Environment variables

This reference covers the process environment registry and external environment reads. The documentation check combines procenv.Registry with source reads, including injected os.Getenv calls and environment slices. Registry entries include emitted runtime values, inherited tool settings and rejected transports. A variable remains documented while either owner uses or classifies it.

Kinds:

• configuration: an operator or user sets it. Each has a flag or config equivalent where one exists, and its page says which wins.
• runtime: Sparkwing sets it in the environment of pipeline code or a job process; pipeline code may read it, and setting it by hand is not supported.
• plumbing: an internal process input. Some entries still belong to execution paths being replaced by the rewrite. Do not set them.
• test: only the test suites set it.
• other tools: a name another tool defines, which Sparkwing reads as that tool documents it.
• undecided: an operator knob without a page yet; each one waits on a decision to document it or remove it.

The services (sparkwing-controller and sparkwing-runner) read their settings from flags and their secrets from the files in --credentials-dir, so no service configuration appears here.

Configuration: the sparkwing CLI and local runs

Configuration: release tooling

Controller administration

sparkwing-controller admin takes no store flags. It reads the deployment record the serving controller writes to $SPARKWING_HOME/deployment.json, so it must run with the controller's SPARKWING_HOME, which kubectl exec into the controller pod provides. See auth.

Runtime

The job protocol supplies runtime identity. These names also have consumers in Sparkwing code. See node protocol.

Test

Other tools

Process environment policy

The registry owns these classifications. A trailing * denotes a name family. Credential and removed-transport rows describe exclusions, not configuration. Process-specific delivery rules come from procenv.Build: local pipeline processes use captured values, remote pipelines use the configured allow list, and Git receives the credential-free base plus proxy and CA settings.

Go toolchain settings (GOPROXY, GOFLAGS, GOPATH, GOPRIVATE, GONOPROXY, GONOSUMDB, GOSUMDB, GOTOOLCHAIN, GOINSECURE) reach pipeline processes on the requester's own machine: from the captured environment for a local run, and from the hosting process's environment when the controller authenticates the claimant as the requester's own host or a personal machine the requester enrolled. Credentials embedded in a GOPROXY entry or the GOSUMDB URL are registered with the masker before any process starts, so logs show *** in their place. A GOPROXY entry or GOSUMDB URL with a path or query is masked whole, because proxies may carry an access token there. Cloud and shared runners drop these settings unless the operator's allow list names them.

A run can submit only its own names through run.submit_env_allow. Intake refuses, and the CLI does not capture, any name the registry above owns other than AWS_REGION, AWS_DEFAULT_REGION, NO_COLOR, CLICOLOR_FORCE and TERM, any SPARKWING_* or Go toolchain name (GOAUTH, GOCACHEPROG, and similar), and any name that loads code into a job or tool, in any case: LD_*, DYLD_*, GIT_*, SSH_*, CGO_*, NODE_*, npm, yarn, pip and other package-manager settings, BASH_ENV, ENV, PYTHONPATH, JAVA_TOOL_OPTIONS, and similar. Submitted names reach a shared runner only when its operator also lists them, never replace a value the host sets itself, and never reach the pipeline compile. Remote builds on a host the run's owner does not own set GOENV=off, so a go env -w file on that host does not change the build.