Do I need to define a repo secret in a YAML file when accessing via a Python script?

[Sharon Machlis]

I'm having some trouble accessing my secrets in a Python script and don't know if I need to do anything in my Pipeline YAML file? I've seen conflicting advice on this. 

Specifically: If I save a BitBucket repository secret value called MY_SECRET by going to Repository settings > [under the Pipelines section] Repository Variables, do I need to add anything in my Pipeline YAML file in order to access the value of MY_SECRET in a Python script? Or is os.getenv('MY_SECRET') in my Python script enough to access that value?

[Syahrul]

G'day, @Sharon Machlis 

Welcome to the community!

Each programming language has its own methods or modules that allow interaction with environment variables. This includes reading the value of a variable or writing to a variable. Specifically for Python, the environment variables are usually accessed using the os module. You just need to import this module into your script and then use the os.environ function to interact with the variables.

Example on how you can reference the variables :

import os

# Set environment variables
os.environ['API_USER'] = 'username'
os.environ['API_PASSWORD'] = 'secret'

# Get environment variables
USER = os.getenv('API_USER')
PASSWORD = os.environ.get('API_PASSWORD')

# Getting non-existent keys
FOO = os.getenv('FOO') # None
BAR = os.environ.get('BAR') # None
BAZ = os.environ['BAZ'] # KeyError: key does not exist.

I would also recommend checking the following documentation on How to set and get environment variables in Python 

Regards,
Syahrul

[Sharon Machlis]

Thank you, @Syahrul!   I'm familiar with how to access environment variables in Python either with os.getenv() or by reading a .env file or by exporting the values into my current working environment. My problem is that I don't know how BitBucket secrets work. Once I set my secret in BitBucket Cloud by going to Repository settings > [under the Pipelines section] Repository Variables and defining a variable, does that mean it is automatically an environment variable and I can access it with os.getenv('MY_SECRET')? Or I need to use os.environ.get('MY_SECRET')? Or something else? Because os.getenv('MY_SECRET') is not working in my script, my script is failing.

[Syahrul]

Hey @Sharon Machlis 

Thanks for clarifying. 

What you understand about variables is correct. Once the variables are added to the workspace, repository, or deployment, they are accessible in your pipeline build, and you can call them according to their variable names.

So in your use case, you add them to the repository variable as HOME as 123 and use the following example:

import os

home = os.environ['HOME'] 
print("HOME:", home)

It should print out the variable as 123:

python3 ./variable.py
HOME: 123

Regards,
Syahrul