Configure CodeUp code synchronization

Step 1: Create a dedicated RAM user

Create a dedicated RAM user as a service account for automated code synchronization between DataWorks and CodeUp. This isolates permissions from your main account.

1. Log on to the Resource Access Management (RAM) console with your main account.

2. Navigate to Identities > User, and then click Create User.

3. Enter the user account information:

   • Login Name: Set a descriptive name, such as dataworks_pusher.

   • Secure Email: Enter a valid email address. CodeUp uses this email for identity verification.

   • Access Mode: Select Console Access and set a logon password.

Step 2: Configure the CodeUp repository

Grant the RAM user permissions in CodeUp and set up a protected branch rule to enforce standardized code commits.

1. Add the RAM user as a repository member:

   • Log on to the CodeUp platform with your main account and go to the target repository.

   • In the left navigation bar, select Members. Click Add Member > Invite > Add RAM user. If dataworks_pusher does not appear in the list, click Manual Sync to refresh. Add dataworks_pusher to the organization.

     Note

     If the message You are not authorized is displayed when you invite a member, grant the required permissions and confirm.

   • Select the dataworks_pusher user, assign the Developer role, and add the user to the repository.

2. Configure a protected branch rule:

   Goal: Allow only the DataWorks system to push code automatically. Manual changes must be submitted through a merge request for review.

   1. Go to the Settings > Branch Settings > Protected Branch Rules page of the repository.

   2. Click New Rule and configure the following parameters:

      1. Branch name match: Enter dataworks_*. This protects all branches automatically created and managed by DataWorks.

      2. Allowed to push:

         1. Allowed roles to push: Set to None.

         2. Allowed push members: Select only dataworks_pusher.

      3. Allowed to merge:

         Allowed roles to merge / Allowed members to merge: Set both to None.

   3. Save the rule.

3. Generate an SSH key:

   1. Log out of the main account, and use the newly created RAM user (dataworks_pusher) to log in to the Alibaba Cloud DevOps platform.

   2. In the upper-right corner, click your profile picture and go to Personal Settings > Ssh public key.

   3. Generate an SSH key pair (run this command on your local machine or a bastion host).

      # Replace "your_user_email@example.com" with the email address that you configured in the previous step.
      ssh-keygen -t rsa -C "your_user_email@example.com"
      # When prompted for a passphrase, press Enter to leave it empty.
       Enter passphrase (empty for no passphrase): [Enter]
       Enter same passphrase again: [Enter]
      # View the public key.
      cat ~/.ssh/id_rsa.pub

   4. Add the SSH public key:

      • Paste the public key into the Public Key text box in CodeUp.

      • For Scope, select All.

      • Set no expiration time.

Note: DataWorks automatically creates three branches with fixed naming formats in your repository. Do not create them manually.

Step 3: Verify network connectivity (optional but recommended)

After you complete the configuration, create a temporary Shell node in DataWorks to verify that the scheduling resource group can access the CodeUp service.

1. In DataWorks, create a Shell node and assign it the resource group with public network access.

2. Test network connectivity: Run the telnet command. If the log shows Connected to ..., the network is connected and you can stop the command.

   # Replace with the domain name or IP address of your Git server. For example, use codeup.aliyun.com for CodeUp.
   telnet codeup.aliyun.com 22

   For CodeUp, if the log returns a message similar to the following example, the network is connected. You can stop the task. Otherwise, check your network configuration.

   2025-11-03 19:09:28 INFO ALISA_TASK_PRIORITY=0:
   2025-11-03 19:09:28 INFO --- Invoking Shell command line now ---
   2025-11-03 19:09:28 INFO ========================================================================
   Trying 118.xxx.xxx.50...
   Connected to codeup.aliyun.com.
   Escape character is '^]'.
   SSH-2.0-Go

Step 4: Configure the DataWorks workspace

With the private key ready, return to DataWorks to complete the binding.

1. In DataWorks, go to DataStudio > Code Management.

2. Configure code synchronization:

   Name	Description
   SSH Address	The SSH address of the target Git repository.
   Private key	Paste the entire contents of the private key (id_rsa file) generated in Step 2. Important The private key content must include -----BEGIN OPENSSH PRIVATE KEY----- and -----END OPENSSH PRIVATE KEY-----.
   OSS Data Source	Select the OSS data source that you have prepared. Note If the interface displays the message "The current resource group is not authorized to access the OSS data source. Go to authorize", click the authorization link to grant access.
   OSS Path	Specify an OSS path for storing code metadata, for example: dataworks-workspace-code.
   General Resource Group	Select the serverless resource group prepared earlier.

3. After the configuration is complete, click Start Sync. Then, click Initialization. The system automatically creates the branches required by DataWorks in the Git repository and synchronizes the code from the current workspace. This process may take several minutes. During this time, you can click the button in the upper-right corner to view the initialization logs.

   Note

   If you disable and then re-enable synchronization, you must initialize the repository again. Before you re-initialize, you must clean up the previously synchronized state in the repository.

   After the configuration takes effect, DataWorks automatically creates and manages the following three branches in your Git repository. Do not create or modify them manually:

   • dataworks_${region}_${projectId}_save: Stores the code from save operations in DataWorks.

   • dataworks_${region}_${projectId}_release_dev: Stores the code deployed to the development environment. Not created if the workspace is in Simple Mode.

   • dataworks_${region}_${projectId}_release_prod: Stores the code released to the production environment.