Secrets in build actions

Never commit secrets to your repository. Build actions read tokens, passwords and keys from a file that exists only while your script runs, filled from values you store in the branch settings.

Where secrets are stored

Store secrets in the Build Action Secrets group in your branch settings, next to the Android and iOS signing settings. To share a value across branches, create a group with the same name on the project or the organization.

Where a secret can be set, and which value a build uses
Set on	Applies to	Wins over
Branch	That branch only	Project and organization
Project	Every branch in the project	Organization
Organization	Every project in the organization	Nothing; it is the fallback

The Build Action Secrets group appears only once build actions are turned on for the project. See Turn build actions on.
Values are write-only. Once saved, nobody can read them back from the website, only replace or remove them.

Read them from a script

Your script reads secrets from a JSON file whose path is in DSL_SECRETS_FILE. The file exists only while your script runs.

Python

import json, os
secrets = json.load(open(os.environ["DSL_SECRETS_FILE"])) if "DSL_SECRETS_FILE" in os.environ else {}
token = secrets["ASSET_SERVER_TOKEN"]

A KeyError on a secret name means it is not set in Build Action Secrets for this branch, project or organization.

What the log masks

If a secret value appears in the build log, it is replaced with ***. That covers the value as written, line by line, and URL-encoded.

Passing a secret to a program

Secrets are not passed as environment variables. If a program you start needs one as an environment variable, pass it to that one call only:

Python

subprocess.run([...], env={**os.environ, "TOKEN": token})

For a worked example that reads a webhook URL from secrets, see Reporting results with on_end.

Something out of date or unclear? Email support@devstreamlabs.com.