title: How to pass the env secret variable in google app engine and gitlab CI
body: <p>I am using gitlab and deploying it to google app engine for my nodejs application.</p>
  <p>Google Service access is added as variable in gitlab settings</p>
  <pre class="lang-json prettyprint-override"><code>SERVICE_ACCOUNT_KEY: 
     {
        &quot;type&quot;: &quot;service_account&quot;,
        &quot;project_id&quot;: &quot;node-us&quot;,
        &quot;private_key_id&quot;: &quot;&quot;,
        &quot;private_key&quot;: &quot;&quot;,
        &quot;client_email&quot;: &quot;gitlab-demo-service-account@node-us.iam.gserviceaccount.com&quot;,
        &quot;client_id&quot;: &quot;&quot;,
        &quot;auth_uri&quot;: &quot;&quot;,
        &quot;token_uri&quot;: &quot;&quot;,
        &quot;auth_provider_x509_cert_url&quot;: &quot;&quot;,
        &quot;client_x509_cert_url&quot;: &quot;&quot;
      }
  </code></pre>
  <p><strong>.gitlab-ci.yml</strong></p>
  <pre class="lang-yaml prettyprint-override"><code>image: node:latest
  cache:
    paths:
      - node_modules/
      
  before_script:
    - echo &quot;deb http://packages.cloud.google.com/apt cloud-sdk-jessie main&quot; | tee /etc/apt/sources.list.d/google-cloud-sdk.list
    - curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
    - apt-get update
    - apt-get -qq -y install google-cloud-sdk
  
  deploy_production:
    stage: deploy
    environment: Production
    only:
      - master
    script:
      - echo $SERVICE_ACCOUNT_KEY &gt; /tmp/$CI_PIPELINE_ID.json
      - gcloud auth activate-service-account --key-file /tmp/$CI_PIPELINE_ID.json
      - gcloud --quiet --project node-us app deploy app.yaml
  
  after_script:
    - rm /tmp/$CI_PIPELINE_ID.json
  </code></pre>
  <p>my root folder has <code>app.yaml</code> file and <code>.env</code> file</p>
  <p>As of now I was testing the flow which worked fine and deployed successfully to google app engine. (it does not contain any secret keys)</p>
  <p>However I want the my env variables (containing secret keys) need to be ignored in <code>.gitignore</code> also not to be part of <code>app.yaml</code> file.</p>
  <p>How can I pass my env secret keys?</p>