Expose deploy token to CI/CD jobs as environment variable

- If a deploy token with a name 'gitlab-deploy-token' is exists for the
  project, CI_DEPLOY_USER and CI_DEPLOY_PASSWORD variables will be
expose

3 files changed, 14 insertions, 0 deletions

diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index b0c02cdeec7..2a652b01313 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -624,6 +624,7 @@ module Ci
         variables.append(key: "CI_PIPELINE_TRIGGERED", value: 'true') if trigger_request
         variables.append(key: "CI_JOB_MANUAL", value: 'true') if action?
         variables.concat(legacy_variables)
+        variables.concat(deploy_token_variables) if project.gitlab_deploy_token
       end
     end
 
@@ -654,6 +655,13 @@ module Ci
       end
     end
 
+    def deploy_token_variables
+      Gitlab::Ci::Variables::Collection.new.tap do |variables|
+        variables.append(key: 'CI_DEPLOY_USER', value: DeployToken::GITLAB_DEPLOY_TOKEN)
+        variables.append(key: 'CI_DEPLOY_PASSWORD', value: project.gitlab_deploy_token.token)
+      end
+    end
+
     def environment_url
       options&.dig(:environment, :url) || persisted_environment&.external_url
     end
diff --git a/app/models/deploy_token.rb b/app/models/deploy_token.rb
index 979e9232fda..191f07c527f 100644
--- a/app/models/deploy_token.rb
+++ b/app/models/deploy_token.rb
@@ -4,6 +4,7 @@ class DeployToken < ActiveRecord::Base
   add_authentication_token_field :token
 
   AVAILABLE_SCOPES = %i(read_repository read_registry).freeze
+  GITLAB_DEPLOY_TOKEN = 'gitlab-deploy-token'.freeze
 
   default_value_for(:expires_at) { Forever.date }
 
diff --git a/app/models/project.rb b/app/models/project.rb
index cec1e705aa8..a594f2df662 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -1879,6 +1879,11 @@ class Project < ActiveRecord::Base
     []
   end
 
+  def gitlab_deploy_token
+    @gitlab_deploy_token ||=
+      deploy_tokens.active.find_by(name: DeployToken::GITLAB_DEPLOY_TOKEN)
+  end
+
   private
 
   def storage