Secret literal at "env.vars.password" — I want the password in the env file, why is that refused?

Example threads. These questions and answers were written by the SDODS team to document real problems and how to fix them. The people named are illustrative, not real users. Questions asked on this site are marked new.

Put the login password straight into projects/demo-shop/envs/staging.yaml so the data-driven login scenarios can pick it up:

yaml

vars:
  defaultProduct: Sauce Labs Backpack
  password: hunter2

Every command now refuses to start:

text

✖ CONFIG_SECRET_LITERAL: Secret literal at "env.vars.password". Use ${VAR} and put the value in .env.<env>.
  hint: Replace the value with "${PASSWORD}" and add PASSWORD=... to your .env file.
  docs: https://docs.sdods.com/docs/guides/configuration

This is a throwaway demo account. Is there a way to say "yes I meant it"?

config lint

asked by Hsu Wei-lin

2 answers

Accepted answer
No override, on purpose. The environment files are committed; a key whose name looks like a secret has to hold a ${VAR} reference and nothing else.
Do it the way the shipped demo does:
yaml
```
vars:
  standardPassword: "${DEMO_SHOP_PASSWORD:-secret_sauce}"
```
bash
```
echo "DEMO_SHOP_PASSWORD=hunter2" >> projects/demo-shop/.env.staging
```
The :- form gives you a fallback, so a checkout with no .env.staging still runs against the public demo site. Steps read it as {{standardPassword}} either way.
answered by Reeta NandalSDODS team
The reason the rule has no escape hatch is that the same check is what lets us promise the yaml is safe to commit and safe to paste into an issue. Once one project has a literal in it, nobody trusts the rest.
Keep a .env.example next to the project with the names and no values — it documents what a new machine needs without carrying anything.
answered by Priya VenkateshSDODS team

Know the answer?

Wrap commands and output in triple backticks and they will render as a code block.

Checking whether you’re signed in…

Have a different question? Ask it.

Secret literal at "env.vars.password" — I want the password in the env file, why is that refused?

2 answers

Know the answer?

Related