gitlab-variable（GitLab variable 运维）

CI/CD Variable Skill

CI/CD variable management operations for GitLab using the glab CLI.

Quick Reference

Risk Legend: - Safe | ⚠️ Caution | ⚠️⚠️ Warning | ⚠️⚠️⚠️ Danger

When to Use This Skill

ALWAYS use when:

• User wants to manage CI/CD variables
• User mentions "variable", "secret", "env var", "CI variable", "environment variable"
• User wants to configure build/deployment settings

NEVER use when:

• User wants to run pipelines (use gitlab-ci)
• User wants to manage.env files locally (use file operations)

Available Commands

List Variables

glab variable list [options]

Options:

Examples:

# List project variables
glab variable list

# List group variables
glab variable list -g mygroup

Get Variable

glab variable get <key> [options]

Options:

Examples:

# Get variable value
glab variable get API_KEY

# Get scoped variable
glab variable get DATABASE_URL --scope=production

Set Variable

glab variable set <key> <value> [options]

Options:

Examples:

# Set simple variable
glab variable set API_URL "https://api.example.com"

# Set masked secret
glab variable set API_KEY "secret123" --masked

# Set protected variable (only on protected branches)
glab variable set DEPLOY_KEY "key123" --protected --masked

# Set scoped variable for production
glab variable set DATABASE_URL "postgres://prod..." --scope=production

# Set file type variable
glab variable set CONFIG_FILE "$(cat config.json)" --type=file

# Set group variable
glab variable set SHARED_SECRET "secret" -g mygroup --masked

Update Variable

glab variable update <key> <value> [options]

Same options as set. Updates existing variable.

Examples:

# Update variable value
glab variable update API_KEY "new-secret" --masked

# Update and change scope
glab variable update DATABASE_URL "new-url" --scope=staging

Delete Variable

glab variable delete <key> [options]

Options:

Warning: This permanently deletes the variable.

Examples:

# Delete variable
glab variable delete OLD_API_KEY

# Delete scoped variable
glab variable delete DATABASE_URL --scope=staging

Export Variables

glab variable export [options]

Export variables in dotenv format.

Examples:

# Export to stdout
glab variable export

# Export to file
glab variable export > .env.ci

# Export and source
eval $(glab variable export)

Variable Types

Variable Flags

Common Workflows

Workflow 1: Set Up Deployment Variables

# Set production secrets
glab variable set PROD_API_KEY "xxx" --protected --masked --scope=production
glab variable set PROD_DB_URL "postgres://..." --protected --masked --scope=production

# Set staging secrets
glab variable set STAGING_API_KEY "xxx" --masked --scope=staging
glab variable set STAGING_DB_URL "postgres://..." --masked --scope=staging

Workflow 2: Rotate Secrets

# 1. List current variables
glab variable list

# 2. Update the secret
glab variable update API_KEY "new-secret-value" --masked

# 3. Trigger a new pipeline to use new secret
glab ci run

Workflow 3: Set Up Service Account

# Store credentials as masked file
glab variable set SERVICE_ACCOUNT_JSON "$(cat service-account.json)" \
  --type=file --protected --masked

# In CI/CD, use $SERVICE_ACCOUNT_JSON as path to the credentials file

Workflow 4: Configure Multi-Environment

# Production (protected + masked)
glab variable set DATABASE_URL "postgres://prod..." --scope=production --protected --masked
glab variable set API_KEY "prod-key" --scope=production --protected --masked

# Staging
glab variable set DATABASE_URL "postgres://staging..." --scope=staging --masked
glab variable set API_KEY "staging-key" --scope=staging --masked

# Development
glab variable set DATABASE_URL "postgres://dev..." --scope=development
glab variable set API_KEY "dev-key" --scope=development

Security Best Practices

1. Always mask secrets: Use --masked for any sensitive values
2. Protect production secrets: Use --protected for production credentials
3. Use scopes: Separate variables by environment
4. Rotate regularly: Update secrets periodically
5. Avoid logging: Never echo variable values in CI scripts
6. Use file type for complex secrets: JSON, certificates, etc.

Troubleshooting

Related Documentation

• Safeguards
• Quick Reference