semantic-release in a GitLab pipeline with multiple users

Question

I'm running a semantic-release job in a GitLab pipeline, it works great but only for my user (I configured it). No one else seems able to trigger a release, even if I merge their code. No errors, everything seems to run smoothly. I'm assuming there's some kind of authentication issue and/or everyone needs their own token or something like that? (I've only configured a token via my account and I'm not sure how I'd instruct someone to do that for multiple accounts in GitLab.)

The pipeline looks like this:

variables:
  GL_TOKEN: $GL_TOKEN

stages:
    - release

publish:
  image: node:lts-alpine
  stage: release
  before_script:
    - apk update
    - apk add zip unzip git 
    - npm ci
  script:
    - npm run build
    - npx semantic-release
  only:
    refs:
      - main

and the config (in the package.json) is:

"release": {
    "branches": [
        "main"
    ],
    "plugins": [
        "@semantic-release/commit-analyzer",
        "@semantic-release/release-notes-generator",
        [
            "@google/semantic-release-replace-plugin",
            {
                "replacements": [
                    {
                        "files": [
                            "style.css"
                        ],
                        "from": "Version: .*",
                        "to": "Version: ${nextRelease.version}",
                        "results": [
                            {
                                "file": "style.css",
                                "hasChanged": true,
                                "numMatches": 1,
                                "numReplacements": 1
                            }
                        ],
                        "countMatches": true
                    },
                    {
                        "files": [
                            "package.json"
                        ],
                        "from": "\"version\": \".*\",",
                        "to": "\"version\": \"${nextRelease.version}\",",
                        "results": [
                            {
                                "file": "package.json",
                                "hasChanged": true,
                                "numMatches": 1,
                                "numReplacements": 1
                            }
                        ],
                        "countMatches": true
                    }
                ]
            }
        ],
        [
            "@semantic-release/git",
            {
                "assets": [
                    "style.css",
                    "package.json"
                ],
                "message": "chore(release): ${nextRelease.version} [skip ci]"
            }
        ],
        [
            "@semantic-release/exec",
            {
                "prepareCmd": "node bin/makezip.js"
            }
        ],
        [
            "@semantic-release/gitlab",
            {
                "assets": [
                    {
                        "path": "file.zip",
                        "label": "compiled release"
                    }
                ]
            }
        ]
    ]
}

Answer 1

I would suggest creating token per project and using that instead of your personal token.

You can create project token from project Settings > Access Token

This should solve your issue.