Gitlab Ci Patterns

by wshobson46891e7e60daNo licenseListed Oct 8, 2026Updated Oct 8, 2026

Build GitLab CI/CD pipelines with multi-stage workflows, caching, and distributed runners for scalable automation. Use when implementing GitLab CI/CD, optimizing pipeline performance, or setting up automated testing and deployment.

Instructions onlyDevOps & Cloud

AI-generated overview

Provides GitLab CI/CD pipeline patterns for multi-stage builds, caching, deployment, and security scanning.

What it does: This skill supplies reference patterns and YAML examples for building GitLab CI/CD pipelines. It covers multi-stage workflows, Docker build and push, multi-environment Kubernetes deployment, Terraform pipelines, security scanning, caching strategies, and dynamic child pipelines. It also lists best practices for pipeline organization and performance.
When to use it: Use it when implementing or optimizing GitLab CI/CD, configuring GitLab Runners, setting up automated testing and deployment, or adopting GitOps workflows. It is also relevant when adding security scanning or caching to existing pipelines.
Requirements: No scripts are included; it is instructions and YAML examples only. Running the example pipelines requires a GitLab instance, GitLab Runners, and access to container images such as node, docker, kubectl, terraform, and trivy. Kubernetes deployment examples need KUBE_URL, KUBE_CA_CERT_FILE, and KUBE_TOKEN CI variables.

GitLab CI Patterns

Comprehensive GitLab CI/CD pipeline patterns for automated testing, building, and deployment.

Purpose

Create efficient GitLab CI pipelines with proper stage organization, caching, and deployment strategies.

When to Use

Automate GitLab-based CI/CD
Implement multi-stage pipelines
Configure GitLab Runners
Deploy to Kubernetes from GitLab
Implement GitOps workflows

Basic Pipeline Structure

yaml

stages:  - build  - test  - deploy
variables:  DOCKER_DRIVER: overlay2  DOCKER_TLS_CERTDIR: "/certs"
build:  stage: build  image: node:20  script:    - npm ci    - npm run build  artifacts:    paths:      - dist/    expire_in: 1 hour  cache:    key: ${CI_COMMIT_REF_SLUG}    paths:      - node_modules/
test:  stage: test  image: node:20  script:    - npm ci    - npm run lint    - npm test  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'  artifacts:    reports:      coverage_report:        coverage_format: cobertura        path: coverage/cobertura-coverage.xml
deploy:  stage: deploy  image: bitnami/kubectl:1.31  script:    - kubectl apply -f k8s/    - kubectl rollout status deployment/my-app  only:    - main  environment:    name: production    url: https://app.example.com

stages:  - build  - test  - deploy
variables:  DOCKER_DRIVER: overlay2  DOCKER_TLS_CERTDIR: "/certs"
build:  stage: build  image: node:20  script:    - npm ci    - npm run build  artifacts:    paths:      - dist/    expire_in: 1 hour  cache:    key: ${CI_COMMIT_REF_SLUG}    paths:      - node_modules/
test:  stage: test  image: node:20  script:    - npm ci    - npm run lint    - npm test  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'  artifacts:    reports:      coverage_report:        coverage_format: cobertura        path: coverage/cobertura-coverage.xml
deploy:  stage: deploy  image: bitnami/kubectl:1.31  script:    - kubectl apply -f k8s/    - kubectl rollout status deployment/my-app  only:    - main  environment:    name: production    url: https://app.example.com

Docker Build and Push

yaml

build-docker:  stage: build  image: docker:24  services:    - docker:24-dind  before_script:    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY  script:    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .    - docker build -t $CI_REGISTRY_IMAGE:latest .    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA    - docker push $CI_REGISTRY_IMAGE:latest  only:    - main    - tags

build-docker:  stage: build  image: docker:24  services:    - docker:24-dind  before_script:    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY  script:    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .    - docker build -t $CI_REGISTRY_IMAGE:latest .    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA    - docker push $CI_REGISTRY_IMAGE:latest  only:    - main    - tags

Multi-Environment Deployment

Set KUBE_CA_CERT_FILE as a GitLab file variable containing the cluster CA certificate, and provide KUBE_TOKEN through a protected, masked CI variable. The file variable contains a path that kubectl uses to verify the API server certificate. Protect both develop and main so the deployment jobs can read the protected token.

yaml

.deploy_template: &deploy_template  image: bitnami/kubectl:1.31  before_script:    - kubectl config set-cluster k8s --server="$KUBE_URL" --certificate-authority="$KUBE_CA_CERT_FILE" --embed-certs=true    - kubectl config set-credentials admin --token="$KUBE_TOKEN"    - kubectl config set-context default --cluster=k8s --user=admin    - kubectl config use-context default
deploy:staging:  <<: *deploy_template  stage: deploy  script:    - kubectl apply -f k8s/ -n staging    - kubectl rollout status deployment/my-app -n staging  environment:    name: staging    url: https://staging.example.com  only:    - develop
deploy:production:  <<: *deploy_template  stage: deploy  script:    - kubectl apply -f k8s/ -n production    - kubectl rollout status deployment/my-app -n production  environment:    name: production    url: https://app.example.com  when: manual  only:    - main

.deploy_template: &deploy_template  image: bitnami/kubectl:1.31  before_script:    - kubectl config set-cluster k8s --server="$KUBE_URL" --certificate-authority="$KUBE_CA_CERT_FILE" --embed-certs=true    - kubectl config set-credentials admin --token="$KUBE_TOKEN"    - kubectl config set-context default --cluster=k8s --user=admin    - kubectl config use-context default
deploy:staging:  <<: *deploy_template  stage: deploy  script:    - kubectl apply -f k8s/ -n staging    - kubectl rollout status deployment/my-app -n staging  environment:    name: staging    url: https://staging.example.com  only:    - develop
deploy:production:  <<: *deploy_template  stage: deploy  script:    - kubectl apply -f k8s/ -n production    - kubectl rollout status deployment/my-app -n production  environment:    name: production    url: https://app.example.com  when: manual  only:    - main

Terraform Pipeline

yaml

stages:  - validate  - plan  - apply
variables:  TF_ROOT: ${CI_PROJECT_DIR}/terraform  TF_VERSION: "1.6.0"
before_script:  - cd ${TF_ROOT}  - terraform --version
validate:  stage: validate  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init -backend=false    - terraform validate    - terraform fmt -check
plan:  stage: plan  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init    - terraform plan -out=tfplan  artifacts:    paths:      - ${TF_ROOT}/tfplan    expire_in: 1 day
apply:  stage: apply  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init    - terraform apply -auto-approve tfplan  dependencies:    - plan  when: manual  only:    - main

stages:  - validate  - plan  - apply
variables:  TF_ROOT: ${CI_PROJECT_DIR}/terraform  TF_VERSION: "1.6.0"
before_script:  - cd ${TF_ROOT}  - terraform --version
validate:  stage: validate  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init -backend=false    - terraform validate    - terraform fmt -check
plan:  stage: plan  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init    - terraform plan -out=tfplan  artifacts:    paths:      - ${TF_ROOT}/tfplan    expire_in: 1 day
apply:  stage: apply  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init    - terraform apply -auto-approve tfplan  dependencies:    - plan  when: manual  only:    - main

Security Scanning

yaml

include:  - template: Security/SAST.gitlab-ci.yml  - template: Security/Dependency-Scanning.gitlab-ci.yml  - template: Security/Container-Scanning.gitlab-ci.yml
trivy-scan:  stage: test  image: aquasec/trivy:0.58.0  script:    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA  allow_failure: true

include:  - template: Security/SAST.gitlab-ci.yml  - template: Security/Dependency-Scanning.gitlab-ci.yml  - template: Security/Container-Scanning.gitlab-ci.yml
trivy-scan:  stage: test  image: aquasec/trivy:0.58.0  script:    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA  allow_failure: true

Caching Strategies

yaml

# Cache node_modulesbuild:  cache:    key: ${CI_COMMIT_REF_SLUG}    paths:      - node_modules/    policy: pull-push
# Global cachecache:  key: ${CI_COMMIT_REF_SLUG}  paths:    - .cache/    - vendor/
# Separate cache per jobjob1:  cache:    key: job1-cache    paths:      - build/
job2:  cache:    key: job2-cache    paths:      - dist/

# Cache node_modulesbuild:  cache:    key: ${CI_COMMIT_REF_SLUG}    paths:      - node_modules/    policy: pull-push
# Global cachecache:  key: ${CI_COMMIT_REF_SLUG}  paths:    - .cache/    - vendor/
# Separate cache per jobjob1:  cache:    key: job1-cache    paths:      - build/
job2:  cache:    key: job2-cache    paths:      - dist/

Dynamic Child Pipelines

yaml

generate-pipeline:  stage: build  script:    - python generate_pipeline.py > child-pipeline.yml  artifacts:    paths:      - child-pipeline.yml
trigger-child:  stage: deploy  trigger:    include:      - artifact: child-pipeline.yml        job: generate-pipeline    strategy: depend

generate-pipeline:  stage: build  script:    - python generate_pipeline.py > child-pipeline.yml  artifacts:    paths:      - child-pipeline.yml
trigger-child:  stage: deploy  trigger:    include:      - artifact: child-pipeline.yml        job: generate-pipeline    strategy: depend

Best Practices

Use specific image tags (node:20, not node:latest)
Cache dependencies appropriately
Use artifacts for build outputs
Implement manual gates for production
Use environments for deployment tracking
Enable merge request pipelines
Use pipeline schedules for recurring jobs
Implement security scanning
Use CI/CD variables for secrets
Monitor pipeline performance

Related Skills

github-actions-templates - For GitHub Actions
deployment-pipeline-design - For architecture
secrets-management - For secrets handling

Source and attribution

Source:wshobson/agentsinplugins/cicd-automation/skills/gitlab-ci-patternsat commit46891e7

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Gitlab Ci Patterns

GitLab CI Patterns

Purpose

When to Use

Basic Pipeline Structure

Docker Build and Push

Multi-Environment Deployment

Terraform Pipeline

Security Scanning

Caching Strategies

Dynamic Child Pipelines

Best Practices

Related Skills

Source and attribution

More from wshobson/agents

Uv Package Manager

Web Component Design

Python Type Safety

Visual Design Foundations

Responsive Design

Python Resource Management

More in DevOps & Cloud

M5 Onboard

Spanner Basics

Secops Cases

Managed Airflow Migrations

Managed Airflow Dag Troubleshooting

Iam Helper For Privileged Access Management