glab variable

Inherited reads and partial updates

variable get KEY --inherited tries the selected project or group, then parent groups closest first, then instance variables. Missing or unreadable levels (404/401/403) are skipped; other failures are returned. --scope filters project/group variables, but not instance variables. This is a lookup of stored definitions, not a full simulation of every CI variable precedence rule. Both text and JSON output can expose secret values; send them only to an approved consumer.

variable update preserves optional attributes unless supplied. Omitted --protected, --masked, --raw, --type, and --description retain their existing values. Use an explicit boolean such as --protected=false only when that policy change is approved. The value is still supplied positionally, through --value, or from stdin; do not invoke this as a metadata-only update with empty stdin, which can replace the value with an empty string. --scope retains its existing targeting behavior.

Overview

  Variables store configuration and secrets used by CI/CD pipelines.

  Each subcommand acts on the current project by default. Use
  `--group` to manage a group's variables instead.
         
  USAGE  
         
    glab variable [command] [--flags]  
            
  COMMANDS  
            
    delete <key> [--flags]          Delete a variable for a project or group.
    export [--flags]                Export variables from a project or group.
    get <key> [--flags]             Get a variable for a project or group.
    import [--flags]                Import variables from a JSON file or standard input.
    list [--flags]                  List variables for a project or group.
    set <key> <value> [--flags]     Create a new variable for a project or group.
    update <key> <value> [--flags]  Update an existing variable for a project or group.
         
  FLAGS  
         
    -h --help                       Show help for this command.
    -R --repo                       Select another repository. Can use either `OWNER/REPO` or `GROUP/NAMESPACE/REPO` format. Also accepts full URL or Git URL.

Quick start

glab variable --help

Export and import variables

glab variable import consumes the same JSON array shape emitted by glab variable export --output json. It reads standard input by default or a file passed with --input-file / -i.

# Preview and preserve an export before importing it elsewhere
glab variable export --output json > variables.json
glab variable import --input-file variables.json -R group/target-project

# Pipe between groups
glab variable export --group source-group |
  glab variable import --group target-group

# Continue when target variables already exist
glab variable import --input-file variables.json --skip-existing

Import stops when a target variable already exists unless --skip-existing is set. Hidden variable values are omitted from exports, so those entries are skipped with a warning during import; recreate their values explicitly with glab variable set --hidden from an approved secret source. Treat export files as sensitive, keep them out of version control, and verify the target project or group before importing.

Masked and hidden group variables

glab variable set now sends --masked and --hidden correctly for group-level variables. Use explicit flags, verify the target group, and never print the value during confirmation:

glab variable set DEPLOY_TOKEN "$DEPLOY_TOKEN" \
  --group group/subgroup \
  --masked \
  --hidden \
  --protected

# Inspect only approved metadata; the raw JSON includes the value
glab variable get DEPLOY_TOKEN --group group/subgroup --output json \
  --jq '{key, protected, masked, hidden, environment_scope}'

Masking and hiding are server-enforced properties, not substitutes for least privilege or rotation. If GitLab rejects a value because it does not satisfy masking rules, do not weaken the setting silently; fix the value format or get explicit operator approval for a different policy.

Subcommands

See references/commands.md for full --help output.