I am using a group access token (GAT) to download artifacts from one private repository into another and use those during the build step. Both repos are on the same self-hosted community edition instance (I am just a user, not an admin).

During the CI execution I dump the CI_GROUP_TOKEN (the name of my GAT with full api access with Developer role) into a token.txt

.setup_token:
  before_script:
    # Using group access token named CI_GROUP_TOKEN instead of CI_JOB_TOKEN due to failure to use real CI job token between private repos (reason unknown)
    - git config --system core.longpaths true
    - echo "CI_GROUP_TOKEN = $($CI_GROUP_TOKEN)"
    - echo $CI_GROUP_TOKEN > token.txt

that I then read using CMake’s file(STRINGS ...) function:

file(
    STRINGS
    "${CMAKE_SOURCE_DIR}/token.txt"
    TOKEN
    LIMIT_COUNT 1
)

In my secondary repo’s job list (the one that downloads the artifacts) I noticed failure for my debug branch

but not for the main (default settings, so it’s protected):

I am unable to find anything in the GitLab documentation.

The token is used in a curl CMake FetchContant_MakeAvailable() call with the header set properly to PRIVATE-TOKEN: <value-from-token.txt>. The produced REST API request URL can be opened using the same token locally (in my own local setup) as well as with a personal access token and in the web browser (where I have an actively logged user for that GitLab instance).

I also tried Maintainer access without any change in outcome.