Unable to read Secret Azure Release Pipeline Variable inside Marketplace Task

Question

When trying to read Secret variables that is setup in azure release pipeline, I got the following error.

The term 'SecretVariableName' is not recognized as the name of a cmdlet, function, script file or operable program. ....

I know the variable is 100% correct but none of the following ways help to read it. Other non-secret varaibles works just fine.

$myvar1 = $(SecretVariableName)
$myvar2 = "$(SecretVariableName)"
$myvar3 = $Env:SecretVariableName

All these DIDN'T work. Where SecretVariableName is a secret variable inside Release Pipeline.

As side note:

1. For non-secret variables, it works just fine.
2. Running as an inline script in the pipeline works as well.

The problem is when attempting to read the secret variable inside marketplace task that is used to create a vsix file and uploaded in visualstudio marketplace

How can I successfully access it?

Thanks,

Answer 1

Secret variables are encrypted at rest with a 2048-bit RSA key. They are automatically masked out of any log output from the build or release.

Unlike a normal variable, they are not automatically decrypted into environment variables for scripts. You need to explicitly map secret variables.

Each task that needs to use the secret as an environment variable does remapping. If you want to use a secret variable called mySecret from a script, use the Environment section of the scripting task's input variables. Set the environment variable name to MYSECRET, and set the value to $(mySecret).

For details ,please view this official document. In addition, you can refer to this case with similar issue.

Update:

The following example shows how to use a secret variable called mySecret in a PowerShell script.

variables:
 GLOBAL_MYSECRET: $(mySecret) # this will not work because the variable needs to be mapped as env

steps:

- powershell: |
    # Using an input-macro:
    Write-Host "This works: $(mySecret)"

    # Using the mapped env var:
    Write-Host "This works: $env:MY_MAPPED_ENV_VAR"    # Recommended

  env:
    MY_MAPPED_ENV_VAR: $(mySecret) # right way to map to an env variable

You can also map secret variables using the variables definition. This example shows how to use secret variables $(vmsUser) and $(vmsAdminPass) in an Azure file copy task.

variables:
  VMS_USER: $(vmsUser)
  VMS_PASS: $(vmsAdminPass)    

steps:
- task: AzureFileCopy@4
  inputs:
    SourcePath: 'my/path'
    azureSubscription: 'my-subscription'
    Destination: 'AzureVMs'
    storage: 'my-storage'
    resourceGroup: 'my-rg'
    vmsAdminUserName: $(VMS_USER)
    vmsAdminPassword: $(VMS_PASS)

For examples, please refer to this.

Answer 2

There isn't any documentation that I could find useful and spend days to figure this thing out on my own - trying so many things and suggessions with no success. I finally solved it on my own and hopefully will help someone else not to waste as much time as I did.

# This gets ALL Task Variables that you can access (including Secret variables)
$allTaskVariablesIncludingSecrets = Get-VstsTaskVariableInfo

# Convert it to json it to see whats available during your debugging - this is just for you to see whats available for you to access.
$allTaskVariablesIncludingSecrets | ConvertTo-Json
#that will give you array of objects with three properties (Name, Secret and Value) in this format:
# [
#     {
#         "Name":  "SecretVariableName",
#         "Secret":  true,
#         "Value":  "***"
#     },
#     {
#         "Name":  "NotSecretVar",
#         "Secret":  false,
#         "Value":  "Some stuff here"
#     }
# ]

# Since our objective is to get a hold of Secret varibales, lets filter them
$secVariables = $allTaskVariablesIncludingSecrets | Where-Object {$_.Secret -eq $true}
# If one of your Secret Variable is called 'SecretVariableName', here is how you access it
$mySecretVarObject = $secVariables |  Where-Object {$_.Name -eq "SecretVariableName"}
$mySecret = $($mySecretVarObject.Value)
# This will give display *** for the value but Length will show you the actual length. So you are good to use $mySecret in your script. You don't NEED to SEE the actual value.
Write-Host "Value: $mySecret and Length: $($mySecret.Length)"

# Simply use $mySecret the way you would any local variable. No special treatment or husle needed

https://bitbucket.org/ZelalemW/how-to-access-secrets-in-ado/src/master/