Pipeline fails on permissions when Admin pushes into repo without expixitly granted permissions
Summary
When I'm on my own instance a Gitlab Admin (so I can do everything without permissions explicitly granted), the pipeline fails
Steps to reproduce
Run an instance. Let other account make a private project and don't give the Admin any explicit permisions. Run a CI/CD job by pushing a code by the Admin
Example Project
I'm unable to reproduce on Gitlab.com by definition. Instance Admin required
What is the current bug behavior?
Pipeline fails due to permission error.
What is the expected correct behavior?
Pipeline should succeed as the Admin has permissions to the project by default
Relevant logs and/or screenshots
Job result:
remote: You are not allowed to download code from this project.
fatal: unable to access <<<the repo url>>> : The requested URL returned error: 403
Output of checks
(If you are reporting a bug on GitLab.com, write: This bug happens on GitLab.com)
Results of GitLab environment info
Expand for output related to GitLab environment info
System information System: Debian 10 Current User: git Using RVM: no Ruby Version: 2.6.5p114 Gem Version: 2.7.10 Bundler Version:1.17.3 Rake Version: 12.3.3 Redis Version: 5.0.7 Git Version: 2.24.1 Sidekiq Version:5.2.7 Go Version: unknownGitLab information Version: 12.7.2 Revision: 2d4cda9da36 Directory: /opt/gitlab/embedded/service/gitlab-rails DB Adapter: PostgreSQL DB Version: 10.9 URL: https://[REDACTED] HTTP Clone URL: https://[REDACTED]/some-group/some-project.git SSH Clone URL: git@:some-group/some-project.git Using LDAP: no Using Omniauth: yes Omniauth Providers:
GitLab Shell Version: 11.0.0 Repository storage paths:
- default: /var/opt/gitlab/git-data/repositories GitLab Shell path: /opt/gitlab/embedded/service/gitlab-shell Git: /opt/gitlab/embedded/bin/git
Results of GitLab application Check
Expand for output related to the GitLab application check
Checking GitLab subtasks ...Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 11.0.0 ? ... OK (11.0.0) Running /opt/gitlab/embedded/service/gitlab-shell/bin/check Internal API available: OK Redis available via internal API: OK gitlab-shell self-check successful
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... yes Number of Sidekiq processes ... 1
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Checking Reply by email ...
IMAP server credentials are correct? ... no Try fixing it: An error occurred: Errno::ECONNREFUSED: Connection refused - connect(2) for 127.0.0.1:143 Check that the information in config/gitlab.yml is correct For more information see: doc/administration/reply_by_email.md Please fix the error above and rerun the checks. Init.d configured correctly? ... skipped MailRoom running? ... skipped
Checking Reply by email ... Finished
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... LDAP is disabled in config/gitlab.yml
Checking LDAP ... Finished
Checking GitLab App ...
Git configured correctly? ... yes Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... yes Init script exists? ... skipped (omnibus-gitlab has no init script) Init script up-to-date? ... skipped (omnibus-gitlab has no init script) Projects have namespace: ... 5/1 ... yes 4/3 ... yes 6/4 ... yes 8/7 ... yes 8/8 ... yes 2/9 ... yes 9/10 ... yes 14/12 ... yes 11/14 ... yes 16/15 ... yes 17/18 ... yes 17/19 ... yes 17/21 ... yes 17/23 ... yes 13/24 ... yes 6/26 ... yes 17/27 ... yes 17/28 ... yes 19/29 ... yes 18/30 ... yes 17/31 ... yes 5/32 ... yes 9/33 ... yes 17/34 ... yes 21/35 ... yes 23/36 ... yes 25/40 ... yes 25/41 ... yes 17/42 ... yes 26/44 ... yes 4/46 ... yes 27/47 ... yes 4/48 ... yes 27/49 ... yes 28/50 ... yes 29/51 ... yes 27/52 ... yes 18/53 ... yes 27/54 ... yes 7/55 ... yes 7/56 ... yes 33/57 ... yes 32/58 ... yes 9/59 ... yes 25/60 ... yes 33/61 ... yes 43/62 ... yes 33/63 ... yes 44/64 ... yes 46/65 ... yes 46/66 ... yes 46/67 ... yes 2/68 ... yes 43/69 ... yes 46/70 ... yes 2/71 ... yes 2/72 ... yes 33/73 ... yes 49/74 ... yes 11/75 ... yes 11/76 ... yes Redis version >= 2.8.0? ... yes Ruby version >= 2.5.3 ? ... yes (2.6.5) Git version >= 2.22.0 ? ... yes (2.24.1) Git user has default SSH configuration? ... yes Active users: ... 22 Is authorized keys file accessible? ... yes
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished