[FIXED] How to Setup GitLab Environment Variables in a safe way?

Issue

I don't wan't to put sensitive Credentials (Like API keys, passwords etc) into my branch. For this, GitLab (and other CI/CD-Services) are able to set Environment-Variables. They will be injected into the script during deployment process.

I know about two ways for GitLab to set them:

1. Via UI: Project ⇒ Settings ⇒ CI/CD ⇒ Variables
2. Via .gitlab-ci.yml

As in my opinion the first way is the secure one, because no files with credentials are saved in the git repo but it's also the more complicated way because I have to set each single variable by hand via GitLab-GUI.

With the second way, the issue is that .gitlab-ci.yml is saved into the gitlab repo so that the credentials are not secure.

Question: Is there a way to define the ENV-Vars in a file and provide it to GitLab, without putting them into the branch? Or is there another way to create those ENV-Vars easily and securely in GitLab?

Solution

Is there a way to define the ENV-Vars in a File?

Yes, in UI settings you mentioned you can specify variables type to be variable (key:value) or file (in Key will be passed path to secret file with content from value input).

So file variable seems like what you are looking for.

Readme and docs provide good description for variables. Personally I find very useful other options: variable masking and protected state.

Answered By - makozaki

Answer Checked By - Candace Johnson (PHPFixing Volunteer)