Gitlab Variable

CI/CD Variable Skill

CI/CD variable management operations for GitLab using the glab CLI.

Quick Reference

| Operation | Command | Risk | |-----------|---------|:----:| | List variables | glab variable list | - | | Get variable | glab variable get | - | | Set variable | glab variable set | ⚠️ | | Update variable | glab variable update | ⚠️ | | Delete variable | glab variable delete | ⚠️⚠️ | | Export variables | glab variable export | - |

Risk Legend: - Safe | ⚠️ Caution | ⚠️⚠️ Warning | ⚠️⚠️⚠️ Danger

When to Use This Skill

ALWAYS use when:

• User wants to manage CI/CD variables
• User mentions "variable", "secret", "env var", "CI variable", "environment variable"
• User wants to configure build/deployment settings

NEVER use when:

• User wants to run pipelines (use gitlab-ci)
• User wants to manage .env files locally (use file operations)

Available Commands

List Variables

glab variable list [options]

Options: | Flag | Description | |------|-------------| | -g, --group= | List group-level variables | | -P, --per-page= | Results per page |

Examples:

# List project variables
glab variable list

# List group variables
glab variable list -g mygroup

Get Variable

glab variable get  [options]

Options: | Flag | Description | |------|-------------| | -g, --group= | Get from group level | | -s, --scope= | Variable scope/environment |

Examples:

# Get variable value
glab variable get API_KEY

# Get scoped variable
glab variable get DATABASE_URL --scope=production

Set Variable

glab variable set   [options]

Options: | Flag | Description | |------|-------------| | -g, --group= | Set at group level | | -m, --masked | Mask value in logs | | -p, --protected | Only available in protected branches | | -r, --raw | Value is raw (no expansion) | | -s, --scope= | Variable scope/environment | | -t, --type= | Variable type: env_var, file |

Examples:

# Set simple variable
glab variable set API_URL "https://api.example.com"

# Set masked secret
glab variable set API_KEY "secret123" --masked

# Set protected variable (only on protected branches)
glab variable set DEPLOY_KEY "key123" --protected --masked

# Set scoped variable for production
glab variable set DATABASE_URL "postgres://prod..." --scope=production

# Set file type variable
glab variable set CONFIG_FILE "$(cat config.json)" --type=file

# Set group variable
glab variable set SHARED_SECRET "secret" -g mygroup --masked

Update Variable

glab variable update   [options]

Same options as set. Updates existing variable.

Examples:

# Update variable value
glab variable update API_KEY "new-secret" --masked

# Update and change scope
glab variable update DATABASE_URL "new-url" --scope=staging

Delete Variable

glab variable delete  [options]

Options: | Flag | Description | |------|-------------| | -g, --group= | Delete from group level | | -s, --scope= | Variable scope |

Warning: This permanently deletes the variable.

Examples:

# Delete variable
glab variable delete OLD_API_KEY

# Delete scoped variable
glab variable delete DATABASE_URL --scope=staging

Export Variables

glab variable export [options]

Export variables in dotenv format.

Examples:

# Export to stdout
glab variable export

# Export to file
glab variable export > .env.ci

# Export and source
eval $(glab variable export)

Variable Types

| Type | Use Case | |------|----------| | env_var | Environment variable (default) | | file | Write value to file, expose path as variable |

Variable Flags

| Flag | Effect | |------|--------| | masked | Value is hidden in job logs | | protected | Only available on protected branches/tags | | raw | No variable expansion (use for JSON, etc.) |

Common Workflows

Workflow 1: Set Up Deployment Variables

# Set production secrets
glab variable set PROD_API_KEY "xxx" --protected --masked --scope=production
glab variable set PROD_DB_URL "postgres://..." --protected --masked --scope=production

# Set staging secrets
glab variable set STAGING_API_KEY "xxx" --masked --scope=staging
glab variable set STAGING_DB_URL "postgres://..." --masked --scope=staging

Workflow 2: Rotate Secrets

# 1. List current variables
glab variable list

# 2. Update the secret
glab variable update API_KEY "new-secret-value" --masked

# 3. Trigger a new pipeline to use new secret
glab ci run

Workflow 3: Set Up Service Account

# Store credentials as masked file
glab variable set SERVICE_ACCOUNT_JSON "$(cat service-account.json)" \
  --type=file --protected --masked

# In CI/CD, use $SERVICE_ACCOUNT_JSON as path to the credentials file

Workflow 4: Configure Multi-Environment

# Production (protected + masked)
glab variable set DATABASE_URL "postgres://prod..." --scope=production --protected --masked
glab variable set API_KEY "prod-key" --scope=production --protected --masked

# Staging
glab variable set DATABASE_URL "postgres://staging..." --scope=staging --masked
glab variable set API_KEY "staging-key" --scope=staging --masked

# Development
glab variable set DATABASE_URL "postgres://dev..." --scope=development
glab variable set API_KEY "dev-key" --scope=development

Security Best Practices

1. Always mask secrets: Use --masked for any sensitive values
2. Protect production secrets: Use --protected for production credentials
3. Use scopes: Separate variables by environment
4. Rotate regularly: Update secrets periodically
5. Avoid logging: Never echo variable values in CI scripts
6. Use file type for complex secrets: JSON, certificates, etc.

Troubleshooting

| Issue | Cause | Solution | |-------|-------|----------| | Authentication failed | Invalid/expired token | Run glab auth login | | Variable not found | Wrong key or scope | Check with glab variable list | | Cannot see value | Variable is masked | Masked values cannot be retrieved | | Permission denied | Not maintainer | Need maintainer+ role for variables | | Value truncated | Special characters | Use --raw flag for complex values |

Related Documentation

• [Safeguards](../shared/docs/SAFEGUARDS.md)
• [Quick Reference](../shared/docs/QUICK_REFERENCE.md)

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: grandcamel
• Source: grandcamel/GitLab-Assistant-Skills
• License: MIT

Install and usage instructions live in the source repository linked above.