Skip to main content

Gitlab CI/CD concepts

1. Predefined (Built-in) Variables​

These variables exist by default within GitLab and provide information about the project, pipeline, or commit. Examples include:

  • CI_COMMIT_BRANCH: Shows the branch where changes were committed.
  • CI_PROJECT_NAME: The name of the project.
  • CI_PIPELINE_ID: A unique ID for every pipeline run.

2. Custom (User-Defined) Variables​

These are variables created by the user to store specific values needed for the pipeline, such as database usernames or environment names. They are typically created in the GitLab project settings under Settings > CI/CD > Variables.

3. Secrets​

Secrets are a specific category of custom variables used for sensitive data, such as passwords, API keys, tokens, and SSH keys. The video emphasizes a critical rule: never hardcode secrets directly into the pipeline script or source code to avoid leaking them in logs or to unauthorized users.

4. Masked Variables​

Masking is a security feature applied to variables so their values do not appear in the pipeline logs.

  • When a variable is masked, GitLab replaces the value with stars (e.g., **********) in the logs.
  • To be masked, a value must be at least eight characters long and contain no spaces.

5. Protected Variables​

These variables are restricted so they are only available to jobs running on protected branches (like the main branch).

  • If a developer creates a "malicious" branch to try and print secrets, protected variables will not be visible or accessible in that branch.

6. Environment Variables​

When a pipeline runs, GitLab internally injects these variables into the job's environment using an export command. This allows scripts to access the values securely during execution.

Variable Scope and Precedence​

The video also explains that variables can be defined at different "scopes," and GitLab follows a specific hierarchy (precedence) if the same variable is defined in multiple places:

  1. Pipeline level: Highest priority; passed during the pipeline run.
  2. Project level: Available to all pipelines within a specific project.
  3. Group level: Shared across multiple projects within a group.
  4. Predefined level: The default built-in values.