glab variable

Inherited reads and partial updates

variable get KEY --inherited tries the selected project or group, then parent groups closest first, then instance variables. Missing or unreadable levels (404/401/403) are skipped; other failures are returned. --scope filters project/group variables, but not instance variables. This is a lookup of stored definitions, not a full simulation of every CI variable precedence rule. Both text and JSON output can expose secret values; send them only to an approved consumer.

variable update preserves optional attributes unless supplied. Omitted --protected, --masked, --raw, --type, and --description retain their existing values. Use an explicit boolean such as --protected=false only when that policy change is approved. The value is still supplied positionally, through --value, or from stdin; do not invoke this as a metadata-only update with empty stdin, which can replace the value with an empty string. --scope retains its existing targeting behavior.

Overview

  Variables store configuration and secrets used by CI/CD pipelines.

  Each subcommand acts on the current project by default. Use
  `--group` to manage a group's variables instead.
         
  USAGE