Masked GitLab CI variables need at least 8 characters

Today I stumbled upon a strange little quirk about GitLab CI/CD variables.

I wanted to store a port number as a masked CI/CD variable, but GitLab rejected it because masked values must satisfy stricter validation rules, one of which is minimum length.

With port numbers only going up to 65535, my variable being a short numeric value failed that validation check.

I quite quickly found this related discussion in the GitLab: https://gitlab.com/gitlab-org/gitlab/-/work_items/465258

Apparently at some point there was no mention of the validation check and people did not know why their short variables could not be masked, until this Merge Request added an error message.

Workaround

I found a workaround that is pretty clever. Store a padded masked variable, then normalize it in CI.

For example set the variable DEPLOY_PORT_MASKED=00023456 which can be masked as it is 8 chars long and then just convert it back into the actual numeric port value in the job by doing the following:

DEPLOY_PORT="$((10#$DEPLOY_PORT_MASKED))"
export DEPLOY_PORT

Then use DEPLOY_PORT normally:

ssh -p "$DEPLOY_PORT" ...

Why this works

10# forces base-10 parsing and safely strips leading zeros.

Result

I can keep the value masked in GitLab and still use the intended port number at in my CI job.