Gitlab Ci

GitLab CI/CD Skill

GitLab CI runs pipelines defined in .gitlab-ci.yml at the repository root. This skill covers pipeline authoring with a Drupal project as the working example: validate → test → build → deploy, with composer caching and drush-based deployment.

---

Pipeline anatomy

stages:
  - validate
  - test
  - deploy

default:
  image: php:8.3-cli
  before_script:
    - curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

variables:
  COMPOSER_CACHE_DIR: "$CI_PROJECT_DIR/.composer-cache"

cache:
  key:
    files:
      - composer.lock        # cache invalidates when the lock file changes
  paths:
    - .composer-cache/
    - vendor/

• stages run sequentially; jobs within a stage run in parallel.
• default holds settings shared by all jobs.
• Cache vs artifacts: cache is best-effort storage between pipelines

(composer/npm caches); artifacts pass build results between jobs of the same pipeline and can be downloaded from the UI.

---

Controlling when jobs run — rules:

rules: replaces the deprecated only/except:

phpcs:
  stage: validate
  script:
    - composer install --no-progress
    - vendor/bin/phpcs --standard=Drupal,DrupalPractice web/modules/custom
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

First matching rule wins. Common conditions:

| Goal | Rule | |---|---| | MR pipelines only | if: $CI_PIPELINE_SOURCE == "merge_request_event" | | Default branch only | if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH | | Tags only | if: $CI_COMMIT_TAG | | Skip on draft MRs | if: $CI_MERGE_REQUEST_TITLE =~ /^Draft:/ + when: never | | Manual gate | when: manual (e.g. production deploy) |

---

Drupal test jobs

phpstan:
  stage: test
  script:
    - composer install --no-progress
    - vendor/bin/phpstan analyse web/modules/custom

phpunit:
  stage: test
  services:
    - name: mariadb:11.4
      alias: db
  variables:
    MARIADB_DATABASE: drupal_test
    MARIADB_ROOT_PASSWORD: root
    SIMPLETEST_DB: mysql://root:root@db/drupal_test
    SIMPLETEST_BASE_URL: http://localhost
  script:
    - composer install --no-progress
    - vendor/bin/phpunit -c web/core/phpunit.xml.dist web/modules/custom
  artifacts:
    when: always
    reports:
      junit: junit.xml          # test results shown in MR widget

services: starts sidecar containers (database, redis) reachable by alias.

---

Deploying with drush

deploy_prod:
  stage: deploy
  environment:
    name: production
    url: https://www.example.com
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual              # require a human click for prod
  script:
    - eval $(ssh-agent -s)
    - echo "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
    - ssh deploy@prod.example.com "cd /var/www/site && git pull --ff-only
        && composer install --no-dev --optimize-autoloader
        && vendor/bin/drush deploy -y"

drush deploy runs updb → config:import → cache:rebuild in the right order. Store SSH_PRIVATE_KEY as a masked, protected CI/CD variable (Settings → CI/CD → Variables) — never in the repository.

environment: makes deployments visible under Operations → Environments and enables rollback tracking.

---

Reuse — include and needs

include:
  - local: .gitlab/ci/common.yml                  # split big configs
  - component: gitlab.com/components/sast/sast@main   # CI/CD component

phpunit:
  needs: ["phpcs"]      # DAG: start as soon as phpcs passes, skip stage wait

needs: builds a directed acyclic graph so independent jobs don't wait for their whole previous stage.

---

Troubleshooting

| Symptom | Fix | |---|---| | Job never appears in pipeline | A rules: entry filtered it out — check $CI_PIPELINE_SOURCE for the trigger type | | "This job is stuck" | No runner with matching tags:; check runner availability | | Composer re-downloads everything each run | Cache key/path mismatch — cache vendor/ and $COMPOSER_CACHE_DIR, key on composer.lock | | PHPUnit cannot connect to DB | Service alias must match host in SIMPLETEST_DB; wait for DB startup or use healthcheck-aware images | | Masked variable prints as [MASKED] but auth fails | Variable contains newline/CR — for SSH keys use tr -d '\r' and file-type variables | | Pipeline runs twice per MR push | Branch + MR pipelines both enabled — use workflow: rules: to keep one |

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: siva01c
• Source: siva01c/claude-plugins
• License: MIT

Install and usage instructions live in the source repository linked above.