Can't access unsecured variable from pipelines in script

Question

I'm trying to use the technique of base64 encoding my .env file into a pipelines unsecured variable as described in the following places, but the file that is created is empty:

How can I run a env variables on bitbucket pipeline?

How to pass variables to credentials.json in bitbucket-pipelines?

image: node:16
definitions:

  caches:
    yarncustom: /usr/local/share/.cache/yarn
  steps:
    - step: &Build-step
        name: Build
        caches:
          - node
          - yarncustom
        script:
          - echo $ENV_FILE | base64 -d > .env.local
          - cat .env.local
          - yarn install
          - yarn build
        artifacts:
          - .next/**
          - node_modules/**
          - .env.local
    - step: &Deploy-step
        name: Deploy
        script:
          - pipe: atlassian/rsync-deploy:0.4.3
            variables:
              USER: $USER
              SERVER: $SERVER
              REMOTE_PATH: $REMOTE_PATH
              LOCAL_PATH: '.'
              EXTRA_ARGS: '--exclude-from=deployment-exclude-list.txt'
pipelines:
  branches:
    development:
      - step: *Build-step
      - step:
          <<: *Deploy-step
          deployment: test

I have tried running the following which works, which means that the variable is simply not there, although everything I have read suggests this should be working.

echo randomBase64String | base64 -d > .env.local

Screenshot of Bitbucket Piplelines to prove it exists and is unsecured:

What could I be missing?

esimonov · Answer 1 · 2022-06-16T05:07:49.593

3

You are not passing the correct deployment to the Build-step.

As can be seen on the screenshot, the ENV_FILE variable is defined in the Test deployment, so you'll need to change your pipeline to:

pipelines:
  branches:
    development:
      - step:
          <<: *Build-step
          deployment: Test # This is required to fix your problem
      - step:
          <<: *Deploy-step
          deployment: Other-Deployment # Don't attempt to use Test deployment twice as it's not allowed.

edited Jun 16 '22 at 05:07

answered Jun 15 '22 at 09:28

esimonov

546
3
8

Thanks for your comment, I thought you had it! But when running the pipeline I get: "The deployment environment 'test' in your bitbucket-pipelines.yml file occurs multiple times in the pipeline. Please refer to our documentation for valid environments and their ordering." – Chris Jun 16 '22 at 01:07
You got me on the right track, it seems you can't share env vars between steps. Solution to this is to use a repository level variable which it can now read (yay!) - but now it's complaining about invalid base64 input, even though it is completely valid... – Chris Jun 16 '22 at 01:36
You are absolutely right about reusing a single deployment. I'll update my answer to not confuse future readers. – esimonov Jun 16 '22 at 05:06

score 0 · Answer 2 · answered Jun 16 '22 at 01:56

I found that you can't access deployment variables between steps. But you can access repository level variables in any step. So I created a new step to get the repo level variable and save it as an artefact for later steps. If anyone has any improvements on this I would love to hear it!

image: node:16
definitions:

  caches:
    yarncustom: /usr/local/share/.cache/yarn
  steps:
    - step: &Dev-step
        name: Env
        script:
          - echo $DEV_ENV | base64 -di > .env.local
        artifacts:
          - .env.local
    - step: &Build-step
        name: Build
        caches:
          - node
          - yarncustom
        script:
          - yarn install
          - yarn build
        artifacts:
          - .next/**
          - node_modules/**
    - step: &Deploy-step
        name: Deploy
        script:
          - pipe: atlassian/rsync-deploy:0.4.3
            variables:
              USER: $USER
              SERVER: $SERVER
              REMOTE_PATH: $REMOTE_PATH
              LOCAL_PATH: '.'
              EXTRA_ARGS: '--exclude-from=deployment-exclude-list.txt'
pipelines:
  branches:
    development:
      - step:
          <<: *Dev-step
      - step:
          <<: *Build-step
      - step:
          <<: *Deploy-step
          deployment: test

In such cases I normally use different deployments (see my updated answer). Repository (or workspace) variables are used for the values which are meant to be shared across the wider context, repo-wide or workspace-wide. Your 'ENV_FILE', as we can tell from its name, is env-specific, so creating a new deployment looks like a more appropriate solution to me. — esimonov, Jun 16 '22 at 05:13

Can't access unsecured variable from pipelines in script

2 Answers2