Everytime I have to do something new with GitLab CI, it’s harder than fighting inner demons to figure out the correct permissions for things.

Today I learned more about CI_JOB_TOKEN, the access token one gets by default in their CI runtime.

I’ve always regarded this similar to Personal Access Tokens (PATs) in GitLab. One way it’s different is the CI_JOB_TOKEN works only when CI_JOB_USERNAME is gitlab-ci-token. On the other hand, with PATs used, GitLab doesn’t care about the username provided.