI_JOB_TOKEN is better scoped and short-lived
  • No expiry of tokens as Gitlab limits access tokens to 1 year now

Possible implementation

python-semantic-release/semantic-release/hvcs/gitlab.py L76 reads:

self._client = gitlab.Gitlab(self.hvcs_domain.url, private_token=self.token)

CI_JOB_TOKEN requires that the client be created as such:

self._client = gitlab.Gitlab(self.hvcs_domain.url, job_token=self.token)

Maybe we could add an extra parameter or check if CI_JOB_TOKEN exists when the environment variable GITLAB_TOKEN is not populated in order to determine which of the two syntax to use.

Activity

  1. codejedi365 commented on Jul 12, 2024

    @codejedi365
    Contributor

    Thank you for submitting this ticket. It is great news to hear that push will now be available for GitLab and I wouldn't have been tracking that improvement without your submission.

  2. github-actions commented on Sep 11, 2024

    @github-actions

    It has been 60 days since the last update on this confirmed issue. @python-semantic-release/team can you provide an update on the status of this issue?

  3. codejedi365 commented on Sep 11, 2024

    @codejedi365
    Contributor

    I had some work towards this but got sidetracked with other improvements, hopefully circle back around to this soon.

  4. github-actions commented on Nov 11, 2024

    @github-actions

    It has been 60 days since the last update on this confirmed issue. @python-semantic-release/team can you provide an update on the status of this issue?

  5. codejedi365 commented on Nov 11, 2024

    @codejedi365
    Contributor

    Still in backlog

  6. added 2 commits that reference this issue on Nov 18, 2024
    a2f3f13
    82c76c4
  7. github-actions commented on Jan 12, 2025

    @github-actions

    It has been 60 days since the last update on this confirmed issue. @python-semantic-release/team can you provide an update on the status of this issue?

  8. added a commit that references this issue on Jan 12, 2025
    349753b
  9. added a commit that references this issue on Jan 26, 2025
    cfdf5f8
  10. added a commit that references this issue on Feb 6, 2025
    0be3672
  11. added a commit that references this issue on Sep 14, 2025
    b3a4d48
  12. svaningelgem commented on Jan 20, 2026

    @svaningelgem

    Hello, is there any information regarding this PR? We would love to start using the CI-token on gitlab if at all possible.

  13. a-gertner commented on Feb 19, 2026

    @a-gertner

    Hi, just joining this discussion after #1431 was closed as a duplicate.
    May I ask what is maintainers view on this topic?

    • Useful and will imeplemt?
    • Useful but not a priority?
    • Won't implement because ...

    I am not the best python dev in the world, but I am happy to invest some time and contribute to PR if needed.

  14. benedikt-bartscher commented on Feb 19, 2026

    @benedikt-bartscher

    @a-gertner take a look here: #1098

  15. a-gertner commented on Feb 19, 2026

    @a-gertner

    @a-gertner take a look here: #1098

    Ah, thanks. My bad, I did not notice that PR already exists.
    Had a quick look through the diff, it looks great. Different from implementation I had in mind, but very good nevertheless.

    My original idea was to not implicitly get CI_JOB_TOKEN from ENV var, but rather handle a special case where user specifies it in semantic-release config:

    [semantic_release.remote]
    type = "gitlab"
    token = {"env" = "CI_JOB_TOKEN" } # this will be treated as job_token
    [semantic_release.remote]
    type = "gitlab"
    token = {"env" = "ANY_OTHER_TOKEN_NAME" } # this will be treated as private token

    But I guess I am late to the party with my ideas. @KundaPanda's solution is great.

    Thanks a lot for great features!

  16. github-actions commented on May 21, 2026

    @github-actions

    It has been 90 days since the last update on this confirmed issue. @python-semantic-release/team can you provide an update on the status of this issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    confirmedPrevent from becoming stalefeatureA new feature or a feature requestneeds-updateNeeds status update from maintainers

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions