Automate GitLab CI/CD Pipelines

This skill provides comprehensive GitLab CI/CD pipeline patterns for automated testing, building, and deployment, helping create efficient pipelines with proper stage organization, caching, and deployment strategies. It covers a basic build/test/deploy pipeline structure with Node.js caching and coverage reporting, Docker build-and-push using Docker-in-Docker, multi-environment (staging/production) deployment with a shared YAML anchor template and manual production gates, a full Terraform validate/plan/apply pipeline, GitLab's built-in SAST/Dependency-Scanning/Container-Scanning security templates plus a Trivy image scan, several caching strategies (per-branch, global, per-job), and dynamic child pipelines generated at runtime and triggered via strategy: depend.

Use this skill to automate GitLab-based CI/CD, implement multi-stage pipelines, configure GitLab Runners, deploy to Kubernetes from GitLab, or implement GitOps workflows. Do not use it for tasks unrelated to GitLab CI patterns or for a different CI/CD platform - the related github-actions-templates skill covers GitHub Actions instead. Treat the output as guidance, not a substitute for environment-specific validation, testing, or expert review, and stop to ask for clarification if required inputs, permissions, or success criteria are missing.

A basic pipeline defines build/test/deploy stages, caches node_modules/ keyed by ${CI_COMMIT_REF_SLUG}, publishes build artifacts and Cobertura coverage reports, and deploys to Kubernetes via kubectl apply/kubectl rollout status, restricted to the main branch with a named environment. Docker builds use the docker:24 image with the docker:24-dind service, logging in via $CI_REGISTRY_USER/$CI_REGISTRY_PASSWORD, then tagging and pushing to $CI_REGISTRY_IMAGE by commit SHA and latest. Multi-environment deployment uses a YAML anchor (.deploy_template) shared between deploy:staging (auto-deployed from develop) and deploy:production (manual gate, restricted to main). The Terraform pipeline runs terraform init/validate/fmt -check in a validate stage, terraform plan -out=tfplan in a plan stage (artifact-passed to the next stage), and a manual terraform apply -auto-approve tfplan in an apply stage. Security scanning includes GitLab's Security/SAST, Security/Dependency-Scanning, and Security/Container-Scanning CI templates, plus a trivy image --exit-code 1 --severity HIGH,CRITICAL scan job. Two reference files ship with the skill: assets/gitlab-ci.yml.template (a complete pipeline template) and references/pipeline-stages.md (stage organization patterns).

Caching strategies shown include per-branch caching with policy: pull-push, a global cache for shared paths (.cache/, vendor/), and separate named caches per job. Dynamic child pipelines are generated by a script (e.g. python generate_pipeline.py > child-pipeline.yml) in one job and triggered from another via trigger: include: - artifact: child-pipeline.yml with strategy: depend. Documented best practices: use specific image tags (node:20, not node:latest), cache dependencies appropriately, use artifacts for build outputs, implement manual gates for production, use named environments for deployment tracking, enable merge request pipelines, use pipeline schedules for recurring jobs, implement security scanning, use CI/CD variables for secrets, and monitor pipeline performance. Related skills: github-actions-templates for GitHub Actions, deployment-pipeline-design for architecture, and secrets-management for handling secrets.

Teams building or hardening GitLab CI/CD pipelines who need concrete, working patterns for staged builds, Kubernetes and Terraform deployment, security scanning, caching, and dynamic child pipelines rather than starting from a blank .gitlab-ci.yml.