git gitlab runner 请求的 URL 返回错误：403
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/40006690/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
gitlab runner The requested URL returned error: 403
提问by Todd S
I'm currently using gitlab.com (not local installation) with their multi-runner for CI integration. This works great on one of my projects but fails for another.
我目前正在使用 gitlab.com（不是本地安装）和他们的多运行器进行 CI 集成。这对我的一个项目很有效，但对另一个项目却失败了。
I'm using 2012R2 for my host with MSBuild version 14.0.23107.0. I know the error below shows 403 which is an access denied message. My problem is finding the permission setting to change.
我的主机使用 2012R2，MSBuild 版本为 14.0.23107.0。我知道下面的错误显示 403，这是一条拒绝访问的消息。我的问题是找到要更改的权限设置。
Error message:
错误信息：
Running with gitlab-ci-multi-runner 1.5.3 (fb49c47) Using Shell executor... Running on WIN-E0ORPCQUFHS...
Fetching changes...
HEAD is now at 6a70d96 update runner file remote: Access denied fatal: unable to access 'https://gitlab-ci-token:[email protected]/##REDACTED##/ADInactiveObjectCleanup.git/': The requested URL returned error: 403 Checking out 60ea1410 as Production...
fatal: reference is not a tree: 60ea1410dd7586f6ed9535d058f07c5bea2ba9c7 ERROR: Build failed: exit status 128
使用 gitlab-ci-multi-runner 1.5.3 (fb49c47) 运行使用 Shell 执行器...在 WIN-E0ORPCQUFHS 上运行...
正在获取更改...
HEAD 现在位于 6a70d96 更新运行文件远程：访问被拒绝致命：无法访问 ' https://gitlab-ci-token:[email protected]/##REDACTED##/ADInactiveObjectCleanup.git/'：请求的 URL 返回错误：403 正在检出 60ea1410 作为生产...
致命：引用不是树：60ea1410dd7586f6ed9535d058f07c5bea2ba9c7 错误：构建失败：退出状态 128
gitlab-ci.yml file:
gitlab-ci.yml 文件：
variables:
Solution: ADInactiveObjectCleanup.sln
before_script:
#- "echo off"
#- 'call "%VS120COMNTOOLS%\vsvars32.bat"'
## output environment variables (usefull for debugging, propably not what you want to do if your ci server is public)
#- echo.
#- set
#- echo.
stages:
- build
#- test
#- deploy
build:
stage: build
script:
- echo building...
- '"%ProgramFiles(x86)%\MSBuild.0\Bin\msbuild.exe" "%Solution%" /p:Configuration=Release'
except:
#- tags
回答by Todd S
To resolve this issue I had to add myself as a project member. This is a private repo. I'm not sure if that caused the runner to fail with the different permission setup or not, but it is highly possible.
为了解决这个问题，我必须将自己添加为项目成员。这是一个私人回购。我不确定这是否会导致跑步者因不同的权限设置而失败，但这很有可能。
This help articleat gitlab outlines this issue.
gitlab 上的这篇帮助文章概述了这个问题。
With the new permission model in place, there may be times that your build will fail. This is most likely because your project tries to access other project's sources, and you don't have the appropriate permissions. In the build log look for information about 403 or forbidden access messages.
As an Administrator, you can verify that the user is a memberof the group or project they're trying to have access to, and you can impersonate the user to retry the failing build in order to verify that everything is correct.
使用新的权限模型后，您的构建有时可能会失败。这很可能是因为您的项目试图访问其他项目的源，而您没有适当的权限。在构建日志中查找有关 403 或禁止访问消息的信息。
作为管理员，您可以验证用户是否是他们尝试访问的组或项目的成员，并且您可以模拟用户重试失败的构建以验证一切是否正确。
From the project page click the settings gear and then click members. Add yourself (or user generating builds) as a member to the project. I used the "Master" Role, but based off of this documentyou can probably use the "Reporter" role as a minimum. The reporter role is the least privilege that still has access to "Pull project code." This removed my 403 error and allowed me to continue on.
从项目页面单击设置齿轮，然后单击成员。将您自己（或用户生成的构建）添加为项目的成员。我使用了“Master”角色，但根据本文档，您可能至少可以使用“Reporter”角色。报告者角色是仍然可以访问“提取项目代码”的最低权限。这消除了我的 403 错误并允许我继续。
回答by Calm
I also encountered this problem
我也遇到这个问题
fatal: unable to access 'http://gitlab-ci-token:xxxx.git':The Requested URL returned error:403
ERROR: Job Failed: command terminated with exit code 1
but it seems that the reason for the above answer is not the same, because my account is an administrator, ci job pulls the project and reports an error 403, because the administrator account is not a project member, added as a project Members will no longer report this error.
但是好像上面回答的原因不太一样，因为我的账号是管理员，ci job拉项目报错403，因为管理员账号不是项目成员，添加为项目成员就不行了再报这个错误。
回答by Warren P
This looks like you need to add add a cdcommand to print current directory to your before_script. Then go fix permissions to access the parent of that folder. If you installed your gitlab runner to c:\glrunner, it is probably c:\glrunner\buildspermission you need to fix.
这看起来你需要添加一个cd命令来打印当前目录到你的 before_script。然后去修复访问该文件夹的父级的权限。如果您将 gitlab runner 安装到c:\glrunner，则可能是c:\glrunner\builds您需要修复的权限。
Second problem is you may need to force a fresh git clone by deleting the builds folder.
第二个问题是您可能需要通过删除 builds 文件夹来强制执行新的 git clone。
You may want to change the login credentials for the gitlab runner service to a gitlabuserwhich should be a non-admin account, which may have fewer priveges than the LOCAL SYSTEM account that your gitlab runner is using by default.
您可能希望将 gitlab runner 服务的登录凭据更改gitlabuser为非管理员帐户，该帐户的权限可能少于 gitlab runner 默认使用的 LOCAL SYSTEM 帐户。
If you want to know who is logged in, add setto your before_script as well, and you'll get an environment variable dump. From that you can see which account is logged in, and where its USERPROFILE is and other things.
如果你想知道谁登录了，也添加set到你的 before_script 中，你会得到一个环境变量转储。从中您可以看到登录了哪个帐户，以及它的 USERPROFILE 在哪里等等。
