Summary
gitlab-ci-local adds default port numbers (:443 for HTTPS, :80 for HTTP) to URLs used for git clone when fetching include:project and include:component. This breaks git credential helpers (e.g. glab auth git-credential) that match credentials by exact URL — https://git.example.com and https://git.example.com:443 are treated as different hosts.
Minimal reproduction
- Self-hosted GitLab at
https://git.example.com (no explicit port in remote URL)
- Git credential helper configured for
https://git.example.com:
[credential "https://git.example.com"]
helper =
helper = !glab auth git-credential
.gitlab-ci.yml with a project include:
include:
- project: 'group/ci-templates'
file: '.gitlab-ci.yml'
- Run:
Expected behavior
git clone uses the same URL as git remote get-url origin (without explicit default port), so credential helpers match and authentication works.
Actual behavior
gitlab-ci-local reconstructs the URL with :443 appended:
git clone -n --depth=1 --filter=tree:0 https://git.example.com:443/group/ci-templates.git
Credential helper for https://git.example.com does not match https://git.example.com:443 → git prompts for username/password:
Username for 'https://git.example.com:443':
Root cause
Introduced in #1202 (commit d9431ab). src/git-data.ts sets default ports:
let port = "443";
if (gitRemoteMatch.groups.schema === "https") {
port = gitRemoteMatch.groups.port ?? "443";
} else if (gitRemoteMatch.groups.schema === "http") {
port = gitRemoteMatch.groups.port ?? "80";
}
Then src/parser-includes.ts uses ${remote.host}:${remote.port} in git clone URLs, always including the port even when it's a default.
Workaround
Add a duplicate credential entry with the port:
[credential "https://git.example.com:443"]
helper =
helper = !glab auth git-credential
Suggested fix
Don't append the port to clone URLs when it's a default (443 for HTTPS, 80 for HTTP). Alternatively, store an empty string for default ports and conditionally include :${port} only when non-empty.
Environment
- gitlab-ci-local: 4.74.0
- OS: Linux
Summary
gitlab-ci-localadds default port numbers (:443for HTTPS,:80for HTTP) to URLs used forgit clonewhen fetchinginclude:projectandinclude:component. This breaks git credential helpers (e.g.glab auth git-credential) that match credentials by exact URL —https://git.example.comandhttps://git.example.com:443are treated as different hosts.Minimal reproduction
https://git.example.com(no explicit port in remote URL)https://git.example.com:.gitlab-ci.ymlwith a project include:Expected behavior
git cloneuses the same URL asgit remote get-url origin(without explicit default port), so credential helpers match and authentication works.Actual behavior
gitlab-ci-localreconstructs the URL with:443appended:Credential helper for
https://git.example.comdoes not matchhttps://git.example.com:443→ git prompts for username/password:Root cause
Introduced in #1202 (commit d9431ab).
src/git-data.tssets default ports:Then
src/parser-includes.tsuses${remote.host}:${remote.port}ingit cloneURLs, always including the port even when it's a default.Workaround
Add a duplicate credential entry with the port:
Suggested fix
Don't append the port to clone URLs when it's a default (443 for HTTPS, 80 for HTTP). Alternatively, store an empty string for default ports and conditionally include
:${port}only when non-empty.Environment