Allow CI includes from public/internal projects via CI_JOB_TOKEN if repository visibility is not limited
Summary
Pipelines triggered via the api with a Job Token cannot access public components or perform project includes from a public/internal project. This is the case even when Limit job token scope for public or internal projects is not set up to limit repository access to project members.
This has already been reported in #451993 (closed) but was not fixed there as the issue was classified as troubleshooting request.
This issue also contains some comments that describe this issue in different contexts, like here and here.
There was a discussion if it should be added to Granular Job Token Permissions. But in my Opinion it should not be required to manually give the token more permissions as the pipeline should already have access to these components and it works with different triggers.
Steps to reproduce
see also example project below
- create a pipeline that uses (public) component
- trigger the pipeline via api from another pipeline
Example Project
https://gitlab.com/erik.petzold1/component-access-demo
Uses the public https://gitlab.com/components/code-quality-oss/codequality-os-scanners-integration components.
Pipeline for main can use the component: https://gitlab.com/erik.petzold1/component-access-demo/-/pipelines/2257426892
Pipeline for branch can use the component: https://gitlab.com/erik.petzold1/component-access-demo/-/pipelines/2257427582
Pipeline where main branch triggers the other branch fails: https://gitlab.com/erik.petzold1/component-access-demo/-/pipelines/2257428537
What is the current bug behavior?
Error message in the logs:
{"message":{"base":["Component 'gitlab.com/components/code-quality-oss/codequality-os-scanners-integration/codequality-oss@1.1.5' - project does not exist or you don't have sufficient permissions"]}}What is the expected correct behavior?
Component is loaded and used.
Relevant logs and/or screenshots
