From 5ea25f74ab567495744ca4cda51a779b5a060310 Mon Sep 17 00:00:00 2001
From: Rhys Arkins <rhys@arkins.net>
Date: Sun, 25 Feb 2024 07:28:25 +0100
Subject: [PATCH] docs(customEnvVariables): recommend secrets
---
docs/usage/self-hosted-configuration.md | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/docs/usage/self-hosted-configuration.md b/docs/usage/self-hosted-configuration.md
index 2cb12b13ea..f4e388e6f0 100644
--- a/docs/usage/self-hosted-configuration.md
+++ b/docs/usage/self-hosted-configuration.md
@@ -327,6 +327,31 @@ Use this option if you need such downloads to be stored outside of Renovate's re
This configuration will be applied after all other environment variables so you can use it to override defaults.
+<!-- prettier-ignore -->
+!!! warning
+ Do not configure any secret values directly into `customEnvVariables` because they may be logged to stdout.
+ Instead, configure them into `secrets` first so that they will be redacted in logs.
+
+If configuring secrets in to `customEnvVariables`, take this approach:
+
+```js
+{
+ secrets: {
+ SECRET_TOKEN: process.env.SECRET_TOKEN,
+ },
+ customEnvVariables: {
+ SECRET_TOKEN: '{{ secrets.SECRET_TOKEN }}',
+ },
+}
+```
+
+The above configuration approach will mean the values are redacted in logs like in the following example:
+
+```
+ "secrets": {"SECRET_TOKEN": "***********"},
+ "customEnvVariables": {"SECRET_TOKEN": "{{ secrets.SECRET_TOKEN }}"},
+```
+
## detectGlobalManagerConfig
The purpose of this config option is to allow you (as a bot admin) to configure manager-specific files such as a global `.npmrc` file, instead of configuring it in Renovate config.
--
GitLab