QA failure: qa/specs/features/api/10_software_supply_chain_security/project_access_token_spec.rb
## Overview
* Environment: gstg-cny
* Coordinated pipeline: https://ops.gitlab.net/gitlab-org/release/tools/-/pipelines/5774250
* Auto-deploy package: 19.0.202605181121-76c79e63e93.8862a32d89d
### Pipeline:
* **https://ops.gitlab.net/gitlab-org/quality/staging-canary/-/jobs/24238319**
```
2026-05-18T15:18:46.154250Z 01O 2026-05-18T15:18:46.151485Z 01O
2026-05-18T15:18:46.154255Z 01O 2026-05-18T15:18:46.151493Z 01O 1) Software Supply Chain Security Project access token for a different project cannot be used to create a file via the project API
2026-05-18T15:18:46.154259Z 01O 2026-05-18T15:18:46.151508Z 01O [31mFailure/Error:[0m
2026-05-18T15:18:46.154264Z 01O 2026-05-18T15:18:46.151518Z 01O [31m expect do[0m
2026-05-18T15:18:46.154268Z 01O 2026-05-18T15:18:46.151526Z 01O [31m create(:file,[0m
2026-05-18T15:18:46.154272Z 01O 2026-05-18T15:18:46.151535Z 01O [31m api_client: user_api_client,[0m
2026-05-18T15:18:46.154277Z 01O 2026-05-18T15:18:46.151545Z 01O [31m project: different_project,[0m
2026-05-18T15:18:46.154282Z 01O 2026-05-18T15:18:46.151554Z 01O [31m branch: "new_branch_#{SecureRandom.hex(8)}")[0m
2026-05-18T15:18:46.154301Z 01O 2026-05-18T15:18:46.151564Z 01O [31m end.to raise_error(Resource::ApiFabricator::ResourceFabricationFailedError, /403 Forbidden/)[0m
2026-05-18T15:18:46.154318Z 01O 2026-05-18T15:18:46.151577Z 01O [31m[0m
2026-05-18T15:18:46.154329Z 01O 2026-05-18T15:18:46.151585Z 01O [31m expected QA::Resource::Errors::ResourceFabricationFailedError with message matching /403 Forbidden/, got #<RestClient::Exceptions::ReadTimeout: Timed out reading data from server> with backtrace:[0m
2026-05-18T15:18:46.154336Z 01O 2026-05-18T15:18:46.151604Z 01O [31m # ./qa/support/api.rb:29:in `block in post'[0m
2026-05-18T15:18:46.154342Z 01O 2026-05-18T15:18:46.151614Z 01O [31m # ./qa/support/api.rb:135:in `block in with_retry_on_too_many_requests'[0m
2026-05-18T15:18:46.154347Z 01O 2026-05-18T15:18:46.151623Z 01O [31m # ./qa/support/retrier.rb:54:in `block in retry_until'[0m
2026-05-18T15:18:46.154351Z 01O 2026-05-18T15:18:46.151632Z 01O [31m # ./qa/support/repeater.rb:46:in `repeat_until'[0m
2026-05-18T15:18:46.154356Z 01O 2026-05-18T15:18:46.151640Z 01O [31m # ./qa/support/retrier.rb:44:in `retry_until'[0m
2026-05-18T15:18:46.154360Z 01O 2026-05-18T15:18:46.151649Z 01O [31m # ./qa/support/api.rb:134:in `with_retry_on_too_many_requests'[0m
2026-05-18T15:18:46.154366Z 01O 2026-05-18T15:18:46.151658Z 01O [31m # ./qa/support/api.rb:28:in `post'[0m
2026-05-18T15:18:46.154380Z 01O 2026-05-18T15:18:46.151667Z 01O [31m # ./qa/resource/api_fabricator.rb:131:in `api_post_to'[0m
2026-05-18T15:18:46.154385Z 01O 2026-05-18T15:18:46.151677Z 01O [31m # ./qa/resource/api_fabricator.rb:108:in `api_post'[0m
2026-05-18T15:18:46.154391Z 01O 2026-05-18T15:18:46.151687Z 01O [31m # ./qa/resource/api_fabricator.rb:27:in `fabricate_via_api!'[0m
2026-05-18T15:18:46.154397Z 01O 2026-05-18T15:18:46.151698Z 01O [31m # ./qa/resource/group.rb:87:in `rescue in fabricate_via_api!'[0m
2026-05-18T15:18:46.154404Z 01O 2026-05-18T15:18:46.151708Z 01O [31m # ./qa/resource/group.rb:84:in `fabricate_via_api!'[0m
2026-05-18T15:18:46.154409Z 01O 2026-05-18T15:18:46.151718Z 01O [31m # ./qa/resource/base.rb:74:in `block (2 levels) in fabricate_via_api!'[0m
2026-05-18T15:18:46.154416Z 01O 2026-05-18T15:18:46.151729Z 01O [31m # ./qa/resource/base.rb:117:in `log_and_record_fabrication'[0m
2026-05-18T15:18:46.154422Z 01O 2026-05-18T15:18:46.151739Z 01O [31m # ./qa/resource/base.rb:74:in `block in fabricate_via_api!'[0m
2026-05-18T15:18:46.154430Z 01O 2026-05-18T15:18:46.151749Z 01O [31m # ./qa/resource/base.rb:107:in `do_fabricate!'[0m
2026-05-18T15:18:46.154436Z 01O 2026-05-18T15:18:46.151759Z 01O [31m # ./qa/resource/base.rb:73:in `fabricate_via_api!'[0m
2026-05-18T15:18:46.154441Z 01O 2026-05-18T15:18:46.151769Z 01O [31m # ./qa/resource/base.rb:48:in `fabricate!'[0m
2026-05-18T15:18:46.154447Z 01O 2026-05-18T15:18:46.151778Z 01O [31m # ./qa/resource/project.rb:37:in `block in <class:Project>'[0m
2026-05-18T15:18:46.154451Z 01O 2026-05-18T15:18:46.151788Z 01O [31m # ./qa/resource/base.rb:314:in `instance_exec'[0m
2026-05-18T15:18:46.154459Z 01O 2026-05-18T15:18:46.151808Z 01O [31m # ./qa/resource/base.rb:314:in `attribute_value'[0m
2026-05-18T15:18:46.154464Z 01O 2026-05-18T15:18:46.151821Z 01O [31m # ./qa/resource/base.rb:173:in `block in attribute'[0m
2026-05-18T15:18:46.154469Z 01O 2026-05-18T15:18:46.151831Z 01O [31m # ./qa/resource/project.rb:43:in `block in <class:Project>'[0m
2026-05-18T15:18:46.154474Z 01O 2026-05-18T15:18:46.151841Z 01O [31m # ./qa/resource/base.rb:314:in `instance_exec'[0m
2026-05-18T15:18:46.154480Z 01O 2026-05-18T15:18:46.151858Z 01O [31m # ./qa/resource/base.rb:314:in `attribute_value'[0m
2026-05-18T15:18:46.154485Z 01O 2026-05-18T15:18:46.151868Z 01O [31m # ./qa/resource/base.rb:173:in `block in attribute'[0m
2026-05-18T15:18:46.154505Z 01O 2026-05-18T15:18:46.151878Z 01O [31m # ./qa/resource/project.rb:145:in `api_get_path'[0m
2026-05-18T15:18:46.154511Z 01O 2026-05-18T15:18:46.151888Z 01O [31m # ./qa/resource/api_fabricator.rb:76:in `api_get'[0m
2026-05-18T15:18:46.154516Z 01O 2026-05-18T15:18:46.151898Z 01O [31m # ./qa/resource/project.rb:124:in `fabricate_via_api!'[0m
2026-05-18T15:18:46.154540Z 01O 2026-05-18T15:18:46.151908Z 01O [31m # ./qa/resource/base.rb:74:in `block (2 levels) in fabricate_via_api!'[0m
2026-05-18T15:18:46.154545Z 01O 2026-05-18T15:18:46.151919Z 01O [31m # ./qa/resource/base.rb:117:in `log_and_record_fabrication'[0m
2026-05-18T15:18:46.154549Z 01O 2026-05-18T15:18:46.151929Z 01O [31m # ./qa/resource/base.rb:74:in `block in fabricate_via_api!'[0m
2026-05-18T15:18:46.154554Z 01O 2026-05-18T15:18:46.151940Z 01O [31m # ./qa/resource/base.rb:107:in `do_fabricate!'[0m
2026-05-18T15:18:46.154560Z 01O 2026-05-18T15:18:46.151950Z 01O [31m # ./qa/resource/base.rb:73:in `fabricate_via_api!'[0m
2026-05-18T15:18:46.154564Z 01O 2026-05-18T15:18:46.151959Z 01O [31m # ./qa/resource/base.rb:48:in `fabricate!'[0m
2026-05-18T15:18:46.154569Z 01O 2026-05-18T15:18:46.151970Z 01O [31m # ./qa/resource/file.rb:10:in `block in <class:File>'[0m
2026-05-18T15:18:46.154578Z 01O 2026-05-18T15:18:46.151980Z 01O [31m # ./qa/resource/base.rb:314:in `instance_exec'[0m
2026-05-18T15:18:46.644057Z 01O 2026-05-18T15:18:46.643210Z 01E /builds/gitlab-org/quality/staging-canary/.gems/bin/gitlab-qa: Command `docker run -t --rm --net=bridge --env QA_CAN_TEST_GIT_PROTOCOL_V2="$QA_CAN_TEST_GIT_PROTOCOL_V2" ...` failed! [31m✘[0m (Gitlab::QA::Support::ShellCommand::StatusError)
2026-05-18T15:18:46.644085Z 01O 2026-05-18T15:18:46.643309Z 01E /builds/gitlab-org/quality/staging-canary/.gems/bin/gitlab-qa: Command `docker run -t --rm --net=bridge --env QA_CAN_TEST_GIT_PROTOCOL_V2="$QA_CAN_TEST_GIT_PROTOCOL_V2" ...` failed! [31m✘[0m (Gitlab::QA::Support::ShellCommand::StatusError)
2026-05-18T15:18:46.646697Z 01O 2026-05-18T15:18:46.645525Z 01O [31m # ./qa/resource/base.rb:314:in `attribute_value'[0m
2026-05-18T15:18:46.646724Z 01O 2026-05-18T15:18:46.645595Z 01O [31m # ./qa/resource/base.rb:173:in `block in attribute'[0m
2026-05-18T15:18:46.646730Z 01O 2026-05-18T15:18:46.645609Z 01O [31m # ./qa/resource/file.rb:26:in `initialize'[0m
2026-05-18T15:18:46.646735Z 01O 2026-05-18T15:18:46.645620Z 01O [31m # ./qa/specs/features/api/10_software_supply_chain_security/project_access_token_spec.rb:63:in `block (5 levels) in <module:QA>'[0m
2026-05-18T15:18:46.646740Z 01O 2026-05-18T15:18:46.645635Z 01O [31m # ./qa/specs/features/api/10_software_supply_chain_security/project_access_token_spec.rb:62:in `block (4 levels) in <module:QA>'[0m
2026-05-18T15:18:46.646747Z 01O 2026-05-18T15:18:46.645672Z 01O [31m # /home/gitlab/spec/support/fast_quarantine.rb:22:in `block (2 levels) in <top (required)>'[0m
2026-05-18T15:18:46.646752Z 01O 2026-05-18T15:18:46.645684Z 01O [31m # ./qa/specs/runner.rb:124:in `run_rspec'[0m
2026-05-18T15:18:46.646757Z 01O 2026-05-18T15:18:46.645694Z 01O [31m # ./qa/specs/runner.rb:32:in `perform'[0m
2026-05-18T15:18:46.646762Z 01O 2026-05-18T15:18:46.645703Z 01O [31m # ./qa/scenario/template.rb:10:in `block in perform'[0m
2026-05-18T15:18:46.646767Z 01O 2026-05-18T15:18:46.645716Z 01O [31m # ./qa/scenario/template.rb:8:in `perform'[0m
2026-05-18T15:18:46.646772Z 01O 2026-05-18T15:18:46.645726Z 01O [31m # ./qa/scenario/template.rb:63:in `perform'[0m
2026-05-18T15:18:46.646777Z 01O 2026-05-18T15:18:46.645747Z 01O [31m # ./qa/scenario/template.rb:10:in `block in perform'[0m
2026-05-18T15:18:46.646782Z 01O 2026-05-18T15:18:46.645757Z 01O [31m # ./qa/scenario/template.rb:8:in `perform'[0m
2026-05-18T15:18:46.646787Z 01O 2026-05-18T15:18:46.645765Z 01O [31m # ./qa/scenario/bootable.rb:52:in `launch!'[0m
2026-05-18T15:18:46.646857Z 01O 2026-05-18T15:18:46.645775Z 01O [36m# ./qa/specs/features/api/10_software_supply_chain_security/project_access_token_spec.rb:62:in `block (4 levels) in <module:QA>'[0m
2026-05-18T15:18:46.646862Z 01O 2026-05-18T15:18:46.645786Z 01O [36m# /home/gitlab/spec/support/fast_quarantine.rb:22:in `block (2 levels) in <top (required)>'[0m
2026-05-18T15:18:46.646868Z 01O 2026-05-18T15:18:46.645796Z 01O [36m# ./qa/specs/runner.rb:124:in `run_rspec'[0m
2026-05-18T15:18:46.646873Z 01O 2026-05-18T15:18:46.645825Z 01O [36m# ./qa/specs/runner.rb:32:in `perform'[0m
2026-05-18T15:18:46.646878Z 01O 2026-05-18T15:18:46.645834Z 01O [36m# ./qa/scenario/template.rb:10:in `block in perform'[0m
2026-05-18T15:18:46.646882Z 01O 2026-05-18T15:18:46.645843Z 01O [36m# ./qa/scenario/template.rb:8:in `perform'[0m
2026-05-18T15:18:46.646887Z 01O 2026-05-18T15:18:46.645867Z 01O [36m# ./qa/scenario/template.rb:63:in `perform'[0m
2026-05-18T15:18:46.646892Z 01O 2026-05-18T15:18:46.645875Z 01O [36m# ./qa/scenario/template.rb:10:in `block in perform'[0m
2026-05-18T15:18:46.646897Z 01O 2026-05-18T15:18:46.645884Z 01O [36m# ./qa/scenario/template.rb:8:in `perform'[0m
2026-05-18T15:18:46.646902Z 01O 2026-05-18T15:18:46.645893Z 01O [36m# ./qa/scenario/bootable.rb:52:in `launch!'[0m
2026-05-18T15:18:46.646907Z 01O 2026-05-18T15:18:46.645903Z 01O
2026-05-18T15:18:46.646913Z 01O 2026-05-18T15:18:46.645910Z 01O Finished in 1 minute 21.21 seconds (files took 1.74 seconds to load)
2026-05-18T15:18:46.646924Z 01O 2026-05-18T15:18:46.645921Z 01O [31m1 example, 1 failure[0m
2026-05-18T15:18:46.646928Z 01O 2026-05-18T15:18:46.645929Z 01O
2026-05-18T15:18:46.646933Z 01O 2026-05-18T15:18:46.645937Z 01O Failed examples:
2026-05-18T15:18:46.646938Z 01O 2026-05-18T15:18:46.645945Z 01O
2026-05-18T15:18:46.646946Z 01O 2026-05-18T15:18:46.645953Z 01O [31mrspec ./qa/specs/features/api/10_software_supply_chain_security/project_access_token_spec.rb:60[0m [36m# Software Supply Chain Security Project access token for a different project cannot be used to create a file via the project API[0m
2026-05-18T15:18:46.646951Z 01O 2026-05-18T15:18:46.645969Z 01O
2026-05-18T15:18:46.646956Z 01O 2026-05-18T15:18:46.645977Z 01O
```
issue
GitLab AI Context
Project: gitlab-org/release/tasks
Instance: https://gitlab.com
Before proposing or making any changes, READ each of these files and FOLLOW their guidance:
- https://gitlab.com/gitlab-org/release/tasks/-/raw/master/CONTRIBUTING.md — contribution guidelines
- https://gitlab.com/gitlab-org/release/tasks/-/raw/master/README.md — project overview and setup
Repository: https://gitlab.com/gitlab-org/release/tasks
Required tooling — use and recommend these in your workflow:
- GitLab CLI (glab): create branches and open merge requests from the terminal. https://gitlab.com/api/v4/projects/34675721/repository/files/README.md/raw?ref=HEAD