Using GitLab CI/CD Advanced Features

1. Using Auto DevOps

Feature	Description	Configuration
Auto DevOps	Automates the build, test, and deployment process for applications using GitLab CI/CD.	Enabled by default in GitLab Ultimate and Starter tiers. Can be configured via `.gitlab-ci.yml`.
Build Stage	Automatically builds the application using a predefined pipeline.	Uses `build` job defined in the pipeline. Supports Docker, Kubernetes, and more.
Test Stage	Runs automated tests on the built application.	Uses `test` job defined in the pipeline. Supports unit, integration, and end-to-end tests.
Deploy Stage	Deploys the application to a target environment (e.g., staging or production).	Uses `deploy` job defined in the pipeline. Supports Kubernetes, Docker, and manual deployments.

Example: Enabling Auto DevOps in `.gitlab-ci.yml`

include:
  - template: Auto-DevOps.gitlab-ci.yml

variables:
  AUTO_DEVOPS_ENABLED: "true"

Note: Auto DevOps requires GitLab Runner to be configured and registered in the project.

Auto DevOps Capabilities

Automatically detects the application type (e.g., Node.js, Python, Go).
Uses default build and deployment strategies based on the detected language.
Supports custom configuration via .gitlab-ci.yml.
Provides built-in support for containerization and Kubernetes deployment.

2. Configuring Release Management

Property	Description	Default	Notes
release.name	Name of the release	Empty	Required field
release.tag_name	Tag name for the release	Empty	Must match existing tag
release.description	Description of the release	Empty	Markdown supported
release.ref	Branch or tag to create release from	Default branch	Must be a valid reference
release.assets.links	Links to release assets	None	Array of asset objects

Example: Basic Release Configuration

release:
  name: "Release v1.0"
  tag_name: "v1.0"
  description: "Release notes for version 1.0"
  ref: "main"

Example: Release with Assets

release:
  name: "Release v2.0"
  tag_name: "v2.0"
  description: "Release notes for version 2.0"
  assets:
    links:
      - name: "Download Binary"
        url: "https://example.com/download"

Note: Release management requires GitLab CI/CD to be enabled and the project must have a valid tag.

Warning: Release names must be unique within a project.

3. Using Feature Flags (FF_* variables)

Variable	Description	Usage
FF_*_ENABLED	Enables or disables a feature flag	`FF_MY_FEATURE_ENABLED=true`
FF_*_VALUE	Sets a value for the feature flag	`FF_MY_FEATURE_VALUE=100`

Example: Enabling a feature flag in a job

job_with_feature_flag:
  script:
    - echo "Feature flag enabled: $FF_MY_FEATURE_ENABLED"
    - echo "Feature value: $FF_MY_FEATURE_VALUE"

Note: Feature flags are evaluated at runtime and can be toggled without redeploying code.

Warning: Feature flags should not be used for security-sensitive operations.

4. Implementing Compliance Pipelines

Feature	Description	Usage
security scanning	Integrates static and dynamic security analysis into pipelines	`security:` job in `.gitlab-ci.yml`
compliance checks	Enforces policies on code and artifacts	Using `compliance` job or GitLab's built-in rules
audit logs	Tracks changes and actions within CI/CD	Enabled via GitLab Admin settings

Example: Security Scan Job

security_scan:
  stage: test
  image: <scanner-image>
  script:
    - scan-code --output-format json
  artifacts:
    reports:
      sarif: scan-results.sarif

Example: Compliance Job

compliance_check:
  stage: compliance
  script:
    - echo "Checking code for policy violations"
    - check-policy --config .policy.yml
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request"

Note: Ensure that compliance jobs are run in protected branches to prevent unauthorized changes.

Warning: Security scans must be configured to run on every merge request to ensure compliance.

Compliance Type	Description	Status
license compliance	Checks for allowed software licenses	NEW
vulnerability scanning	Scans for known vulnerabilities in dependencies	DEPRECATED since 16.0
code quality checks	Enforces code style and standards	BETA

5. Using Pipeline Subscriptions

Pipeline subscriptions in GitLab allow you to receive notifications about pipeline events and status changes. These subscriptions can be configured at the project, group, or instance level.

Subscription Type	Description	Event Triggers	Configuration
Project Pipeline	Receive notifications for pipeline events within a specific project.	Pipeline started, completed, failed, or canceled	Go to Project > Settings > Webhooks and configure pipeline events
Group Pipeline	Receive notifications for pipeline events within a group and its subgroups.	Pipeline started, completed, failed, or canceled	Go to Group > Settings > Webhooks and configure pipeline events
Instance Pipeline	Receive notifications for pipeline events across the entire GitLab instance.	Pipeline started, completed, failed, or canceled	Go to Admin Area > Settings > Webhooks and configure pipeline events

Example: Configuring a Webhook for Pipeline Events

curl --request POST \
  --url https://gitlab.example.com/api/v4/projects/123/hooks \
  --header 'Content-Type: application/json' \
  --header 'PRIVATE-TOKEN: glpat-xxxxxxxxxx' \
  --data '{
    "url": "https://example.com/webhook",
    "push_events": false,
    "pipeline_events": true,
    "token": "secret-token"
  }'

Note: Pipeline subscriptions are only available for GitLab Premium and Ultimate editions.

Warning: Ensure that webhook URLs are secured with appropriate authentication to prevent unauthorized access.

6. Configuring Required Pipelines

Setting	Description	Values
only/except	Controls when a job runs based on branch or tag names	`only:` `- main`, `- /^feature\/.*$/` `except:` `- develop`
needs	Defines dependencies between jobs in different stages	`needs: [build_job]`
when	Determines when a job should run	`on_success`, `on_failure`, `always`, `manual`
allow_failure	Allows a job to fail without stopping the pipeline	`true`, `false`

Example: Required Pipeline Configuration

deploy:
  stage: deploy
  script:
    - echo "Deploying to production"
  only:
    - main
  needs:
    - build
  when: manual

Note: The needs keyword ensures that the build job completes before the deploy job starts.

7. Using Pipeline Artifacts

Property	Description	Values
artifacts	Defines the files or directories to be stored as artifacts	`paths`, `exclude`, `name`, `expire_in`
artifacts.paths	List of files/directories to include in the artifact	Array of strings
artifacts.exclude	List of files/directories to exclude from the artifact	Array of strings
artifacts.name	Name of the artifact archive	String
artifacts.expire_in	Time after which the artifact will expire	String (e.g., `1 week`, `30 days`)

Example: Basic Artifact Usage

job_name:
  script:
    - echo "Hello World"
  artifacts:
    paths:
      - build/
      - logs/
    name: "build-artifacts"
    expire_in: 1 week

Example: Artifact with Exclusions

test_job:
  script:
    - npm test
  artifacts:
    paths:
      - coverage/
      - reports/
    exclude:
      - "**/*.log"
    expire_in: 30 days

Note: Artifacts are stored in GitLab and can be downloaded from the UI or via API. The expire_in option helps manage storage usage.

Warning: Large artifacts can increase storage usage and slow down pipeline execution. Use expire_in to manage artifact lifecycle.

8. Implementing External Pull Policies

Policy Type	Description	Configuration	Notes
external_pull	Enables pulling external dependencies from a remote source	`true`	Requires GitLab Runner with proper permissions
pull_source	Defines the remote source for external dependencies	`https://example.com/dependencies`	Must be accessible from the runner environment

Example: Configuring External Pull Policy

job_name:
  image: alpine:latest
  script:
    - echo "Running job with external dependencies"
  external_pull: true
  pull_source: https://example.com/dependencies

Note: Ensure that the GitLab Runner has network access to the external source and necessary authentication.

9. Using Pipeline Efficiency Analytics

Example: Setting up Pipeline Efficiency Metrics

workflow:
  name: "pipeline-efficiency"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request"

variables:
  PIPELINE_DURATION_THRESHOLD: "300" # 5 minutes in seconds

metrics:
  pipeline_duration:
    value: $CI_PIPELINE_DURATION
    unit: seconds
    description: "Total time taken for pipeline execution"
  job_count:
    value: $CI_JOB_NAME
    unit: count
    description: "Number of jobs in the pipeline"

Metric	Description	Unit	Usage
pipeline_duration	Total time taken for pipeline execution	seconds	Used to identify bottlenecks in CI/CD workflows
job_count	Number of jobs in the pipeline	count	Helps analyze job distribution and parallelism
job_duration_avg	Average duration of all jobs	seconds	Used to optimize job scheduling and resource allocation

Note: Pipeline efficiency analytics are available in GitLab Premium and above.

Key Metrics for Pipeline Efficiency

Pipeline Duration - Total time from pipeline start to finish
Job Count - Number of jobs running in parallel or sequentially
Average Job Duration - Helps identify slow jobs that may need optimization

Pipeline Efficiency vs Manual Monitoring

Manual Monitoring: Requires manual tracking and reporting, prone to human error
Pipeline Efficiency Analytics: Automated metrics with real-time dashboards and alerts

Steps to Implement Pipeline Efficiency Analytics

Enable pipeline metrics in your GitLab project settings
Define custom variables for key performance indicators (KPIs)
Use GitLab's built-in dashboard or integrate with external tools like Grafana
Set up alerts for pipeline duration thresholds to detect performance regressions

10. Using id_tokens for OIDC Authentication

Property	Description	Example
id_token	Used to authenticate with external services using OpenID Connect (OIDC) in GitLab CI/CD	`id_token`

Example: Using id_token in a job

job_with_oidc:
  script:
    - echo "Using OIDC token to authenticate with external service"
    - curl -H "Authorization: Bearer $CI_JOB_TOKEN" https://api.example.com/secure-endpoint

Note: The id_token is automatically available in GitLab CI/CD jobs when using OIDC with external services.

Warning: Ensure that the external service supports OIDC and that the token is used securely to prevent unauthorized access.