Variable Usage for Environment Portability

This rule applies to files matching the patterns above.

# Variable Usage for Environment Portability

## Rule
All environment-specific values in .hurl files MUST use {{variable}} syntax. Hardcoded URLs, tokens, and credentials are prohibited.

## Required Variables
```hurl
# Good — portable across environments
GET {{base_url}}/api/users
Authorization: Bearer {{auth_token}}

# Bad — hardcoded, only works locally
GET http://localhost:3000/api/users
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
```

## Standard Variable Names
| Variable | Description | Example Value |
|----------|-------------|---------------|
| `base_url` | API base URL | http://localhost:3000 |
| `auth_token` | Authentication token | (captured or injected) |
| `admin_email` | Admin test credentials | admin@test.com |
| `admin_password` | Admin test password | testpassword |
| `api_version` | API version prefix | v2 |

## CLI Usage
```bash
# Development
hurl --test --variable base_url=http://localhost:3000 tests/*.hurl

# Staging
hurl --test --variable base_url=https://staging.api.example.com tests/*.hurl

# CI (with secrets)
hurl --test \
  --variable base_url=$API_URL \
  --variable admin_password=$ADMIN_PASSWORD \
  tests/*.hurl
```

## Variables File
```bash
# Create variables file (not committed)
cat > .hurl-vars << 'EOF'
base_url=http://localhost:3000
admin_email=admin@test.com
admin_password=password123
EOF

# Use with --variables-file
hurl --test --variables-file .hurl-vars tests/*.hurl
```

## Anti-Patterns
- Hardcoded http://localhost:3000 in .hurl files
- Real API tokens in committed test files
- Different base URLs across .hurl files in the same project
- Not documenting required variables for new team members