GitLab Runner 18.6.0 Authentication Failure on Subsequent Pipeline Runs (Shell Executor)

GitLab Runner 18.6.0 Authentication Failure on Subsequent Pipeline Runs (Shell Executor)

Summary

GitLab Runner 18.6.0 fails to authenticate when fetching Git repository on subsequent pipeline runs in the same build directory. First run (fresh clone) works, second run fails with "HTTP Basic: Access denied". Issue does not exist in version 18.5.0.

Note: This issue appeared after upgrading both GitLab Runner and GitLab platform. I'm unsure if this is a genuine bug or if I'm missing something in the upgrade process. Reporting as informational - feel free to close if the error is on my side.

Versions

  • GitLab Platform: 18.6.0-ee.0 (upgraded from previous version)
  • GitLab Runner:
    • Affected: 18.6.0 (Git revision: 3a847532, Built: 2025-11-17T12:44:00Z)
    • Working: 18.5.0
  • Executor: Shell
  • OS/Arch: linux/amd64

Steps to Reproduce

  1. Upgrade GitLab platform to 18.6.0-ee.0
  2. Upgrade GitLab Runner to 18.6.0 with shell executor
  3. Run pipeline on a runner that has never been used with the project
  4. Run second pipeline on the same runner (build directory with existing repository)

Expected Behavior

Runner should successfully fetch repository changes using valid credentials on subsequent runs, same as in version 18.5.0.

Actual Behavior

First pipeline run (fresh clone) - SUCCESS:

Getting source from Git repository
Gitaly correlation ID: 01KAHBZ78F4D666YQF8VR2GV7X
Fetching changes with git depth set to 20...
Initialized empty Git repository in /home/gitlab-runner/builds/MeP1M3j1M/0/example-user/example-project/.git/
Created fresh repository.
Checking out c511eff9 as detached HEAD (ref is master)...
Skipping Git submodules setup

Second pipeline run (existing build directory) - FAILURE:

Getting source from Git repository
Gitaly correlation ID: 01KAHC6QK7E2H4WMFTMRHCR3YD
Fetching changes with git depth set to 20...
Reinitialized existing Git repository in /home/gitlab-runner/builds/MeP1M3j1M/0/example-user/example-project/.git/
remote: HTTP Basic: Access denied. If a password was provided for Git authentication, the password was incorrect or you're required to use a token instead of a password. If a token was provided, it was either incorrect, expired, or improperly scoped. See https://example-gitlab.com/help/topics/git/troubleshooting_git.md#error-on-git-fetch-http-basic-access-denied
fatal: Authentication failed for 'https://example-gitlab.com/example-user/example-project.git/'

Other error message seen:
Fetching changes with git depth set to 1...
Reinitialized existing Git repository in /home/gitlab-runner/builds/bGNg127p4/0/XXXX/XXXXXXXXX/.git/
fatal: unable to get password from user

Workaround Attempted

Setting GIT_STRATEGY: clone in .gitlab-ci.yml does not resolve the issue.

Workaround That Works

Downgrade to GitLab Runner 18.5.0:

apt-get install gitlab-runner-helper-images=18.5.0-1 gitlab-runner=18.5.0-1

Additional Context

  • Issue appears to be related to credential handling when reusing build directories
  • Credentials work correctly on fresh clone but fail on fetch operations
  • Both GitLab platform and GitLab Runner were upgraded - issue might be related to platform upgrade rather than runner
  • Limited investigation performed - I may be missing important upgrade steps or configuration changes
  • Rolled back to 18.5.0 immediately after confirming the issue

Configuration

  • Executor: shell
  • Platform: Linux (amd64)
  • Go version: go1.24.6 X:cacheprog

Disclaimer

I'm not certain if this is a bug or a configuration issue on my end. Please investigate and close if this is user error or missing upgrade steps.

Edited by Robert Socha