Gitlab Ci Patterns

作者 wshobson46891e7e60da无许可证收录于 2026年10月8日更新于 2026年10月8日

Build GitLab CI/CD pipelines with multi-stage workflows, caching, and distributed runners for scalable automation. Use when implementing GitLab CI/CD, optimizing pipeline performance, or setting up automated testing and deployment.

仅含说明DevOps & Cloud

AI 生成的概览

提供 GitLab CI/CD 流水线模式，涵盖多阶段构建、缓存、部署与安全扫描。

功能: 该技能提供构建 GitLab CI/CD 流水线的参考模式与 YAML 示例。内容涵盖多阶段工作流、Docker 构建与推送、多环境 Kubernetes 部署、Terraform 流水线、安全扫描、缓存策略以及动态子流水线。它还列出了流水线组织与性能方面的最佳实践。
适用场景: 适用于实施或优化 GitLab CI/CD、配置 GitLab Runner、搭建自动化测试与部署，或采用 GitOps 工作流时。也适合为现有流水线添加安全扫描或缓存。
运行要求: 不包含脚本，仅为说明与 YAML 示例。运行示例流水线需要 GitLab 实例、GitLab Runner，以及 node、docker、kubectl、terraform、trivy 等容器镜像。Kubernetes 部署示例需要 KUBE_URL、KUBE_CA_CERT_FILE 和 KUBE_TOKEN 等 CI 变量。

GitLab CI Patterns

Comprehensive GitLab CI/CD pipeline patterns for automated testing, building, and deployment.

Purpose

Create efficient GitLab CI pipelines with proper stage organization, caching, and deployment strategies.

When to Use

Automate GitLab-based CI/CD
Implement multi-stage pipelines
Configure GitLab Runners
Deploy to Kubernetes from GitLab
Implement GitOps workflows

Basic Pipeline Structure

yaml

stages:  - build  - test  - deploy
variables:  DOCKER_DRIVER: overlay2  DOCKER_TLS_CERTDIR: "/certs"
build:  stage: build  image: node:20  script:    - npm ci    - npm run build  artifacts:    paths:      - dist/    expire_in: 1 hour  cache:    key: ${CI_COMMIT_REF_SLUG}    paths:      - node_modules/
test:  stage: test  image: node:20  script:    - npm ci    - npm run lint    - npm test  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'  artifacts:    reports:      coverage_report:        coverage_format: cobertura        path: coverage/cobertura-coverage.xml
deploy:  stage: deploy  image: bitnami/kubectl:1.31  script:    - kubectl apply -f k8s/    - kubectl rollout status deployment/my-app  only:    - main  environment:    name: production    url: https://app.example.com

stages:  - build  - test  - deploy
variables:  DOCKER_DRIVER: overlay2  DOCKER_TLS_CERTDIR: "/certs"
build:  stage: build  image: node:20  script:    - npm ci    - npm run build  artifacts:    paths:      - dist/    expire_in: 1 hour  cache:    key: ${CI_COMMIT_REF_SLUG}    paths:      - node_modules/
test:  stage: test  image: node:20  script:    - npm ci    - npm run lint    - npm test  coverage: '/Lines\s*:\s*(\d+\.\d+)%/'  artifacts:    reports:      coverage_report:        coverage_format: cobertura        path: coverage/cobertura-coverage.xml
deploy:  stage: deploy  image: bitnami/kubectl:1.31  script:    - kubectl apply -f k8s/    - kubectl rollout status deployment/my-app  only:    - main  environment:    name: production    url: https://app.example.com

Docker Build and Push

yaml

build-docker:  stage: build  image: docker:24  services:    - docker:24-dind  before_script:    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY  script:    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .    - docker build -t $CI_REGISTRY_IMAGE:latest .    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA    - docker push $CI_REGISTRY_IMAGE:latest  only:    - main    - tags

build-docker:  stage: build  image: docker:24  services:    - docker:24-dind  before_script:    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY  script:    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .    - docker build -t $CI_REGISTRY_IMAGE:latest .    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA    - docker push $CI_REGISTRY_IMAGE:latest  only:    - main    - tags

Multi-Environment Deployment

Set KUBE_CA_CERT_FILE as a GitLab file variable containing the cluster CA certificate, and provide KUBE_TOKEN through a protected, masked CI variable. The file variable contains a path that kubectl uses to verify the API server certificate. Protect both develop and main so the deployment jobs can read the protected token.

yaml

.deploy_template: &deploy_template  image: bitnami/kubectl:1.31  before_script:    - kubectl config set-cluster k8s --server="$KUBE_URL" --certificate-authority="$KUBE_CA_CERT_FILE" --embed-certs=true    - kubectl config set-credentials admin --token="$KUBE_TOKEN"    - kubectl config set-context default --cluster=k8s --user=admin    - kubectl config use-context default
deploy:staging:  <<: *deploy_template  stage: deploy  script:    - kubectl apply -f k8s/ -n staging    - kubectl rollout status deployment/my-app -n staging  environment:    name: staging    url: https://staging.example.com  only:    - develop
deploy:production:  <<: *deploy_template  stage: deploy  script:    - kubectl apply -f k8s/ -n production    - kubectl rollout status deployment/my-app -n production  environment:    name: production    url: https://app.example.com  when: manual  only:    - main

.deploy_template: &deploy_template  image: bitnami/kubectl:1.31  before_script:    - kubectl config set-cluster k8s --server="$KUBE_URL" --certificate-authority="$KUBE_CA_CERT_FILE" --embed-certs=true    - kubectl config set-credentials admin --token="$KUBE_TOKEN"    - kubectl config set-context default --cluster=k8s --user=admin    - kubectl config use-context default
deploy:staging:  <<: *deploy_template  stage: deploy  script:    - kubectl apply -f k8s/ -n staging    - kubectl rollout status deployment/my-app -n staging  environment:    name: staging    url: https://staging.example.com  only:    - develop
deploy:production:  <<: *deploy_template  stage: deploy  script:    - kubectl apply -f k8s/ -n production    - kubectl rollout status deployment/my-app -n production  environment:    name: production    url: https://app.example.com  when: manual  only:    - main

Terraform Pipeline

yaml

stages:  - validate  - plan  - apply
variables:  TF_ROOT: ${CI_PROJECT_DIR}/terraform  TF_VERSION: "1.6.0"
before_script:  - cd ${TF_ROOT}  - terraform --version
validate:  stage: validate  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init -backend=false    - terraform validate    - terraform fmt -check
plan:  stage: plan  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init    - terraform plan -out=tfplan  artifacts:    paths:      - ${TF_ROOT}/tfplan    expire_in: 1 day
apply:  stage: apply  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init    - terraform apply -auto-approve tfplan  dependencies:    - plan  when: manual  only:    - main

stages:  - validate  - plan  - apply
variables:  TF_ROOT: ${CI_PROJECT_DIR}/terraform  TF_VERSION: "1.6.0"
before_script:  - cd ${TF_ROOT}  - terraform --version
validate:  stage: validate  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init -backend=false    - terraform validate    - terraform fmt -check
plan:  stage: plan  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init    - terraform plan -out=tfplan  artifacts:    paths:      - ${TF_ROOT}/tfplan    expire_in: 1 day
apply:  stage: apply  image: hashicorp/terraform:${TF_VERSION}  script:    - terraform init    - terraform apply -auto-approve tfplan  dependencies:    - plan  when: manual  only:    - main

Security Scanning

yaml

include:  - template: Security/SAST.gitlab-ci.yml  - template: Security/Dependency-Scanning.gitlab-ci.yml  - template: Security/Container-Scanning.gitlab-ci.yml
trivy-scan:  stage: test  image: aquasec/trivy:0.58.0  script:    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA  allow_failure: true

include:  - template: Security/SAST.gitlab-ci.yml  - template: Security/Dependency-Scanning.gitlab-ci.yml  - template: Security/Container-Scanning.gitlab-ci.yml
trivy-scan:  stage: test  image: aquasec/trivy:0.58.0  script:    - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA  allow_failure: true

Caching Strategies

yaml

# Cache node_modulesbuild:  cache:    key: ${CI_COMMIT_REF_SLUG}    paths:      - node_modules/    policy: pull-push
# Global cachecache:  key: ${CI_COMMIT_REF_SLUG}  paths:    - .cache/    - vendor/
# Separate cache per jobjob1:  cache:    key: job1-cache    paths:      - build/
job2:  cache:    key: job2-cache    paths:      - dist/

# Cache node_modulesbuild:  cache:    key: ${CI_COMMIT_REF_SLUG}    paths:      - node_modules/    policy: pull-push
# Global cachecache:  key: ${CI_COMMIT_REF_SLUG}  paths:    - .cache/    - vendor/
# Separate cache per jobjob1:  cache:    key: job1-cache    paths:      - build/
job2:  cache:    key: job2-cache    paths:      - dist/

Dynamic Child Pipelines

yaml

generate-pipeline:  stage: build  script:    - python generate_pipeline.py > child-pipeline.yml  artifacts:    paths:      - child-pipeline.yml
trigger-child:  stage: deploy  trigger:    include:      - artifact: child-pipeline.yml        job: generate-pipeline    strategy: depend

generate-pipeline:  stage: build  script:    - python generate_pipeline.py > child-pipeline.yml  artifacts:    paths:      - child-pipeline.yml
trigger-child:  stage: deploy  trigger:    include:      - artifact: child-pipeline.yml        job: generate-pipeline    strategy: depend

Best Practices

Use specific image tags (node:20, not node:latest)
Cache dependencies appropriately
Use artifacts for build outputs
Implement manual gates for production
Use environments for deployment tracking
Enable merge request pipelines
Use pipeline schedules for recurring jobs
Implement security scanning
Use CI/CD variables for secrets
Monitor pipeline performance

Related Skills

github-actions-templates - For GitHub Actions
deployment-pipeline-design - For architecture
secrets-management - For secrets handling

来源与署名

来源：wshobson/agents位于plugins/cicd-automation/skills/gitlab-ci-patterns提交46891e7

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Gitlab Ci Patterns

GitLab CI Patterns

Purpose

When to Use

Basic Pipeline Structure

Docker Build and Push

Multi-Environment Deployment

Terraform Pipeline

Security Scanning

Caching Strategies

Dynamic Child Pipelines

Best Practices

Related Skills

来源与署名

更多来自 wshobson/agents 的技能

Uv Package Manager

Web Component Design

Python Type Safety

Visual Design Foundations

Responsive Design

Python Resource Management

更多DevOps & Cloud技能

M5 Onboard

Runbook

Incident Response

Deploy Checklist

Spanner Basics

Secops Cases