Synchronize one GitLab token value into CI/CD variables across projects and groups. The component reads the token from a CI variable, logs in with glab, and updates or creates the configured destination variables.

By default the job runs only on scheduled pipelines on the default branch. Store the source token in GITLAB_TOKEN or set token-variable to another masked variable.

Usage

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/token-update@stable
    inputs:
      cicd-variables:
        - location: my-group
          protected: true
          hidden: true
        - location: my-group/my-project
          variable: DEPLOY_TOKEN
          protected: true
          environment: production

Each CI/CD variable entry supports:

location: GitLab group path or project path.
variable: destination CI/CD variable name. Defaults to variable-key, which defaults to GITLAB_TOKEN.
protected: whether the destination variable is protected. Defaults to false.
hidden: whether a newly created destination variable should be hidden. Existing variables cannot be made hidden by update.
masked: whether the destination variable is masked. Defaults to true.
environment: optional environment scope for project variables.

Set self-rotate: true to also update the same variable in the current project. The component does not generate a new personal access token; it rotates/synchronizes the token value supplied by the configured source variable.

Inputs

Name	Description	Default	Type
---	---	---	---
cicd-variables	Destination CI/CD variables to update. Each item needs a location and may override variable, protected, hidden, masked, and environment.	[]	array
name	The name of the token update job.	token-update	string
needs	The jobs that this job depends on.	[]	array
rules	Rules controlling when the token update job runs.	[{"if":"$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == \"schedule\"","when":"on_success"},{"when":"never"}]	array
self-rotate	Update the current project variable in addition to configured destinations.	false	boolean
stage	The stage where the token update job runs.	deploy	string
tags	The runners that this job depends on.	[]	array
token-variable	Name of the CI/CD variable containing the token value to write.	GITLAB_TOKEN	string
variable-key	Name of the CI/CD variable to update in each destination.	GITLAB_TOKEN	string

Inputs​

Inputs