Read locked Azure DevOps variables from .Net Core applicatoin

Question

I have a release pipeline in Azure DevOps, one of the steps is running test designed using Nunit.

YAML of task:

steps:
- task: DotNetCoreCLI@2
  displayName: 'Run Tests'
  inputs:
    command: custom
    projects: '**/a/Tests.dll'
    custom: vstest
    arguments: '--logger:"trx;LogFileName=test.trx" '

In my tests Setup I am retrieving few settings from Environment variables using:

private static IConfiguration InitConfiguration()
{
  var config = new ConfigurationBuilder()
      .AddJsonFile("appsettings.json")
      .AddEnvironmentVariables()
      .Build();
  return config;
}

I am also storing the values of my environment variables in Azure DevOps variable groups.

Everything works fine when my variables are not locked, they are retrieved successfully and tests run fine.

However when I lock the secret ones their value comes empty hence my tests fail to run.

What should I change in order for locked variables to be correctly read from my application.

Krzysztof Madej Krzysztof Madej · Accepted Answer · 2020-12-03T09:53:25

By default variables are mapped into environment variables, but when you locked them you actually make them secrets. And to have secret maps as environment you must map them explicitly. Take a look on this

variables:
 GLOBAL_MYSECRET: $(mySecret) # this will not work because the secret variable needs to be mapped as env
 GLOBAL_MY_MAPPED_ENV_VAR: $(nonSecretVariable) # this works because it's not a secret.

steps:

- powershell: |
    Write-Host "Using an input-macro works: $(mySecret)"
    Write-Host "Using the env var directly does not work: $env:MYSECRET"
    Write-Host "Using a global secret var mapped in the pipeline does not work either: $env:GLOBAL_MYSECRET"
    Write-Host "Using a global non-secret var mapped in the pipeline works: $env:GLOBAL_MY_MAPPED_ENV_VAR" 
    Write-Host "Using the mapped env var for this task works and is recommended: $env:MY_MAPPED_ENV_VAR"
  env:
    MY_MAPPED_ENV_VAR: $(mySecret) # the recommended way to map to an env variable

- bash: |
    echo "Using an input-macro works: $(mySecret)"
    echo "Using the env var directly does not work: $MYSECRET"
    echo "Using a global secret var mapped in the pipeline does not work either: $GLOBAL_MYSECRET"
    echo "Using a global non-secret var mapped in the pipeline works: $GLOBAL_MY_MAPPED_ENV_VAR" 
    echo "Using the mapped env var for this task works and is recommended: $MY_MAPPED_ENV_VAR"
  env:
    MY_MAPPED_ENV_VAR: $(mySecret) # the recommended way to map to an env variable

So if you want to have secret available in one task you need to add something like this:

env:
    MY_MAPPED_ENV_VAR: $(mySecret)

And you need to do this for each secret separately.

With classic it is the same. You need to map them here:

Read locked Azure DevOps variables from .Net Core applicatoin

1 Answers