fix(api): update CI/CD variable create and update attributes

PhilipNelson5 · web-flow · commit 849301b830b0 · 2026-04-20T15:54:42.000-07:00
Make `value` optional when updating CI/CD variables. Variables marked as
`masked_and_hidden` have their value hidden by GitLab and cannot be
retrieved, so `value` must not be required for updates.

Add `masked_and_hidden` to optional create attributes for group and
project variables (admin variables do not support this attribute).
 Also expand the optional attributes for all three variable managers
(admin, group, project) to include `description`, `raw`, and
`environment_scope` where applicable, aligning with the GitLab API.

Add functional tests covering create, get, update, and delete of
masked-and-hidden variables for both group and project scopes.
diff --git a/.gitignore b/.gitignore
@@ -13,6 +13,7 @@ docs/_build
 .tox
 .venv/
 venv/
+.mypy_cache/
 
 # Include tracked hidden files and directories in search and diff tools
 !.dockerignore
diff --git a/gitlab/v4/objects/variables.py b/gitlab/v4/objects/variables.py
@@ -27,10 +27,19 @@ class VariableManager(CRUDMixin[Variable]):
     _path = "/admin/ci/variables"
     _obj_cls = Variable
     _create_attrs = RequiredOptional(
-        required=("key", "value"), optional=("protected", "variable_type", "masked")
+        required=("key", "value"),
+        optional=("description", "masked", "protected", "raw", "variable_type"),
     )
     _update_attrs = RequiredOptional(
-        required=("key", "value"), optional=("protected", "variable_type", "masked")
+        required=("key",),
+        optional=(
+            "description",
+            "masked",
+            "protected",
+            "raw",
+            "value",
+            "variable_type",
+        ),
     )
 
 
@@ -43,10 +52,28 @@ class GroupVariableManager(CRUDMixin[GroupVariable]):
     _obj_cls = GroupVariable
     _from_parent_attrs = {"group_id": "id"}
     _create_attrs = RequiredOptional(
-        required=("key", "value"), optional=("protected", "variable_type", "masked")
+        required=("key", "value"),
+        optional=(
+            "description",
+            "environment_scope",
+            "masked",
+            "masked_and_hidden",
+            "protected",
+            "raw",
+            "variable_type",
+        ),
     )
     _update_attrs = RequiredOptional(
-        required=("key", "value"), optional=("protected", "variable_type", "masked")
+        required=("key",),
+        optional=(
+            "description",
+            "environment_scope",
+            "masked",
+            "protected",
+            "raw",
+            "value",
+            "variable_type",
+        ),
     )
 
 
@@ -60,9 +87,25 @@ class ProjectVariableManager(CRUDMixin[ProjectVariable]):
     _from_parent_attrs = {"project_id": "id"}
     _create_attrs = RequiredOptional(
         required=("key", "value"),
-        optional=("protected", "variable_type", "masked", "environment_scope"),
+        optional=(
+            "description",
+            "environment_scope",
+            "masked",
+            "masked_and_hidden",
+            "protected",
+            "raw",
+            "variable_type",
+        ),
     )
     _update_attrs = RequiredOptional(
-        required=("key", "value"),
-        optional=("protected", "variable_type", "masked", "environment_scope"),
+        required=("key",),
+        optional=(
+            "description",
+            "environment_scope",
+            "masked",
+            "protected",
+            "raw",
+            "value",
+            "variable_type",
+        ),
     )
diff --git a/tests/functional/api/test_variables.py b/tests/functional/api/test_variables.py
@@ -43,3 +43,39 @@ def test_project_variables(project):
     assert variable.value == "new_value1"
 
     variable.delete()
+
+
+def test_hidden_group_variables(group):
+    variable = group.variables.create(
+        {"key": "key1", "value": "secret_value", "masked_and_hidden": True}
+    )
+
+    variable = group.variables.get(variable.key)
+    assert variable.value is None
+    assert variable.description is None
+    assert variable in group.variables.list()
+
+    variable.description = "new_description"
+    variable.save()
+    variable = group.variables.get(variable.key)
+    assert variable.description == "new_description"
+
+    variable.delete()
+
+
+def test_hidden_project_variables(project):
+    variable = project.variables.create(
+        {"key": "key1", "value": "secret_value", "masked_and_hidden": True}
+    )
+
+    variable = project.variables.get(variable.key)
+    assert variable.value is None
+    assert variable.description is None
+    assert variable in project.variables.list()
+
+    variable.description = "new_description"
+    variable.save()
+    variable = project.variables.get(variable.key)
+    assert variable.description == "new_description"
+
+    variable.delete()
