How to use encrypted vars on local cirrus execution about cirrus-cli HOT 5 CLOSED

• add argument to read env vars from a specified file when running cirrus run.

Take a look at #619, once merged it should allow for that.

from cirrus-cli.

cirrus version 0.98.0-21e0ceb works great me. Thank you again.

from cirrus-cli.

Hey @craighurley,

You will need to manage secrets yourself and pass them to Cirrus CLI via --environment flag:

export SECRET_TOKEN="..."
cirrus run --environment SECRET_TOKEN=$SECRET_TOKEN

This will override any SECRET_TOKEN environment variable defined in your .cirrus.yml.

from cirrus-cli.

Hi @fkorotkov

Thanks for that. I'm using sops and can successfully run this for a simple example:

cirrus run -e password=$(sops -d --extract '["password"]' sops.env)

If the task is complex and needs many secrets, I was planning on decrypting sops.env to .env locally, then running cirrus and have a task script to cat .env into $CIRRUS_ENV, e.g:

task:
  set_env_script: cat .env >> $CIRRUS_ENV
  build_script:
    # commands that rely on multiple secrets in env vars

... but because I have gitignored .env (so I don't accidentally commit secrets to git), .env is not available within the cirrus task, unless I use the --dirty argument. I would prefer not to use the --dirty argument so that cirrus has read-only permissions.

Have I missed an option? Is there another way to set env vars that would suit my use case? Or could one of these options be added

• add argument to ignore .gitignore.
• add argument to read env vars from a specified file when running cirrus run.

The second option would be my preference. It also opens the ability to use sops in such a way that the decrypted file does not need to be written to disk, e.g:

sops exec-file sops.env 'cirrus run --vars {}'

from cirrus-cli.

Amazing, thank you!

from cirrus-cli.