Azure-pipelines-tasks: I can't pass secret variables to an inline powershell script task

[Zazcallabah]

The arguments textbox disappeared with the 2.0 version of the powershell task. This means that the recommended method of accessing secret build variables to a script has been removed.

How can I pass a secret variable to an inline powershell script task?

[Ajay-MS]

@Zazcallabah

You can access your release variable directly in your script by specifying in the following format.
$(<VARIABLE_NAME>)

e.g. if you have defined variable username in the release. In the inline script, it could be accessed as $(username)

[Zazcallabah]

Ah, I see, thank you.

$secret = "$(MySecretVariable)"

works fine.

[jrb-github]

Ah, I see, thank you.

$secret = "$(MySecretVariable)"

works fine.

Thanks guys, I ran into this. I just wanted to add that the surrounding quotes are required. I wasted some time because I assumed they weren't, and didn't include them. Fail.

[darrenferguson]

I've tried so many variations of this - but in output - I always get the value *

[jrb-github]

Could be it's just an output issue. Have you tried using $secret after the above, and it is failing? If you're trying something like Write-Host "$secret", I think it is intended to not work, to, well, keep it secret. :)

[Zazcallabah]

It will definitely suppress output for secret variables. You could try outputting $secret.substring(0,10) or something to fool the masking.

[darrenferguson]

Ah cool thanks. The substring trick does work...

I want to put the value in a connectionstrings config file temporarily while I run some tests....

Thankyou

[darrenferguson]

though if I try....

Write-Host $Hello.substring(0, $Hello.length)

It masks it again, so i can get some characters but not all of them!

[darrenferguson]

Ah OK, so i understand that any output to the console has any secret values masked...

[BrianStork]

Thank you for this. Very frustrating trying to track down what's going on. I hope MS fixes this, or if it's working as intended, updates the documentation to reflect this special case for hidden variables and inline Powershell scripts. There is nothing on their official docs to indicate that hidden variables will cause issues in Powershell.

[internetgdl]

I had a very simple workaround, getting the string in two parts, but always that we join the two strings, TFS change to *.

in my case I have to write the secret in the settings.json then I write with a string embedded and liminate this, with a replace writing on my json

I hope that can help somebody

function GetSecretLenght ($secretName){
     $i = 0;
     while($true){
          try { 
               $secretName.substring(0,$i)|out-null 
          } catch { 
               break };
               $i++; 
          } 
     return $i-1;
     } 
function GetSecret($secretName){
     $length = GetSecretLenght($secretName);
     $secret = "$(Secret)"
   return $secret.substring(0,$length-1 )+"_eliminate-this_"+$secret.substring($secret.length-1,1)
} 

$SecretValue = GetSecret("$(Secret)");
Write-Host $SecretValue

[amccool]

why is this not easily found in the documentation?

[RaphaelYoshiga]

Because ideally, we wouldn't be able to just extract the secrets that easily =D
But as a white-hat, it's better to know is possible.

[carlosmiguelsns]

I had a very simple workaround, getting the string in two parts, but always that we join the two strings, TFS change to *.

in my case I have to write the secret in the settings.json then I write with a string embedded and liminate this, with a replace writing on my json

I hope that can help somebody

function GetSecretLenght ($secretName){
     $i = 0;
     while($true){
          try { 
               $secretName.substring(0,$i)|out-null 
          } catch { 
               break };
               $i++; 
          } 
     return $i-1;
     } 
function GetSecret($secretName){
     $length = GetSecretLenght($secretName);
     $secret = "$(Secret)"
   return $secret.substring(0,$length-1 )+"_eliminate-this_"+$secret.substring($secret.length-1,1)
} 

$SecretValue = GetSecret("$(Secret)");
Write-Host $SecretValue

In classic type, In order to access secret variable in inline powershell script,

step1: Define variable and set it secret (for ex Name: ConnectionString value: **)
step2: Add/set an Environment variable (below inline script available as an option) to remap your secret variable [since you can't access secret variables directly in scripts] like for ex Name: CONNECTIONSTRING value: $(ConnectionString )
step3: While using this variable in script access like $env:CONNECTIONSTRING