I have a GitLab Job, which needs secrets from our vault and triggers a downstream pipeline:

myJob:
  secrets:
    API_KEY:
      vault: myVault/ApiKey@secret
      file: false
    USERNAME:
      vault: myVault/Username@secret
      file: false
  stage: build
  allow_failure: true
  variables:
    foo: 'bar'
  trigger:
    include:
      - project: 'gitlab/gitlab-templates'
        ref: '2.1.6'
        file: 'gitlab-ci/.gitlab-ci.yml'
    strategy: depend
    forward:
      yaml_variables: true
      pipeline_variables: true
  only:
    - main

The secrets work, if I have a script instead of a trigger section.

The trigger works too, if I provide the API_KEY and the USERNAME as variables.

But when I combine trigger and secrets , the GitLab tells me already in de Pipeline Editor, that the configuration is invalid.

I read the documentation of the GitLab secrets :https://docs.gitlab.com/ee/ci/yaml/#secrets and trigger : https://docs.gitlab.com/ee/ci/yaml/#trigger.

Where I found this:

Trigger jobs can use only a limited set of GitLab CI/CD configuration keywords. The keywords available for use in trigger jobs are:

• allow_failure.

• extends.

• needs, but not needs:project.

• only and except.

• rules.

• stage.

• trigger.

• variables.

• when (only with a value of on_success, on_failure, or always).

• resource_group.

• environment.

What would be your workaround to get the secrets to the downstream pipeline, without storing them as ci variables?