groovy - 无法插入敏感的环境变量

Question

我有一段这样运行的代码

package core.jenkins

class Utils implements Serializable {
    def script

    Utils(script) {
        this.script = script
    }

    def func() {
        script.withCredentials([script.usernamePassword(credentialsId: 'chartmuseum-basic-auth', usernameVariable: 'USER', passwordVariable: 'PASSWORD')]) {
            script.sh "helm repo add --username script.USER} --password ${script.PASSWORD} chartmuseum \"http://${chartmuseumHostname}:8080\""
        }
}

以上工作完全正常，但我没有警告

Warning: A secret was passed to "sh" using Groovy String interpolation, which is insecure.
         Affected argument(s) used the following variable(s): [PASSWORD, USER]
         See https://jenkins.io/redirect/groovy-string-interpolation for details.
+ helm repo add --username **** --password **** chartmuseum http://apps-chartmuseum.apps.svc.cluster.local:8080

所以按照指南，我做以下

script.withCredentials([script.usernamePassword(credentialsId: 'chartmuseum-basic-auth', usernameVariable: 'USER', passwordVariable: 'PASSWORD')]) {
script.sh 'helm repo add --username $script.USER --password $script.PASSWORD chartmuseum "http://$chartmuseumHostname:8080"'
        }

但是运行变量值没有被正确替换，我得到

+ helm repo add --username .USER --password .PASSWORD chartmuseum http://:8080
Error: Looks like "http://:8080" is not a valid chart repository or cannot be reached: Get http://:8080/index.yaml: dial tcp :8080: connect: connection refused

因此， chartmuseumHostname 的凭据和值都没有。变量被正确替换。我在这里错过了什么？

Answer 1

实际上 withCredentials() 创建了一个环境变量，您可以从 shell 脚本访问它。
看这里:https://www.jenkins.io/doc/pipeline/steps/credentials-binding/
尝试直接使用 shell 变量:

script.sh 'helm repo add --username $USER --password $PASSWORD chartmuseum "http://$chartmuseumHostname:8080"'