Allow passing the access token as an override

PROJECT_ACCESS_TOKEN must be a protected value that is only provided to
pipelines on protected branches.

In order to override the pipeline type and test the update-branch
pipeline, the operator needs to be able to use their own credentials
instead.

ci/generate-pipeline.sh

@@ -30,6 +30,9 @@ case "$PIPELINE_TYPE" in
     update-repo)
         mk_pipeline ci/pipelines/update-repo.yml
         ;;
+    update-branch)
+        mk_pipeline ci/pipelines/update-branch.yml
+        ;;
     *)
         echo "Unknown pipeline type: $PIPELINE_TYPE"
         exit 1

ci/pipelines/update-branch.yml

@@ -2,9 +2,19 @@
 # when we want to trigger jobs to run on head.hackage. This branch is not protected so
 # the permissions about who can trigger jobs on upstream-testing are much more liberal than
 # who can trigger jobs which run on master (which have the side-effect of updating the repo).
+#
+# For testing on topic branches, the operator must pass in
+# PROJECT_ACCESS_TOKEN_OVERRIDE since PROJECT_ACCESS_TOKEN is only available to
+# protected branches.
 update-branch:
   image: "nixos/nix:$DOCKER_TAG"
   tags:
     - x86_64-linux
   script:
-    - git push "https://gitlab-ci-token:$PROJECT_PUSH_TOKEN@$CI_SERVER_HOST/$CI_PROJECT_PATH.git" +refs/remotes/origin/master:refs/heads/upstream-testing -o ci.skip
+    - |
+      : ${PROJECT_ACCESS_TOKEN:=${PROJECT_ACCESS_TOKEN_OVERRIDE}}
+      if [ -z "${PROJECT_ACCESS_TOKEN:-}" ]; then
+        >&2 echo "PROJECT_ACCESS_TOKEN must be set."
+        exit 1
+      fi
+      git push "https://gitlab-ci-token:${PROJECT_ACCESS_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git" +refs/remotes/origin/master:refs/heads/upstream-testing -o ci.skip