Search code examples
securitygitlabgitlab-ci

Is there a way to mask Gitlab environment variables outside of the UI

I am trying to mask dynamically retrieved and set tokens during Gitlab CI pipelines, however, the only way I can see masking being set is predefined pipeline variables.

Is there a way to flag a variable during the pipeline as masked? I SWEAR I had seen something like this in the past, but for the life of me I cannot find it.

export SECRET=$(get secret somehow)
echo $SECRET #secrettext

Is there a way to mask this on the fly?

Solution

  • No, GitLab CI doesn't offer this feature. You cannot dynamically register additional values for masking in the job log. GitLab will only mask CICD variables marked for masking in the project settings or values defined and retrieved through the secrets keyword (e.g., Vault secrets).

    I SWEAR I had seen something like this in the past

    You may be thinking of the add-mask feature in GitHub Actions.