Skip to content

"HTTP Basic: Access denied" for Windows Shell executor runs

Summary

Using a shell runner on Windows, the initial job succeeds, but subsequently triggered jobs cannot fetch the git repository with remote: HTTP Basic: Access denied and silently ignore the error, running the job script on an outdated ref instead.

Steps to reproduce

  1. Install git & gitlab-runner on Windows Server Core

    I used scoop:

    Invoke-Expression (New-Object System.Net.WebClient).DownloadString('https://get.scoop.sh')
scoop install git --global
git config --global --unset credential.helper
git config --system --unset credential.helper
mkdir C:\gitlabrunner
cd C:\gitlabrunner
scoop install gitlab-runner --global
# deploy config.toml
gitlab-runner install
gitlab-runner start

  2. Trigger a job (succeeds)

  3. Trigger another job for the same repository

.gitlab-ci.yml 
my_job:
  stage: mystage
  script:
    - ...
  tags:
    - windows-shell

Actual behavior

  • The first job always clones the Git repository successfully
  • Any subsequent jobs triggered for the same repository attempt to fetch the repository, but always fail with a HTTP authentication error (see log)
  • This error does not lead to job failure! The job continues as if the fetch + checkout succeeded
  • The job script runs on the checked out files from the initial, successful job instead
  • In my case, a job that should have failed succeeded
  • When deleting the gitlab-runner builds directory, the next triggered job acts like this first job again

Expected behavior

  • HTTP authentication succeeds for subsequent git fetches
  • If a git fetch fails, the job should immediately fail
  • If a checkout fails (because the ref does not exist), the job should immediately fail

Job Log

Running with gitlab-runner 13.2.1 (efa30e33)
  on gitlabrunner-machine <token>
Preparing the "shell" executor
00:00
Using Shell executor...
Preparing environment
00:00
Running on <MACHINE>...
Getting source from Git repository
00:01
Fetching changes...
Reinitialized existing Git repository in C:/gitlabrunner/builds/<token>/0/<user>/<project>/.git/
Created fresh repository.
remote: HTTP Basic: Access denied
fatal: Authentication failed for 'https://<gitlab-server>/<user>/<project>.git/'
Checking out <ref> as <branch>...
fatal: reference is not a tree: <hash>
git-lfs/2.11.0 (GitHub; windows amd64; go 1.14.2; git 48b28d97)
Skipping Git submodules setup
Executing "step_script" stage of the job script
...

Environment description

  • Using Gitlab-Runner 13.2.1 on Windows Server Core LTSC 2019, registered as project-specific runner
  • Hosts both Powershell shell runner and docker runner, only shell runner is affected
  • Both runners are tagged, the shell runner with windows-shell
  • Using self-hosted Omnibus Gitlab 13.2.2 on Ubuntu 18.04
config.toml contents 
concurrent = 1
check_interval = 10

[session_server]
  session_timeout = 1800

[[runners]]
  name = "windows-shell"
  url = "https://<gitlab>/"
  token = "<token1>"
  executor = "shell"
  shell = "powershell"

[[runners]]
  name = "windows-docker"
  url = "https://<gitlab>/"
  token = "<token2>"
  output_limit = 32768
  executor = "docker-windows"
  [runners.docker]
    tls_verify = false
    image = "mcr.microsoft.com/windows/nanoserver:1809"
    privileged = false
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["c:\\cache", "C:\\other\\dir"]
    shm_size = 0
    pull_policy = "if-not-present"

Used GitLab Runner version

PS C:\gitlabrunner> gitlab-runner --version
Version:      13.2.1
Git revision: efa30e33
Git branch:   refs/pipelines/172529495
GO version:   go1.13.8
Built:        2020-07-30T13:09:11+0000
OS/Arch:      windows/amd64

Workaround

Use the GIT_STRATEGY=clone in .gitlab-ci.yml:

my_job:
  stage: mystage
  script:
    - ...
  tags:
    - windows-shell
  variables:
    GIT_STRATEGY: clone