How do you implement secret data protection in GitLab CI using environment variables?

In GitLab CI, to protect secret data, environment variables are used, which can be set in the project or group settings:

• In the GitLab interface, go to Settings > CI/CD > Variables.
• Create a variable by specifying its name and value.
• Mark the variable as Protected so it is only available in protected branches (e.g., main or release).
• Mark it as Masked so its value is not displayed in build logs.

In .gitlab-ci.yml, variables can be used with the syntax $VARIABLE_NAME or ${VARIABLE_NAME}.

Example of usage:

stages:
  - deploy

deploy_job:
  stage: deploy
  script:
    - echo "Deploying with secret key $SECRET_KEY"
  only:
    - main

This approach prevents secrets from being stored in code and restricts access to them.