gitlab-runner exec docker - inject gpg key

Question

I need to run gitlab-runner locally using the exec command and the docker executor.

The docker executor clones the project into the container so I start with a blank slate. In order to run the tests, I need to decrypt certain credentials files. Normally this is done on the dev machine using the developers private gpg key. But now we are in a container and I can't find a way to inject the developers gpg key into the testing container.

Normally it would make sense to pass the private key as an environment variable but the environment feature is not supported on the gitlab-runner exec command.

It would be much easier if gitlab-runner would just copy the project files into the container instead of doing a fresh clone of the project. That way the developer would decrypt the credentials on the host and everything is fine.

What are my options here?

Answer 1

The only option to pass in environment variables into the testing container is to use the --env parameter for gitlab-runner .

First we need to store the private key in an environment variable on our local machine. I used direnv for this but it also works manually:

export GPG_PRIVATE_KEY="$(gpg --export-secret-keys -a <KEY ID>)"

Then we can run gitlab-runner like this:

gitlab-runner exec docker test \
  --env GPG_PRIVATE_KEY="$GPG_PRIVATE_KEY" \
  --env GPG_PASSPHRASE="$GPG_PASSPHRASE"

Note that I also passed the passphrase in an environment variable because I need it inside the container to decrypt my data.

Now I can import the key in the docker container. The top of my .gitlab-ci.yml looks like this:

image: quay.io/mhart/alpine-node:8

before_script:
  - apk add --no-cache gnupg
  - echo "$GPG_PRIVATE_KEY" | gpg --batch --import --pinentry-mode loopback --no-tty

Done, now we can use that key inside the container to do what we want.

I also ran into some problems when I tried to decrypt my data. This guide was incredibly helpful and solved my issue.

Answer 2

It is hard for me to imagine.why you need to invoke gitlab-runner with exec but why could not you do

   exec gitlab-runner sh
             export GPG_KEY=...
             ....