GitLab CI/CD报错：script配置格式异常，请求排查原因

配置代码 #

image: ansible:latest

.assume-role: &assume-role
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.com
  script:
    - >
      STS=($(aws sts assume-role-with-web-identity --role-arn ${AWS_ROLE_ARN_TEST}
      --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
      --web-identity-token ${GITLAB_OIDC_TOKEN} --duration-seconds 3600 --query
      'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text))
    - export AWS_ACCESS_KEY_ID="${STS[0]}"
    - export AWS_SECRET_ACCESS_KEY="${STS[1]}"
    - export AWS_SESSION_TOKEN="${STS[2]}"
    - aws sts get-caller-identity

stages:
  - check_sec

check_sec:
  stage: check_sec
  variables:
    AWS_ROLE_ARN: $AWS_ROLE_ARN_TEST
    AWS_DEFAULT_REGION: $TEST_AWS_DEFAULT_REGION
  script:
    - *assume-role
    - echo "${GITLAB_OIDC_TOKEN}"
    - aws sts get-caller-identity
    - aws s3 ls
  only:
    - web
  tags:
    - environment_test

错误信息 #

script config should be a string or a nested array of strings up to 10 levels deep

错误原因 #

问题出在YAML锚点的引用逻辑上：

• 你定义的&assume-role锚点指向的是完整的job片段，包含id_tokens和script两个顶级配置项。
• 当你在check_sec的script数组中使用*assume-role时，相当于把整个包含id_tokens的片段插入到script内部，导致script数组中出现了非字符串/数组类型的内容，违反了GitLab对script字段的格式要求。

解决方案 #

将锚点限定为script内的命令数组，同时把id_tokens直接放到目标job的配置中（因为id_tokens是job级别的配置，不能嵌套在script里）。修改后的配置如下：

image: ansible:latest

# 仅将script命令定义为锚点
.assume-role-commands: &assume-role-commands
  - >
      STS=($(aws sts assume-role-with-web-identity --role-arn ${AWS_ROLE_ARN_TEST}
      --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
      --web-identity-token ${GITLAB_OIDC_TOKEN} --duration-seconds 3600 --query
      'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text))
  - export AWS_ACCESS_KEY_ID="${STS[0]}"
  - export AWS_SECRET_ACCESS_KEY="${STS[1]}"
  - export AWS_SESSION_TOKEN="${STS[2]}"
  - aws sts get-caller-identity

stages:
  - check_sec

check_sec:
  stage: check_sec
  variables:
    AWS_ROLE_ARN: $AWS_ROLE_ARN_TEST
    AWS_DEFAULT_REGION: $TEST_AWS_DEFAULT_REGION
  # 将id_tokens直接放在job级别
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.com
  script:
    # 引用仅包含命令的锚点
    - *assume-role-commands
    - echo "${GITLAB_OIDC_TOKEN}"
    - aws sts get-caller-identity
    - aws s3 ls
  only:
    - web
  tags:
    - environment_test

内容的提问来源于stack exchange，提问作者Adrian Zielinski