Fail on git push --dry-run --no-verify: remote: HTTP Basic: Access denied

[EvanCarroll]

I've tried authenticating with

• Project Access token
  • w/ just API
  • w/ API & Write Repo
• Personal Access token with API & Write Repo

I still get failures like this,

[8:13:17 PM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/gitlab"
2021-07-22T20:13:17.637Z semantic-release:get-git-auth-url Verifying ssh auth by attempting to push to  https://gitlab.awe.eco.cpanel.net/foo/bar.git
2021-07-22T20:13:18.220Z semantic-release:git Error: Command failed with exit code 128: git push --dry-run --no-verify https://gitlab.awe.eco.cpanel.net/foo/bar.git HEAD:main
remote: HTTP Basic: Access denied
fatal: Authentication failed for 'https://gitlab.awe.eco.cpanel.net/foo/bar.git/'
    at makeError (/usr/local/lib/node_modules/semantic-release/node_modules/execa/lib/error.js:60:11)
    at handlePromise (/usr/local/lib/node_modules/semantic-release/node_modules/execa/index.js:118:26)
    at processTicksAndRejections (node:internal/process/task_queues:96:5)
    at async verifyAuth (/usr/local/lib/node_modules/semantic-release/lib/git.js:207:5)
    at async module.exports (/usr/local/lib/node_modules/semantic-release/lib/get-git-auth-url.js:91:5)
    at async run (/usr/local/lib/node_modules/semantic-release/index.js:56:27)
    at async module.exports (/usr/local/lib/node_modules/semantic-release/index.js:260:22)
    at async module.exports (/usr/local/lib/node_modules/semantic-release/cli.js:55:5)
2021-07-22T20:13:18.220Z semantic-release:get-git-auth-url SSH key auth failed, falling back to https.
2021-07-22T20:13:19.134Z semantic-release:get-tags found tags for branch main: [ { gitTag: 'v1.0.0', version: '1.0.0', channels: [ null ] } ]

However, with each one of these three tokens I can confirm it works with

git push --dry-run --no-verify https://oauth:GITLAB_TOKEN@gitlab.awe.eco.cpanel.net/foo/bar.git

I guess the questions here are why is semantic-release:git's verifyAuth being called, and why doesn't it use the GITLAB_TOKEN that I provide?

[EvanCarroll]

Rundown here

• I had a 409 Conflict that was caused by tags. GitLab normally fetches, it does not clone. Switching to clone resolved this and removed tags were purged.
• In troubleshooting that 409 Conflict I enabled --debug. I could then see a "remote: HTTP Basic: Access denied
  fatal: Authentication failed".
• In troubleshooting that spurious error message, I created an image so GL and local dev environment would have the same environment. I pulled the image down locally and ran docker with an env-file. I forgot that docker env-files do not use quotes. env-file has quoting problems docker/for-linux#1208 This gave me a legitamite access denied error in the container because the token was quoted, GITLAB_TOKEN="whatever" rather than GITLAB_TOKEN=whatever
• I hacked the semantic-release/* stuff in order to disable the detail hiding mechanisms because there is no feature for that: FEATURE REQUEST: Ability to not hide sensitive information. semantic-release#2050
• This allowed me identify the above quote marks that were wrapping the token from my env file. I opened up an issue to warn on these FEATURE REQUEST: Die on all use of tokens within single- or double- quotes. semantic-release#2051
• This allowed me to get back to the Access denied error. I troubleshooted that and I believe it's just a result of bad upstream code (which tries and fails different validation methods), and a confusing --debug implementation flag that dumps these attempts to the screen without telling the user it's normal. BUG: verifyAuth should not try SSH in the presence of a token in the environment; and should not call debug() semantic-release#2053

[EvanCarroll]

If anyone else does the same thing, I would love to see you comment on here and fess up to it. I do wonder how common this is.

[mohit497]

found the same issue today trying to setup CI on github actions

[david-shepard]

I'm not sure if I'm having the exact issue, but definitely having a similar issue. I have GH_TOKEN set and it insists on trying SSH authentication. I see the snippet https://github.com/semantic-release/semantic-release/blob/master/lib/get-git-auth-url.js#L91 trying SSH auth and falling back - but it's causing a failure for me.

18:43:44  2021-10-14T22:43:43.950Z semantic-release:get-git-auth-url Verifying ssh auth by attempting to push to  https://github.ibm.com/<repo name>
18:43:44  2021-10-14T22:43:44.157Z semantic-release:git Error: Command failed with exit code 128: git push --dry-run --no-verify https://github.ibm.com/<repo name> HEAD:master