Problem: Ansible secret extra-vars are parsed incorrectly when values contain spaces

Issue

Variable Group secret variables are passed to Ansible differently from regular extra variables.

Regular extra variables are serialized into a JSON --extra-vars argument, but secret variables are currently appended separately as:

--extra-vars name=value

This causes values containing spaces or other complex content to be parsed incorrectly by Ansible.

For example, a secret variable containing:

value with spaces

is not transported in the same safe way as the existing JSON extra-vars payload.

This is especially problematic for values such as SSH public keys, tokens containing spaces, and other structured secret values.

Current behavior

Semaphore builds the normal extra-vars JSON payload first, then appends each Environment Secret Variable as another CLI argument:

--extra-vars name=value

Expected behavior

Environment Secret Variables of type var should be merged into the existing JSON extra-vars map before serialization.

This preserves the exact value and also keeps the existing secret-variable override precedence.

Environment secrets of type env should remain environment variables and should not be included in the Ansible JSON extra-vars payload.

Reproduction

1. Create a Variable Group.
2. Add a Secret Variable.
3. Set its value to a string containing spaces.
4. Attach the Variable Group to an Ansible template.
5. Run a playbook that validates the complete variable value.

The value is not transported correctly when passed using name=value.

Tested fix

I tested a change that merges EnvironmentSecretVar values into getEnvironmentExtraVarsJSON() and removes the separate --extra-vars name=value arguments.

A regression test verifies:

• values containing spaces;
• multiline values;
• secret variable precedence over normal extra vars;
• exclusion of EnvironmentSecretEnv values.

The fix has also been verified end-to-end with an Ansible task.

Semaphore version

Originally reproduced on v2.19.7.

The same separate name=value transport is still present in the current develop branch.