GitLab CI/CD
GitLab CI/CD is a continuous integration and delivery system built into GitLab. Pipelines are defined in a YAML file alongside the source code, running jobs on shared or self-managed runners to build, test, scan, and deploy every commit.
itDevOps and software delivery | OpenSkills.info
Intro
GitLab CI/CD
GitLab CI/CD is the continuous integration and continuous delivery system built into GitLab itself. You describe your build, test, and deploy process as YAML in a single file, .gitlab-ci.yml, committed at the root of your repository. Push a commit, and GitLab reads that file, schedules the work it describes, and reports the result back on the commit and the merge request. There is no separate CI server to install: GitLab hosts the scheduling and the interface, and either GitLab or your own infrastructure supplies the machines that actually run the work.
The mental model
A pipeline is the top-level run: everything triggered for one commit, merge request, schedule, or manual click. A pipeline is composed of stages, which run in order, and jobs, which live inside a stage. Jobs in the same stage run in parallel; if any job in a stage fails, later stages are normally skipped and the pipeline stops early. A small pipeline might look like: a build stage with a compile job, a test stage with test1 and test2 jobs that only start once compile succeeds, and a deploy stage with a deploy-to-production job that only starts once both test jobs succeed.
build-job:
stage: build
script:
- echo "Building..."
test-job1:
stage: test
script:
- echo "Testing part 1"
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://docs.gitlab.com/ci/
Supports
- GitLab CI/CD as a continuous method of building, testing, deploying, monitoring iterative code changes
- .gitlab-ci.yml file at project root defining stages, jobs, scripts
- Pipelines composed of stages (order) and jobs (tasks); runners as agents executing jobs
- GitLab.com provides Linux/Windows/macOS runners already available; self-managed runners can be registered
- CI/CD variables as key-value pairs for configuration/secrets; custom vs predefined variables; protected and masked variable settings
- CI/CD expressions ($[[ ]] syntax) for inputs and matrix contexts
- CI/CD components as reusable pipeline configuration units, added via include:component, published to CI/CD Catalog
- https://docs.gitlab.com/ci/quick_start/
Supports
- First-pipeline tutorial flow - ensure runners available, create .gitlab-ci.yml, commit, view pipeline
- Sample four-job pipeline (build-job, test-job1, test-job2, deploy-prod) with stage and script keywords
- stage describes sequential execution; jobs within a stage run in parallel if runners available
- needs keyword to run jobs out of stage order for speed/efficiency
- rules keyword for conditional job execution; only/except are legacy but still supported
- cache and artifacts keywords for persisting data across jobs/stages despite ephemeral runners
- default keyword for shared configuration such as before_script/after_script
- https://docs.gitlab.com/ci/pipelines/
Supports
- Pipelines defined via global YAML keywords, jobs, and stages; stages run in sequence, jobs in a stage run in parallel
- Example three-stage pipeline (build/compile, test/test1+test2, deploy/deploy-to-production) with stage-gating behavior on failure
- Pipeline types - basic, needs-based, merge request pipelines, merged results pipelines, merge trains, parent-child pipelines (monorepos), multi-project pipelines
- Manual pipeline execution and manual jobs requiring explicit action
- Skipping a pipeline with [ci skip]/[skip ci] commit message or ci.skip push option
- Pipeline security on protected branches - protected variables accessible only to protected-branch pipelines; protected runners restricted to protected branches
- https://docs.gitlab.com/ci/yaml/
Supports
- .gitlab-ci.yml keyword vocabulary (stage, script, variables, rules, needs, cache, artifacts, environment, default, include, extends, when, only/except) as the authoritative configuration reference
- https://docs.gitlab.com/ci/variables/
Supports
- CI/CD variables defined in .gitlab-ci.yml are visible to all users with repo access; store only non-sensitive config there
- Sensitive variables should be defined in project/group/instance UI settings instead of the YAML file
- Variables can be masked (hidden from job logs, replaced with [MASKED]) and protected (restricted to protected branches/tags)
- Masking a CI/CD variable is explicitly not a guaranteed way to prevent malicious users from accessing the value
- Example accidental-leak-job and malicious-job showing variable exfiltration risk in .gitlab-ci.yml changes; recommendation to review all MRs touching .gitlab-ci.yml
- CI/CD variable precedence order (pipeline execution/scan policy variables > pipeline variables > project > group > instance > dotenv > job variables > default top-level variables > predefined variables)
- File-type CI/CD variables for tools like kubectl/AWS CLI that need file input
- https://docs.gitlab.com/ci/runners/
Supports
- Runners as agents running the GitLab Runner application to execute CI/CD jobs
- Runner execution flow - registration, job availability, matching runners pick up jobs, results reported back
- GitLab-hosted runners - fully managed, available immediately, fresh VM per job, Linux/Windows/macOS, automatically scaled
- Self-managed runners - installed/managed by the user, customizable, support Shell/Docker/Kubernetes executors, can be group/project/instance scoped
- Decision criteria for choosing GitLab-hosted vs self-managed runners
- https://docs.gitlab.com/ci/environments/
Supports
- Environment as a specific deployment target (development, staging, production) with consistent, repeatable deployment tracking
- Static vs dynamic environments; dynamic environments typically used for review apps with CI/CD-variable-based names
- Example deploy_staging job creating a named/URL'd static environment; deploy_review_app example for dynamic environments using $CI_COMMIT_REF_SLUG
- Environment scope for CI/CD variables (wildcard * default, specific environment, or wildcard group like review/*)
- on_stop action and stop jobs for tearing down environments automatically (e.g. on branch deletion or MR merge/close)
- Deployment tiers (development, testing, staging, production, other) guessed from environment name patterns
- https://docs.gitlab.com/ci/components/
Supports
- CI/CD component defined as a reusable, single pipeline configuration unit, usable to compose part or all of a pipeline
- Components referenced via include:component with format <FQDN>/<project-path>/<component-name>@<version>, pinned to commit SHA, tag, branch, or ~latest/partial semver (catalog only)
- Included component configuration merges into the pipeline; same-named jobs/config can collide
- CI/CD Catalog as the list of projects with published, discoverable, versioned components
- Security best practices for component users - pin to commit SHA or release version, audit source, avoid `latest`, limit token access
- https://docs.gitlab.com/ci/secrets/
Supports
- CI/CD jobs can source secrets from external providers (HashiCorp Vault, Google Cloud Secret Manager, Azure Key Vault, AWS Secrets Manager) rather than only CI/CD variables
- Secrets must be explicitly requested by a job, unlike always-available CI/CD variables
- External secrets integrations authenticate using ID tokens (OIDC/JWT)
- https://docs.gitlab.com/ci/pipelines/compute_minutes/
Supports
- Compute minute usage formula - job duration in seconds / 60 * cost factor
- GitLab.com Free tier namespaces receive 400 compute minutes per month; paid tiers receive a higher quota; additional minutes purchasable
- Cost factors vary by GitLab-hosted runner type and machine size (e.g. Linux x86-64 small = 1, large = 3, xlarge = 6)
- Strategies to reduce compute minute usage - interruptible jobs, rules to skip unneeded jobs, reducing scheduled pipeline frequency, self-managed runners
