Aller au contenu principal

GitLab Environment Export

Use this helper when migrating from GitLab CI variables to encrypted SOPS environment files.

Script:

  • scripts/export-gitlab-env.mjs
  • scripts/cleanup-gitlab-vars.mjs

Requirements​

  • a GitLab personal access token with permission to read project CI/CD variables
  • the target project id or project path

Recommended env var:

export GITLAB_TOKEN=glpat-...

Examples​

Export staging variables:

node scripts/export-gitlab-env.mjs \
  --environment staging \
  --project-path maximegd/aaperture \
  --output infra/env/staging.from-gitlab.env

Export production variables:

node scripts/export-gitlab-env.mjs \
  --environment production \
  --project-path maximegd/aaperture \
  --output infra/env/production.from-gitlab.env

Scope resolution​

The script resolves variables like GitLab environments do:

  • exact environment scope wins
  • wildcard scopes also match
  • * is used as fallback

Example:

  • DOMAIN scoped to production wins for production
  • DOMAIN scoped to * is used only if no more specific scope matches

Intended workflow​

  1. export GitLab variables into infra/env/*.from-gitlab.env
  2. compare them with infra/env/*.plain.env
  3. clean up any placeholders or outdated values
  4. encrypt into *.env.enc with SOPS
  5. remove the exported plain file

Cleanup after SOPS migration​

Once infra/env/staging.env.enc and infra/env/production.env.enc are the source of truth, use:

GITLAB_TOKEN=... node scripts/cleanup-gitlab-vars.mjs \
  --project-path maximegd/aaperture

This runs in dry-run mode by default and keeps:

  • scope *
    • CI_DEPLOY_USER
    • CI_DEPLOY_PASSWORD
    • CI_REGISTRY_USER
    • CI_REGISTRY_PASSWORD
    • REGISTRY_USER
    • REGISTRY_PASSWORD
  • scope production
    • SOPS_AGE_KEY_B64
    • SERVER_HOST
    • SERVER_USER
    • SERVER_APP_DIR
    • SSH_PRIVATE_KEY_B64
  • scope staging
    • SOPS_AGE_KEY_B64
    • SERVER_HOST
    • SERVER_USER
    • SERVER_APP_DIR
    • SSH_PRIVATE_KEY_B64

When the output looks correct:

GITLAB_TOKEN=... node scripts/cleanup-gitlab-vars.mjs \
  --project-path maximegd/aaperture \
  --apply

Extra keys can be preserved with:

--keep-key SOME_GLOBAL_KEY
--keep-scope-key production:SOME_KEY
--keep-scope-key staging:SOME_KEY

Notes​

  • EXPO_* variables belong to aaperture-mobile, not this repository.
  • SSH deploy access should now use SSH_PRIVATE_KEY_B64.