TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

CI/CD Variables Management

5 posts · Dec 2020 – Nov 2025

What this trail covers

GitLab CI/CD is evolving its variable management to enhance security and maintainability by introducing pipeline inputs as the preferred method for passing parameters. This shift addresses security concerns related to unrestricted pipeline variables, lack of explicit declaration, and type safety. Pipeline inputs offer explicit declaration, type safety, built-in validation, and improved security against variable injection attacks. The platform now recommends restricting pipeline variables, particularly for sensitive information, and emphasizes the use of protected and masked variables. This post details the scopes of CI/CD variables (project, group, instance) and how to define and use them, along with predefined variables and best practices for secure management.

All GitLab trails
  1. Migrate from pipeline variables to pipeline inputsThis post details the migration from pipeline variables to pipeline inputs in GitLab CI/CD. It explains the security and maintainability benefits of pipeline inputs, including explicit declaration, type safety, built-in validation, and protection against variable injection. It provides examples of converting pipeline variables to inputs and outlines how to restrict pipeline variables at project and group levels. It also covers migrating trigger jobs and offers a summary of the benefits of this security enhancement.
  2. CI/CD inputs: Secure and preferred method to pass parameters to a pipelineThis post introduces and advocates for the adoption of CI/CD inputs as a superior alternative to traditional CI/CD variables for parameter passing in GitLab pipelines. It details the shortcomings of variables, including lack of type validation, runtime mutability, security risks, and late error detection. It then explains the fundamentals of CI/CD inputs, highlighting their configuration flexibility, scope, and ability to prevent naming collisions. The post emphasizes the validation and type safety benefits of inputs, demonstrating with examples how they prevent common pipeline failures and lead to more maintainable automation.
  3. Getting started with GitLab: Working with CI/CD variablesThis post details the scopes of CI/CD variables (project, group, and instance) and provides instructions on how to define and use them within `.gitlab-ci.yml` files. It also highlights predefined CI/CD variables and best practices for secure variable management, such as using protected and masked variables. The post emphasizes flexibility, security, maintainability, and reusability as key benefits of using CI/CD variables.
  4. Automating Agile workflows with the gitlab-triage gemThis post introduces the `gitlab-triage` gem, a Ruby library for automating Agile workflows within GitLab projects. It details how to install the gem, obtain API tokens, define triage policies in a `.triage-policies.yml` file (including examples for labeling WIP issues and commenting on old issues), and run the bot manually or via GitLab CI/CD schedules. Advanced policies using Ruby code for custom conditions and actions are also demonstrated, with examples for identifying issues assigned to specific team members and automatically setting due dates. Best practices for using the gem are provided, emphasizing starting simple, testing, monitoring, and using labels for triages.
  5. Revisiting the variables management workflowIntroduced the ability to add descriptions to CI/CD variables for better context and visibility. Improved the variable creation workflow to facilitate consecutive addition or editing of multiple variables with clearer notifications and contextual error messages. Enhanced error prevention by adding new validations and help-texts to the variable creation and editing workflow.
  7. Define input parameters to includable CI/CD configuration filesThis post introduces the ability to define input parameters for includable CI/CD configuration files. It details how to declare these inputs in a template YAML document (using `spec: inputs:`) and how to use them within the template's script or job definitions (using `$[[ inputs.input-name ]]`). It also demonstrates how to include these templates in a main `.gitlab-ci.yml` file and provide values for the input parameters using the `inputs` keyword within the `include` directive. Examples show how to use inputs for dynamic job names, stages, and prefixes.
  8. How to build more reusable CI/CD templatesIntroduced the ability to define input parameters for includable CI/CD files, offering an alternative to environment variables for passing information. These inputs are scoped to specific templates, preventing variable conflicts and increasing isolation. Benefits include explicit passing, full CI/CD interpolation support, mandatory/optional input definition, and default values, enabling more robust and isolated templates that will evolve into CI/CD components.
  9. Understanding the file type variable expansion change in GitLab 15.7This post details the removal of automatic expansion of file type variables in GitLab CI/CD starting from version 15.7. Previously, file type variables would expand their contents when referenced within other variables. This behavior was deemed a security risk as it could expose sensitive data. The change deprecates this feature and removes it, requiring users to update their CI jobs to explicitly handle file contents rather than relying on implicit expansion. The post provides an example of the output difference before and after the change and advises users to check their CI jobs for affected references before upgrading.
  10. Mobile DevOps: iOS code signing with GitLab CI & FastlaneThis post introduces Project-level Secure Files as a storage backend for Fastlane Match, enabling easier management of iOS signing certificates and provisioning profiles within GitLab CI/CD pipelines. It details the setup process for Fastlane Match, including generating a Personal Access Token, generating and uploading certificates, and using the 'upload-only' option. It also provides examples of how to integrate these secure files into CI/CD pipelines for automated app building and signing.
  11. GitLab environment variables demystifiedThis post demystifies GitLab CI/CD variables by explaining their definition (in `.gitlab-ci.yml`, project, group, and instance settings), scope, and precedence. It details predefined variables and custom variable types (File, Environment scope, Protected, Masked, and hidden variables). It also highlights the importance of secrets management, mentioning external integrations and the upcoming native GitLab Secrets Manager.
  12. Masked variable vulnerability in Runner version 13.9.0-rc1This post details a security vulnerability in GitLab Runner version 13.9.0-rc1 where masked CI variables were exposed in build logs. It explains the conditions under which users were affected (GitLab.com shared runners between specific dates, or self-managed instances using the vulnerable runner version). It provides examples of commands that could lead to variable exposure and outlines remediation steps: reviewing jobs for printed variables, rotating secrets, and upgrading/downgrading GitLab Runner. GitLab's actions included deploying a fix (v13.9.0-rc2) and contacting affected users.
  13. How pre-filled CI/CD variables will make running pipelines easierIntroduced pre-filled variables for manual pipeline runs, generating variable suggestions from `.gitlab-ci.yml` definitions. This aims to reduce manual effort, errors, and debugging time associated with entering variables for manual pipelines.