Group CICD variable created via REST API with param masked_and_hidden=false is created as masked and hidden

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

Summary

When creating Group CICD variable via REST API with masked_and_hidden param provided then it does not matter which value it has, variable is always created as masked and hidden. Creating Project CICD variable is not affected with this bug.

Steps to reproduce

Case 1: Creating variable with masked_and_hidden param set to false => does not work correctly (variable is created as masked and hidden):

Request:

{
  "key": "KEY1",
  "value": "valuevalue",
  "masked_and_hidden": false
}

Response:

{
  "variable_type": "env_var",
  "key": "KEY1",
  "value": null,
  "hidden": true,
  "protected": false,
  "masked": true,
  "raw": false,
  "environment_scope": "*",
  "description": null
}

Case 2: Creating variable with masked_and_hidden param set to true => works OK:

Request:

{
  "key": "KEY12",
  "value": "valuevalue",
  "masked_and_hidden": true
}

Response:

{
  "variable_type": "env_var",
  "key": "KEY12",
  "value": null,
  "hidden": true,
  "protected": false,
  "masked": true,
  "raw": false,
  "environment_scope": "*",
  "description": null
}

Case 3: Creating variable without masked_and_hidden param => works OK:

Request:

{
  "key": "KEY123",
  "value": "valuevalue"
}

Response:

{
  "variable_type": "env_var",
  "key": "KEY123",
  "value": "valuevalue",
  "hidden": false,
  "protected": false,
  "masked": false,
  "raw": false,
  "environment_scope": "*",
  "description": null
}

So possible workaround is to not provide masked_and_hidden param in request in case variable should not be masked and hidden.

Issue is reproducible on Gitlab.com (17.11.0-pre 46732c4c) and also on self-hosted instance (v17.9.2-ee)

Example Project

N/A

What is the current bug behavior?

Group CICD Variable is created incorrectly.

What is the expected correct behavior?

If masked_and_hidden param is provided then it's value is not ignored and not always represented as true even it is set to false. Also it should be aligned how similar REST API for Project CICD variables works, to not have two different behavior for Group and Project CICD variables.

Relevant logs and/or screenshots

image

Output of checks

Results of GitLab environment info

N/A

Results of GitLab application Check

N/A

Possible fixes

It looks like the issue is in lib/api/group_variables.rb on line 58 (String vs. Boolean):

        optional :masked_and_hidden, type: String, desc: 'Whether the variable is masked and hidden'

It should be:

        optional :masked_and_hidden, type: Boolean, desc: 'Whether the variable is masked and hidden'

the same as it is defined in lib/api/ci/variables.rb on line 63 for Project CICD variables.

          optional :masked_and_hidden, type: Boolean, desc: 'Whether the variable is masked and hidden'
Edited by 🤖 GitLab Bot 🤖