What Is a Protected Variable?
A protected variable is a pipeline variable that the CI system injects only when the pipeline runs on a protected branch or tag. Pipelines on other refs, including from forks or unprotected branches, never see its value. It scopes sensitive credentials to trusted refs.
Why it matters
Deploy keys and production secrets must not be exposed to pipelines triggered by arbitrary branches or contributors. Marking a variable protected ensures only trusted, protected refs can read it. This is a core control for keeping deployment credentials out of untrusted pipeline runs.
Related guides
What Is a Masked Variable?A masked variable is a value the CI runner redacts from log output, replacing it with asterisks so secrets do…
What Is a File Variable?A file variable is a CI variable whose value the runner writes to a temporary file, exposing the file's path…
What Is a Scoped Variable?A scoped variable is a CI variable whose visibility is limited to a particular environment or condition, so i…