Skip to content

Allow variables to be configured as masked in the new manual pipeline view

GitLab offers the ability to define variables, for example, from the .gitlab-ci.yml we could have:

variables:
  TRANSIENT_SESSION_CREDENTIALS:
    value: ""
    description: "Transient credentials for performing this job"

This can be useful for capturing variables during manual pipeline runs from the "New Pipeline" action. In this case, the following screen could be displayed:

screenshot-andrewn-2023-05-04T17h15Z_2x

Masking Variables

In some cases, the variables contain sensitive values. For example, the variable might contain a special transient authentication token that a user can provide to grant a CI job transient access to perform certain functions.

For an example of this, see https://gitlab.com/gitlab-com/gl-infra/gitlab-dedicated/dedicated-organization-aws/-/merge_requests/28.

However, at present, the inputs are not masked, adding some risk that the credentials might be spied by a third-party.

Allowing manual variables to be masked/hidden would add additional security.

Using the previous example again:

variables:
  TRANSIENT_SESSION_CREDENTIALS:
    value: ""
    description: "Transient credentials for performing this job"
    masked: true # Mask out the variable during manual input and inside pipeline logs when possible.

With the masked: true value, the screen now displays a password input masking the user-supplied vaue:

screenshot-andrewn-2023-05-04T17h21Z_2x

cc @marknuzzo @dhershkovitch

Edited by Andrew Newdigate