Duo Workflows: Git push fails when service account name doesn't match hardcoded DUO_WORKFLOW_GIT_USER_NAME

Problem

When a Duo Workflow runs in the context of a configured service account (e.g., duo-developer with name Duo Developer), the git push fails with the error:

[error]: [RunGitCommandActionHandler] Git command execution error
    Error: git command failed with exit code 1: warning: redirecting to https://gitlab.com/xxx.git/
    remote: GitLab: Your git author name is inconsistent with GitLab account name
    To https://gitlab.com//xxx.git
     ! [remote rejected] xxx -> xxx (pre-receive hook declined)
    error: failed to push some refs to 'https://gitlab.com//xxx.git'

Root Cause

The $DUO_WORKFLOW_GIT_USER_NAME variable is hardcoded to GitLab Duo in the workflow initialization, instead of adapting to the actual configured service account's name.

Reference: https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/services/ai/duo_workflows/start_workflow_service.rb#L153

Impact

When Reject inconsistent user name is configured on the repository, the git push fails because:

  • The git author name is set to GitLab Duo (from the hardcoded variable)
  • The actual service account has a different name (e.g., Duo Developer)
  • GitLab's pre-receive hook rejects the push due to the mismatch

Expected Behavior

The $DUO_WORKFLOW_GIT_USER_NAME variable should be dynamically set to match the actual service account's name that is running the workflow, not hardcoded to GitLab Duo.

Edited by 🤖 GitLab Bot 🤖