Gitlab CI pipeline include template doesn't work (Secret-Detection)

user_14130276 0
Viewed 838

I am encountering some weirdness with Gitlab CI includes, anyone ever see something like this?

I am trying to use gitlab's secret detection through a simple

include:
  - template: Secret-Detection.gitlab-ci.yml

which references this here....but it doesn't work at all, no step ever shows, unless I re -specify this part from Secret-Detection.gitlab-ci.yml but in my own repo's .gitlab-ci.yml:

secret_detection:
  rules:
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH

But why would that help if its already in the original Secret-Detection.gitlab-ci.yml ??

Basically, this doesn't work:

include:
  - template: Secret-Detection.gitlab-ci.yml

But this does work:

include:
 - template: Secret-Detection.gitlab-ci.yml

secret_detection:
  - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH

I am using Gitlab 13.2.3 EE. I am working on a branch/not master.

gitlab gitlab-ci pipeline continuous-integration
1 Answers

You are including a template, then overriding the default behavior of the secret_detection job. However, in doing so, you are actually overriding the entire rules section of the job.

This:

rules:
    - if: $SECRET_DETECTION_DISABLED
      when: never
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH

Becomes this:

rules:
    - if: $CI_COMMIT_BRANCH && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH

Is it possible that the SECRET_DETECTION_DISABLED variable is defined in your job? If so, using the original template will disable secret detection. By overriding the rules section of the job, you are basically not checking SECRET_DETECTION_DISABLED anymore. You can check the value of the variable by adding an printenv statement to a script section in your job.

user_57527300
Related