how to use secret variables from Azure variable group in pipeline? - docker

Question

We have the following varables defined in a variable group in Azure:
"DATABASE": {
"isSecret": null,
"value": "smdb_all"
},
"HOSTNAME": {
"isSecret": null,
"value": "localhost"
},
"PASSWORD": {
"isSecret": true,
"value": null
},
"ROOT_PASSWORD": {
"isSecret": true,
"value": null
},
"USER": {
"isSecret": null,
"value": "IntegrationTest"
}
}
Then this group variables are read in an Azure pipeline:
steps:
- powershell: |
# Get variables from group
$be_common=az pipelines variable-group variable list --group-id <some_id> --output json | ConvertFrom-Json
echo "$be_common"
$user = $be_common.USER.value
$root_password = $be_common.ROOT_PASSWORD.value
$database = $be_common.DATABASE.value
$password = $be_common.PASSWORD.value
echo "Get single values"
echo "$user"
echo "$database"
echo "$password"
echo "$root_password"
echo "##vso[task.setvariable variable=task_user]$user"
echo "##vso[task.setvariable variable=task_database]$database"
echo "##vso[task.setvariable variable=task_password]$password"
echo "##vso[task.setvariable variable=task_root_password]$root_password"
echo "End"
env:
AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
displayName: 'Get backend common variables'
- task: Docker#2
displayName: Login to ACR
inputs:
command: login
containerRegistry: ${{ parameters.dockerRegistryServiceConnection }}
- task: Docker#2
displayName: Build an image to container registry
inputs:
command: build
repository: ${{ parameters.imageRepository }}
dockerfile: ${{ parameters.dockerfilePath }}
buildContext: $(Build.SourcesDirectory)
containerRegistry: ${{ parameters.dockerRegistryServiceConnection }}
tag: '$(Build.BuildId)'
arguments: '--build-arg CURRENT_ROOT_PASSWORD=$(task_root_password) --build-arg CURRENT_USER=$(task_user) --build-arg CURRENT_PASSWORD=$(password) --build-arg CURRENT_DATABASE=$(task_database)'
And the problem is, that as the root password, and password are secret variables, after the conversions the "task_root_password" and "task_password" are empty strings - this is the log of the pipeline (the pipeline builds and pushes a mariadb docker image):
createdAt:2023-02-01T15:04:26Z; layerSize:0B; createdBy:/bin/sh -c #(nop) ENV MARIADB_DATABASE=smdb_all; layerId:sh
createdAt:2023-02-01T15:04:25Z; layerSize:0B; createdBy:/bin/sh -c #(nop) ENV MARIADB_PASSWORD=; la
createdAt:2023-02-01T15:04:24Z; layerSize:0B; createdBy:/bin/sh -c #(nop) ENV MARIADB_USER=IntegrationTest; layerId:sh
createdAt:2023-02-01T15:04:23Z; layerSize:0B; createdBy:/bin/sh -c #(nop) ENV MARIADB_ROOT_PASSWORD=; la
What should i do in order the actual values of the password and the root_password to be passed as arguments of the build?