Private dotenv artifacts not accessible to downstream jobs
Summary
Linked Issue: https://gitlab.com/gitlab-org/security/gitlab/-/issues/1139
CI/CD pipelines can generate dotenv
artifacts to pass variables to subsequent jobs in the same pipeline. When the artifact has public: false
set subsequent jobs in the same project and pipeline no longer load variables from the dotenv
.
Steps to reproduce
- Create a project
- Set up CI/CD:
CI YAML example
stages:
- artifact
- use_artifact
image: alpine:latest
create-artifact:
stage: artifact
script:
- |
echo VARIABLE=12345 >> data.env
echo OTHER_VARIABLE=this-is-a-key >> data.env
echo VERSION_VARIABLE=1.2.3.4 >> data.env
echo VERSION_TAG=1.2.3.${CI_PIPELINE_ID} >> data.env
echo "SOME_PATHS='/mnt/stars/allsky/ccd_54528347-52c5-49e9-9fe2-65c3a007035f/20240508/day/08_05/ccd1_20240508_055734.jpg,/mnt/stars/allsky/ccd_54528347-52c5-49e9-9fe2-65c3a007035f/20240508/day/08_05/ccd1_20240508_055749.jpg'" >> data.env
artifacts:
public: false
reports:
dotenv: data.env
use-artifact:
stage: use_artifact
script:
- echo -e "Checking variables from last job:\n VARIABLE - $VARIABLE \n OTHER_VARIABLE - $OTHER_VARIABLE \n VERSION_VARIABLE - $VERSION_VARIABLE \n VERSION_TAG - $VERSION_TAG \n SOME_PATHS - $SOME_PATHS"
- Run pipeline and observe that variables are not populated as expected.
Example Project
https://gitlab.com/duncan_harris_ultimate_group/dotenv-543743
This example project has a branch with public: true
where the pipeline works as documented.
What is the current bug behavior?
Jobs in the same pipeline are not able to access non-public dotenv
artifacts from prior job stages
What is the expected correct behavior?
Downstream jobs in the same pipeline should have access to dotenv
artifacts
Relevant logs and/or screenshots
$ echo -e "Checking variables from last job:\n VARIABLE - $VARIABLE \n OTHER_VARIABLE - $OTHER_VARIABLE \n VERSION_VARIABLE - $VERSION_VARIABLE \n VERSION_TAG - $VERSION_TAG \n SOME_PATHS - $SOME_PATHS"
Checking variables from last job:
VARIABLE -
OTHER_VARIABLE -
VERSION_VARIABLE -
VERSION_TAG -
SOME_PATHS -
Output of checks
Edited by Shabini Rajadas