I added some automated commit quality checks to our gitlab CI, which essentially walks through all the commits that are in the merge request one-by-one. I essentially loop through the result of a git rev-list origin/main..

Unfortunately, the runner only doesn’t directly clone the repo, leaving us without any of the refs needed to pull this off. Our current workaround is allowing the CI access to the ${GITLAB_PROJECT_ACCESS_TOKEN} which requires an extra setting on the repository and also allows push access.

This is the gist of it:

    - git remote set-url origin "https://gitlab-ci-token:${GITLAB_PROJECT_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
    - git fetch --all
    - git rev-list --reverse origin/${CI_MERGE_REQUEST_TARGET_BRANCH_NAME}..

Is there a way to tell gitlab to just do this for me? Clone the repository in a way that has the tags and remote refs available as they would be locally, but not give push access to the things running in the CI?