Set A Variable To Be Masked Without Adding It To A Environment Variable
Nick Smith
When generating a variable that is sensitive during a job's runtime, it would be helpful if that variable could be set to be masked without having to add it to a context. Secrets generated in this way are typically one off so there is an additional overhead of removing the generated variable from a context/project environment variable.
B
Ben Tomasik
Another use-case would be where a secret is fetched from a remote system (say a password manager, or cloud secrets storage somewhere). A responsible contributor would want to ensure that the cleartext secret value is never logged by CircleCI nor shown in the output. Similar to what is currently done with Context and project-level Environment Variables.