GITLAB_TOKEN or the glab CLI configuration.GitLab::Project::Variable now exposes its value as a first-class secret.
Other resources reference it with myVariable.res.secretValue, which resolves
live and is stored as a reference rather than a copy of the value.GitLab::Project::Variable.value is now opaque: it is stored hashed and
redacted in output, closing a leak where the value GitLab returns on read was
persisted in cleartext. This applies to every variable, including ones holding
ordinary configuration. Their values are no longer readable back out of
formae, and an out-of-band change is still reported as drift but can no longer
be absorbed into code as a readable value.formae@0.89.0 package.sudo formae plugin install gitlab on the host that runs the formae agent.