Merge pull request #223 from hermes-hmc/feature/201-tutorial-gitlab-h…

…ermes_push_token-not-documented

Add HERMES_PUSH_TOKEN

docs/source/tutorials/automated-publication-with-ci.md

@@ -8,6 +8,7 @@ SPDX-License-Identifier: CC-BY-SA-4.0
 SPDX-FileContributor: Oliver Bertuch
 SPDX-FileContributor: Michael Meinel
 SPDX-FileContributor: Stephan Druskat
+SPDX-FileContributor: Sophie Kernchen
 -->
 
 # Set up automatic software publishing
@@ -167,6 +168,18 @@ and activate the option "Allow GitHub Actions to create and approve pull request
 Copy the Zenodo sandbox token you just created into a new [GitLab CI variable](https://docs.gitlab.com/ee/ci/variables/#for-a-project)
 called `ZENODO_TOKEN`.
 
+For Gitlab you also need the HERMES Push Token. That Token gives access to the project in order for HERMES to create Merge Requests.
+Therefore, you [create an access token in your project](https://docs.gitlab.com/ee/user/project/settings/project_access_tokens.html#create-a-project-access-token).
+The Token needs to have at least the `developer` role and `write` access (e.g. write_repository scope).
+Then you create a Gitlab CI variable with the token called `HERMES_PUSH_TOKEN`.
+
+```{note}
+The two Gitlab CI Variables include sensitive and powerful information.
+Therefore you should at least select the flag `Mask variable` when creating.
+If possible you should also select the flag `Protect variable` and define all branches `hermes/*` as
+protected branch.
+```
+
 Copy the [template file for GitLab to Zenodo Sandbox publication](https://github.com/hermes-hmc/ci-templates/blob/main/gitlab/hermes-ci.yml)
 into your project to `.gitlab/hermes-ci.yml`.