Environment variables¶

AntFlow can supply workflow environment variables from the GitLab project hosting the process. Use them for deployment-specific configuration or credentials needed by processing steps.

Project variables¶

In GitLab, open the project's Settings > CI/CD > Variables. Prefix workflow variable names with CWL__, or the prefix configured for your deployment. AntFlow strips this prefix when preparing the execution environment:

Before relying on project variables, check Project permissions, including what happens when the submission credential cannot read them.

Access the resulting variable through your application's usual environment handling. Avoid logging its value if it contains a credential. Test with nonsecret values before using production credentials.

User secret overrides¶

On instances using Keycloak, users can keep personal values in their user vault. When user-secret overrides are enabled on the instance, a matching secret takes precedence over an existing GitLab project variable for that job.

Name the vault entry after the resulting environment variable. For example, TEST_VAR overrides GitLab's CWL__TEST_VAR. The prefixed vault name CWL__TEST_VAR also matches; avoid creating both names for the same variable. A vault entry without a matching project variable does not create a new environment variable. Ask your administrator if overrides are disabled.

The override affects the job, not the value stored in GitLab. Do not assume a user has supplied an override: the project value remains the fallback when there is no matching user secret.

Secret inputs are separate¶

A workflow can declare cwltool:Secrets inputs for which users select vault aliases in the execution form. These inputs do not require GitLab CI/CD variables. See Secret inputs for the declaration and alias contract.