Docs: document token used by the release keyword

Andrew Winatarequested to merge
docs-release-keyword-token into master

What does this MR do and why?

The release keyword documentation does not specify which token is used to perform the release, forcing users to dig through the glab CLI source to learn that GITLAB_TOKEN takes precedence over CI_JOB_TOKEN.

This MR adds an Additional details bullet to the release keyword section in doc/ci/yaml/_index.md that:

  • States the release is authenticated with CI_JOB_TOKEN by default (the generated job script runs glab auth login --job-token $CI_JOB_TOKEN before creating the release).
  • Notes that a GITLAB_TOKEN / GITLAB_ACCESS_TOKEN / OAUTH_TOKEN CI/CD variable takes precedence over the job token, because a personal access token wins in glab's token resolution.
  • Links to the official glab CLI documentation rather than only the source repository.

Related to Docs: Warn about GITLAB_TOKEN CI/CD variable co... (#604239)

Source of truth

The precedence is implemented in the glab CLI (gitlab-org/cli):

  • internal/api/client.go (NewClientFromConfig) checks the PAT before the job token.
  • Confirmed by the "PAT takes precedence over job token" test in internal/api/client_test.go.

The GitLab-side release script that logs in with CI_JOB_TOKEN is generated in lib/gitlab/ci/build/releaser.rb (GLAB_LOGIN_UNIX / GLAB_LOGIN_WINDOWS).

Author's checklist

  • Documentation reviewed by a technical writer.

Closes #604239

Edited by Andrew Winata

Merge request reports