Use project access tokens for the multi-pipeline triggers

Signed-off-by: Rémy Coutable <remy@rymai.me>

.gitlab/ci/cng.gitlab-ci.yml

@@ -7,4 +7,4 @@ cloud-native-image:
     GIT_DEPTH: "1"
   script:
     - install_gitlab_gem
-    - CNG_PROJECT_PATH="gitlab-org/build/CNG" ./scripts/trigger-build cng
+    - ./scripts/trigger-build cng

.gitlab/ci/review.gitlab-ci.yml

@@ -27,12 +27,15 @@ review-build-cng:
     - .review:rules:review-build-cng
   image: ${GITLAB_DEPENDENCY_PROXY}ruby:2.7-alpine3.13
   stage: review-prepare
-  before_script:
-    - source ./scripts/utils.sh
-    - install_gitlab_gem
   needs:
     - job: compile-production-assets
       artifacts: false
+  variables:
+    CNG_PROJECT_ACCESS_TOKEN: "${CNG_MIRROR_PROJECT_ACCESS_TOKEN}"  # "Multi-pipeline (from 'gitlab-org/gitlab' 'review-build-cng' job)" at https://gitlab.com/gitlab-org/build/CNG-mirror/-/settings/access_tokens
+    CNG_PROJECT_PATH: "gitlab-org/build/CNG-mirror"
+  before_script:
+    - source ./scripts/utils.sh
+    - install_gitlab_gem
   script:
     - ./scripts/trigger-build cng
 

scripts/trigger-build

@@ -124,14 +124,19 @@ module Trigger
   end
 
   class Omnibus < Base
+    def self.access_token
+      # Default to "Multi-pipeline (from 'gitlab-org/gitlab' 'package-and-qa' job)" at https://gitlab.com/gitlab-org/build/omnibus-gitlab-mirror/-/settings/access_tokens
+      ENV['OMNIBUS_GITLAB_PROJECT_ACCESS_TOKEN'] || super
+    end
+
     private
 
     def downstream_project_path
-      ENV['OMNIBUS_PROJECT_PATH'] || 'gitlab-org/build/omnibus-gitlab-mirror'
+      ENV.fetch('OMNIBUS_PROJECT_PATH', 'gitlab-org/build/omnibus-gitlab-mirror')
     end
 
     def ref
-      ENV['OMNIBUS_BRANCH'] || 'master'
+      ENV.fetch('OMNIBUS_BRANCH', 'master')
     end
 
     def extra_variables
@@ -154,25 +159,21 @@ module Trigger
   end
 
   class CNG < Base
+    def self.access_token
+      # Default to "Multi-pipeline (from 'gitlab-org/gitlab' 'cloud-native-image' job)" at https://gitlab.com/gitlab-org/build/CNG/-/settings/access_tokens
+      ENV['CNG_PROJECT_ACCESS_TOKEN'] || super
+    end
+
     private
 
     def downstream_project_path
-      ENV['CNG_PROJECT_PATH'] || 'gitlab-org/build/CNG-mirror'
+      ENV.fetch('CNG_PROJECT_PATH', 'gitlab-org/build/CNG')
     end
 
     def ref
-      default_ref =
-        if ENV['CI_COMMIT_REF_NAME'] =~ /^[\d-]+-stable(-ee)?$/
-          ENV['CI_COMMIT_REF_NAME']
-        else
-          'master'
-        end
-
-      ENV['CNG_BRANCH'] || default_ref
-    end
+      return ENV['CI_COMMIT_REF_NAME'] if ENV['CI_COMMIT_REF_NAME'] =~ /^[\d-]+-stable(-ee)?$/
 
-    def trigger_token
-      ENV['CI_JOB_TOKEN']
+      ENV.fetch('CNG_BRANCH', 'master')
     end
 
     def extra_variables
@@ -204,7 +205,8 @@ module Trigger
 
   class Docs < Base
     def self.access_token
-      ENV['DOCS_PROJECT_API_TOKEN']
+      # Default to "DOCS_PROJECT_API_TOKEN" at https://gitlab.com/gitlab-org/gitlab-docs/-/settings/access_tokens
+      ENV['DOCS_PROJECT_API_TOKEN'] || super
     end
 
     SUCCESS_MESSAGE = <<~MSG
@@ -253,11 +255,11 @@ module Trigger
     end
 
     def downstream_project_path
-      ENV['DOCS_PROJECT_PATH'] || 'gitlab-org/gitlab-docs'
+      ENV.fetch('DOCS_PROJECT_PATH', 'gitlab-org/gitlab-docs')
     end
 
     def ref
-      ENV['DOCS_BRANCH'] || 'main'
+      ENV.fetch('DOCS_BRANCH', 'main')
     end
 
     # `gitlab-org/gitlab-docs` pipeline trigger "Triggered from gitlab-org/gitlab 'review-docs-deploy' job"
@@ -349,7 +351,7 @@ module Trigger
     end
 
     def downstream_project_path
-      ENV['GITLABCOM_DATABASE_TESTING_PROJECT_PATH'] || 'gitlab-com/database-team/gitlab-com-database-testing'
+      ENV.fetch('GITLABCOM_DATABASE_TESTING_PROJECT_PATH', 'gitlab-com/database-team/gitlab-com-database-testing')
     end
 
     def extra_variables