Decide if all user defined variables should be exposed within Auto DevOps docker builds by default
For follow up of the discussion in https://gitlab.com/gitlab-org/gitlab-ce/issues/54681#note_213094418
As of gitlab-org/cluster-integration/auto-build-image!22 (merged), we have the ability to forward specific CI variables to the docker build command in the Auto DevOps build job.
This works by forwarding all variables in AUTO_DEVOPS_BUILD_IMAGE_FORWARDED_CI_VARIABLES as a comma separated list. As the variables could contain sensitive information, they are forwarded as docker build secrets.
Currently, we do not forward any CI variables by default as build secrets (we do, however, already forward certain proxy-related variables by default as build arguments).
Note that it is not safe to forward all of env from auto-build-image to the docker build, as this will include variables such as PATH, which can break various commands within the docker build.
The variables we could still conceivably forward are the ones in Ci::Build#variables.
The question is: Should we forward Ci::Build#variables, or a subset thereof, by default?
The main benefit of forwarding variables by default is that users will not need to maintain a separate list of variables they want to forward.
The main concern is that forwarding variables by default is technically not backwards compatible: Builds that currently "just work" work could break.
I also think that those who need environment variables in their builds are more likely to know about it than those whose builds could break due to unexpected variables. But this is purely speculation.