Skip to content

Commit 5ea25f7

Browse files
committed
docs(customEnvVariables): recommend secrets
1 parent 14cba69 commit 5ea25f7

File tree

1 file changed

+25
-0
lines changed

1 file changed

+25
-0
lines changed

docs/usage/self-hosted-configuration.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -327,6 +327,31 @@ Use this option if you need such downloads to be stored outside of Renovate's re
327327

328328
This configuration will be applied after all other environment variables so you can use it to override defaults.
329329

330+
<!-- prettier-ignore -->
331+
!!! warning
332+
Do not configure any secret values directly into `customEnvVariables` because they may be logged to stdout.
333+
Instead, configure them into `secrets` first so that they will be redacted in logs.
334+
335+
If configuring secrets in to `customEnvVariables`, take this approach:
336+
337+
```js
338+
{
339+
secrets: {
340+
SECRET_TOKEN: process.env.SECRET_TOKEN,
341+
},
342+
customEnvVariables: {
343+
SECRET_TOKEN: '{{ secrets.SECRET_TOKEN }}',
344+
},
345+
}
346+
```
347+
348+
The above configuration approach will mean the values are redacted in logs like in the following example:
349+
350+
```
351+
"secrets": {"SECRET_TOKEN": "***********"},
352+
"customEnvVariables": {"SECRET_TOKEN": "{{ secrets.SECRET_TOKEN }}"},
353+
```
354+
330355
## detectGlobalManagerConfig
331356

332357
The purpose of this config option is to allow you (as a bot admin) to configure manager-specific files such as a global `.npmrc` file, instead of configuring it in Renovate config.

0 commit comments

Comments
 (0)