Skip to main content

Environment variables

Environment variables allow you to configure workflows, jobs, and steps with key-value pairs. They can be defined at the workflow, job, or step level. Environment variable values support expressions, allowing you to reference secrets and other environment variables.

Schema​

Environment variables are defined as env?: [string]: string at workflow, job, and step levels.

See Schema Reference for complete schema definitions.

Expression Support: Environment variable values support expressions - see Expressions.

Format​

Environment variables use a simple YAML map format:

env:
  MODEL_REGISTRY: models
  DATA_PATH: /datasets
  EPOCHS: "100"

Important: All values must be strings. Numbers and booleans should be quoted.

Never put sensitive data directly in env vars - use secrets instead

Scope Levels​

Environment variables can be configured at three different levels, each with different scope and inheritance behavior:

Workflow-Level Environment Variables​

Environment variables defined at the workflow level are available to all jobs and steps within the workflow.

Location: Top-level env field in the workflow

Use Case: Global configuration values used across multiple jobs

Example:

id: model-training-pipeline

env:
  EXPERIMENT_NAME: baseline-v1
  DATA_PATH: /datasets
  MODEL_REGISTRY: models

jobs:
  # All jobs can access EXPERIMENT_NAME, DATA_PATH, and MODEL_REGISTRY
  train:
    name: Train Model
    steps:
      - name: Train model

Job-Level Environment Variables​

Environment variables defined at the job level are available to that specific job and its steps.

Location: env field within a job definition

Use Case: Job-specific configuration values

Example:

jobs:
  train:
    name: Train Model
    env:
      MODEL_TYPE: xgboost
      LEARNING_RATE: "0.001"
      BATCH_SIZE: "32"
    steps:
      - name: Train model

Step-Level Environment Variables​

Environment variables defined at the step level are available only to that specific step.

Location: env field within a step definition

Use Case: Step-specific configuration

Example:

steps:
  - name: Train model
    env:
      EPOCHS: "100"
      EARLY_STOPPING: "true"

Scope and Inheritance​

Environment variables at different levels are merged together, with more specific levels taking precedence:

  1. Workflow env vars are available to all jobs and steps.
  2. Job env vars are added to workflow env vars for that job (overriding workflow values for same keys).
  3. Step env vars are added to workflow and job env vars for that step (overriding job/workflow values for same keys).

Precedence: Step > Job > Workflow

Example​

env:
  EPOCHS: "50"           # Workflow level
  DATA_PATH: /datasets

jobs:
  train:
    name: Train Model
    env:
      EPOCHS: "100"      # Overrides workflow EPOCHS for this job
      BATCH_SIZE: "32"   # Adds new variable
    steps:
      - name: Train baseline
        # This step has: EPOCHS=100, DATA_PATH=/datasets, BATCH_SIZE=32

      - name: Train advanced
        env:
          EPOCHS: "200"  # Overrides job EPOCHS for this step
        # This step has: EPOCHS=200, DATA_PATH=/datasets, BATCH_SIZE=32

Combining with Secrets​

Environment variables work alongside secrets to provide the complete runtime environment. Secrets are defined at the workflow level and referenced in environment variables using expressions.

  • env: For both static values and expressions that reference secrets.
  • secrets: Define sensitive data from H2O Secure Store (workflow-level only).
secrets:
  - name: workspaces/b9c6e0da-355c-4683-bfbb-b7bf876e7b6b/secrets/ayiffo22n6gu
    as: registry_token

jobs:
  deploy:
    name: Deploy Model
    env:
      MODEL_NAME: baseline-xgboost
      VERSION: "1.0"
      REGISTRY_TOKEN: "${{ .secrets.registry_token }}"  # Reference secret via expression
    steps:
      - name: Deploy model
        run: |
          # This step has access to:
          # - MODEL_NAME and VERSION (static values)
          # - REGISTRY_TOKEN (secret value via expression)
          python deploy.py --model ${MODEL_NAME} --token ${REGISTRY_TOKEN}

Secrets are always defined at the workflow level and referenced using ${{ .secrets.<name> }} expressions.

Feedback