Documentation clarification and token usage with dry run

[module17]

When attempting to run with dryRun option, I'm getting a 403 Forbidden when supplying a GL_TOKEN with only read_repository scope enabled. Documentation states this is the only scope required for a dry run.

Adding the read_api scope resolves the 403 issue. Is this required?

While attempting a dry run, the process repeatedly asks for SSH key passphrase. I would assume the token would be used for all operations. Is this not expected behaviour?

Thanks for looking!

[fgreinacher]

Wow, sorry for the late response @module17 🙈

Adding the read_api scope resolves the 403 issue. Is this required?

Yes, we need read_api so that we check permissions: https://github.com/semantic-release/gitlab/blob/master/lib/verify.js#L67

While attempting a dry run, the process repeatedly asks for SSH key passphrase. I would assume the token would be used for all operations. Is this not expected behaviour?

Yes, the token is used for all API operations made by this plugin. Maybe you're running into the same issues as here? https://github.com/semantic-release/semantic-release/issues/2053