Masked GitLab CI variables need at least 8 characters

Tue, 03 Mar 2026 17:17:10 +0100

Masked GitLab CI variables need at least 8 characters

Today I ran into a small GitLab CI gotcha.

I wanted to store an SSH port as a masked CI/CD variable, but GitLab rejected it because masked values must satisfy stricter validation rules (including minimum length).

A short numeric port value can fail that check.

Workaround

Store a padded masked variable, then normalize it in CI.

Example:

DEPLOY_PORT_MASKED=00023456 (masked, 8 chars)
Convert it back to an integer in the job:

DEPLOY_PORT="$((10#$DEPLOY_PORT_MASKED))"
export DEPLOY_PORT

Then use DEPLOY_PORT normally:

ssh -p "$DEPLOY_PORT" ...

Why `10#` matters

10# forces base-10 parsing and safely strips leading zeros. Without it, shell arithmetic can misinterpret leading-zero numbers in some cases.

Result

I can keep the value masked in GitLab and still use the intended port at runtime.

CI/CD on totoroot's blog

Masked GitLab CI variables need at least 8 characters

Masked GitLab CI variables need at least 8 characters

Workaround

Why 10# matters

Result

Why `10#` matters