### Overview The CI_JOB_TOKEN CI/CD variable makes API calls more intuitive within CI/CD jobs, enabling advanced automation. For example, the token can be used with bot automation projects that run pipelines in other projects. The token is short-lived, but in an effort to make its usage even more secure we are adding a setting that lets you list the exact projects that can be accessed with your project's CI job token. If the token is used to try to access other projects, it will be denied access to the API. In the bot automation example, it gives you additional control over the exact projects your bot will have access to and an added layer of security when using the CI_JOB_TOKEN CI/CD variable. This setting is enabled by default for all new projects, and we strongly recommend enabling it in all your existing projects. ### Vision Our vision for the CI_JOB_TOKEN is to let it replace longer lived tokens like Project or Personal Access Tokens in pipelines. We want to let project maintainers have the ultimate control over what those tokens are allowed to do within their project. ### Roadmap / Goals #### Phase 1.0 - Users of a project can limit which projects their token can use / GitLab has usage data * [x] Owners of a project want to limit their own project access with a CI_JOB_TOKEN - https://gitlab.com/gitlab-org/gitlab/-/issues/328553 #### Phase 1.1 - CI_JOB_TOKEN can be used for use cases like Dependabot without worrying about tokens leaking. Get data about which projects * [x] I (developer) want to know if this project uses secure CI_JOB_TOKENs through the API - https://gitlab.com/gitlab-org/gitlab/-/issues/337087 - %"15.5" * [x] I want to allow a bot to run pipelines in my project securely - https://gitlab.com/gitlab-org/gitlab/-/issues/346298 - %"15.9" * [x] https://gitlab.com/gitlab-org/gitlab/-/issues/375782+ - %"15.9" * [x] New projects want CI_JOB_TOKENs enabled by default - only let my project access what I say it can - https://gitlab.com/gitlab-org/gitlab/-/issues/340822 - %"15.9" * [x] Add CI_JOB_TOKEN project additions to audit log - https://gitlab.com/gitlab-org/gitlab/-/issues/338255 - %"15.10" * [x] Add REST API for CI_JOB_TOKEN - https://gitlab.com/gitlab-org/gitlab/-/issues/351740 - %"15.10" * [ ] Remove outbound flow - https://gitlab.com/gitlab-org/gitlab/-/issues/383084 - %"16.0" * [ ] Remove inbound flow as optional / enforce inbound as always on - https://gitlab.com/gitlab-org/gitlab/-/issues/335465 - %"17.0" * [ ] Report on projects with access to CI_JOB_TOKEN limited - https://gitlab.com/gitlab-org/gitlab/-/issues/366378 - TBD