Copy secret variable in Azure DevOps

Alexander Kozachenko 0
Viewed 49

I have a fairly simple pipeline where subproject_test is not a secret, but openshift_token_test is a secret.

steps:
- bash: |
    echo "##vso[task.setvariable variable=project]$(subproject_test)"
    echo "##vso[task.setvariable variable=openshift_token;issecret=true]$(openshift_token_test)"
  displayName: Set test branch variables

- bash: |
    echo ${PROJECT}
    echo ${#OPENSHIFT_TOKEN}
  displayName: Show vars

the output of Show vars always shows 0 as length of OPENSHIFT_TOKEN variable, while PROJECT variable shown correctly. I did try adding env and mapping secret to it - did not change anything.

bash azure-devops
2 Answers

For people who meet the similar question to refer to.

This situation is totally expected.

Why this happens?

The usage is not correct.

${variable} is a usage of bash script, it is as same as $variable in bash. {} is just a disambiguation mechanism in bash, and it is not a variable usage in DevOps pipeline.

Official document clearly clarify why in this situation nothing will be put in:

https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/logging-commands?view=azure-devops&tabs=bash#usage-4

When issecret is set to true, the value of the variable will be saved as secret and masked out from log. Secret variables aren't passed into tasks as environment variables and must instead be passed as inputs.

enter image description here

It is the example, it also describe how to use the output variable correctly in same job:

https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/logging-commands?view=azure-devops&tabs=bash#examples-1

How to use the output variables correctly in every situation:

https://docs.microsoft.com/en-us/azure/devops/pipelines/process/set-variables-scripts?view=azure-devops&tabs=bash#levels-of-output-variables

Bowman Zhu-MSFT0

Resolved with using $(OPENSHIFT_TOKEN) instead of ${OPENSHIFT_TOKEN}

Alexander Kozachenko0
Related