GitLab CI 面试题

Commit Push --> Pipeline Created --> Stage[build] (并行 jobs) --> Stage[test] (并行 jobs) --> Stage[deploy] (并行 jobs)

stages:          # 定义所有 Stage 及执行顺序
  - build
  - test
  - deploy

variables:       # 全局变量定义
  IMAGE_TAG: $CI_COMMIT_SHORT_SHA

before_script:   # 每个 Job 执行前运行的全局脚本
  - echo "Starting job"

after_script:    # 每个 Job 执行后运行的全局脚本
  - echo "Job finished"

cache:           # 全局缓存配置
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - node_modules/

job_name:        # Job 定义
  stage: build
  script:
    - docker build -t app:$IMAGE_TAG .
  only:
    - main

stages:
  - build
  - test
  - deploy

build_job:
  stage: build
  script: make build

test_job:
  stage: test
  script: make test
  allow_failure: true

deploy_job:
  stage: deploy
  script: make deploy
  when: manual

gitlab-runner register \
  --url https://gitlab.example.com \
  --registration-token $TOKEN \
  --executor docker \
  --description "project-runner-1"

cache:
  key: ${CI_COMMIT_REF_SLUG}
  paths:
    - .m2/repository/

build_job:
  stage: build
  script: mvn package
  artifacts:
    paths:
      - target/*.jar
    expire_in: 30 days

job:
  script: echo "Hello"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: always
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual
    - when: never

# 旧语法
job:
  only:
    - main
  except:
    - tags

# 等价新语法
job:
  rules:
    - if: $CI_COMMIT_TAG
      when: never
    - if: $CI_COMMIT_BRANCH == "main"
      when: always

build_job:
  stage: build
  artifacts:
    paths:
      - dist/

deploy_job:
  stage: deploy
  needs:
    - build_job
  script:
    - ls dist/

deploy_job:
  stage: deploy
  dependencies:
    - build_job
  script:
    - deploy.sh

image: docker:20.10.16

services:
  - docker:20.10.16-dind

variables:
  DOCKER_TLS_CERTDIR: "/certs"

build_image:
  stage: build
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

build_image:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - /kaniko/executor
      --context $CI_PROJECT_DIR
      --dockerfile $CI_PROJECT_DIR/Dockerfile
      --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

deploy_k8s:
  stage: deploy
  image: bitnami/kubectl:latest
  script:
    - kubectl set image deployment/app app=$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - kubectl rollout status deployment/app
  environment:
    name: production

deploy_helm:
  stage: deploy
  image: alpine/helm:latest
  script:
    - helm upgrade --install app ./chart
      --set image.tag=$CI_COMMIT_SHORT_SHA
      --namespace production
  environment:
    name: staging

workflow:
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      variables:
        DEPLOY_ENV: "production"
    - if: $CI_COMMIT_BRANCH =~ /^feature/
      variables:
        DEPLOY_ENV: "review"
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH =~ /^release/
      variables:
        DEPLOY_ENV: "staging"

# 受保护变量注入
deploy_prod:
  stage: deploy
  script:
    - echo $PROD_API_KEY  # 仅在 main 分支 Pipeline 中可见，日志 masked
  environment: production
  only:
    - main

include:
  - template: Security/Secret-Detection.gitlab-ci.yml

secret_detection:
  stage: test
  variables:
    SECRET_DETECTION_HISTORIC_SCAN: "true"

test_job:
  stage: test
  script: npm test
  parallel: 5
  needs: ["build_job"]
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - node_modules/

curl -X POST \
  -F token=$CI_JOB_TOKEN \
  -F ref=main \
  -F variables[DEPLOY_ENV]=production \
  https://gitlab.example.com/api/v4/projects/$PROJECT_ID/trigger/pipeline

trigger_downstream:
  stage: deploy
  trigger:
    project: mygroup/downstream-project
    branch: main
    strategy: depend

concurrent = 10

[[runners]]
  name = "docker-runner"
  url = "https://gitlab.example.com"
  token = "xxxx"
  executor = "docker"
  limit = 5
  [runners.docker]
    image = "alpine:latest"

deploy_job:
  stage: deploy
  script: deploy.sh
  resource_group: production

pages:
  stage: deploy
  script:
    - npm install
    - npm run build
  artifacts:
    paths:
      - public/
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

# Jekyll
image: ruby:2.7
pages:
  script:
    - gem install jekyll
    - jekyll build -d public/

# 项目 Settings > CI/CD > Auto DevOps 开启
# 或显式 include 模板
include:
  - template: Auto-DevOps.gitlab-ci.yml

test_job:
  stage: test
  parallel:
    matrix:
      - OS: ["ubuntu", "centos", "alpine"]
        VERSION: ["18", "20"]
  script:
    - docker build -t app:${OS}-${VERSION} -f Dockerfile.${OS} .
    - docker run app:${OS}-${VERSION} test

script:
  - echo "Testing on $OS version $VERSION"

build_image:
  stage: build
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

# 注册第一个 Runner
gitlab-runner register \
  --non-interactive \
  --url https://gitlab.example.com \
  --registration-token TOKEN_A \
  --executor docker \
  --description "runner-project-a" \
  --tag-list "project-a,node14" \
  --run-untagged="false"

# 注册第二个 Runner
gitlab-runner register \
  --non-interactive \
  --url https://gitlab.example.com \
  --registration-token TOKEN_B \
  --executor docker \
  --description "runner-project-b" \
  --tag-list "project-b,node16" \
  --run-untagged="false"

concurrent = 8

[[runners]]
  name = "runner-project-a"
  url = "https://gitlab.example.com"
  token = "token-a"
  executor = "docker"
  tag_list = ["project-a"]

[[runners]]
  name = "runner-project-b"
  url = "https://gitlab.example.com"
  token = "token-b"
  executor = "docker"
  tag_list = ["project-b"]

deploy_job:
  stage: deploy
  script: deploy.sh
  environment:
    name: production
    url: https://app.example.com

review_deploy:
  stage: deploy
  script:
    - helm upgrade --install review-$CI_MERGE_REQUEST_IID ./chart
      --namespace review
  environment:
    name: review/$CI_MERGE_REQUEST_IID
    url: https://review-$CI_MERGE_REQUEST_IID.example.com
    on_stop: review_cleanup
  rules:
    - if: $CI_MERGE_REQUEST_ID

review_cleanup:
  stage: deploy
  script:
    - helm uninstall review-$CI_MERGE_REQUEST_IID
  environment:
    name: review/$CI_MERGE_REQUEST_IID
    action: stop
  needs:
    - review_deploy
  rules:
    - if: $CI_MERGE_REQUEST_ID
      when: manual

build_job:
  stage: build
  script: make build

test_unit:
  stage: test
  script: make test-unit

test_integration:
  stage: test
  script: make test-integration
  needs:
    - build_job

deploy_staging:
  stage: deploy
  script: deploy-staging.sh
  needs:
    - test_unit
    - test_integration

graph LR
    build_job --> test_unit --> deploy_staging
    build_job --> test_integration
    test_integration --> deploy_staging

deploy_blue:
  stage: deploy
  script: deploy-blue.sh
  resource_group: production
  environment:
    name: production

deploy_green:
  stage: deploy
  script: deploy-green.sh
  resource_group: production
  environment:
    name: production

include:
  - local: '/templates/.build-template.yml'
  - project: 'shared/templates'
    file: '/ci-templates/.docker-template.yml'
    ref: v1.0
  - remote: 'https://gitlab.com/example/template.yml'
  - template: 'Security/SAST.gitlab-ci.yml'

workflow:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_TAG =~ /^v\d+\.\d+\.\d+/
    - if: $CI_COMMIT_BRANCH == "main"
    - if: $CI_COMMIT_BRANCH =~ /^feature/
      variables:
        SKIP_DEPLOY: "true"
    - if: $CI_PIPELINE_SOURCE == "schedule"
      variables:
        NIGHTLY_BUILD: "true"
    - when: never

long_test:
  stage: test
  script: make long-test
  timeout: 30 minutes
  retry:
    max: 2
    when:
      - runner_system_failure
      - stuck_or_timeout_failure
      - unknown_failure

Git Push (manifests update) --> Pipeline --> kubectl apply / Helm upgrade --> Cluster state reconciliation

# .gitlab/agents/my-agent/config.yaml
gitops:
  manifest_projects:
    - id: mygroup/myproject
      default_namespace: production
      paths:
        - glob: "manifests/**/*.yaml"

sync_cluster:
  stage: deploy
  image: bitnami/kubectl
  script:
    - kubectl apply -f manifests/
    - kubectl wait --for=condition=Ready pods --all --timeout=300s
  environment:
    name: production
  only:
    - main

image: docker:20.10.16

variables:
  DOCKER_HOST: tcp://docker:2376
  DOCKER_TLS_CERTDIR: "/certs"
  DOCKER_DRIVER: overlay2

services:
  - name: docker:20.10.16-dind
    command: ["--tls=false"]

build:
  stage: build
  script:
    - docker build -t app:$CI_COMMIT_SHORT_SHA .
    - docker push app:$CI_COMMIT_SHORT_SHA

Runner Host
  └── Docker Container (Job)
        ├── docker CLI
        └── Service Container (docker:dind)
              └── Docker Daemon (绑定 /var/run/docker.sock)

build_job:
  stage: build
  script: mvn package
  artifacts:
    paths:
      - target/*.jar
    expire_in: 30 days

build_linux:
  stage: build
  tags:
    - linux
    - docker
  script: make build

build_macos:
  stage: build
  tags:
    - macos
    - shell
  script: xcodebuild

# 项目 Settings > CI/CD > Variables
# Name: DB_PASSWORD
# Value: xxxxxx
# Protected: true
# Masked: true
# Environment: production

# 存储 SSH_PRIVATE_KEY 为 File 类型变量
before_script:
  - chmod 400 $SSH_PRIVATE_KEY
  - ssh -i $SSH_PRIVATE_KEY user@host

# 全局 Cache
cache:
  key:
    files:
      - package-lock.json
    prefix: npm-cache
  paths:
    - node_modules/
  policy: pull-push

# Job 级别覆盖
test_job:
  stage: test
  cache:
    key: test-${CI_COMMIT_REF_SLUG}
    paths:
      - node_modules/
    policy: pull

stages: [build, test, lint, package, deploy]

compile:
  stage: build
  script: make compile

unit_test:
  stage: test
  script: make test

lint:
  stage: lint
  script: make lint

package:
  stage: package
  script: make package
  needs: [compile]

integration_test:
  stage: test
  script: make integration
  needs: [compile]

deploy:
  stage: deploy
  script: deploy.sh
  needs: [package, unit_test, lint, integration_test]

graph LR
    compile --> lint
    compile --> unit_test
    compile --> integration_test
    compile --> package
    lint --> deploy
    unit_test --> deploy
    integration_test --> deploy
    package --> deploy

# MR Pipeline
test_in_mr:
  stage: test
  script: make test
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

# Merged Results Pipeline
# 需要项目 Settings > Merge Requests > Merge checks 开启

include:
  - template: Security/Secret-Detection.gitlab-ci.yml

secret_detection:
  stage: test
  variables:
    SECRET_DETECTION_HISTORIC_SCAN: "true"
    GIT_DEPTH: 0

# .gitlab/agents/my-agent/config.yaml
ci_access:
  projects:
    - id: mygroup/myproject

gitops:
  manifest_projects:
    - id: mygroup/myproject
      default_namespace: production

deploy_with_agent:
  stage: deploy
  variables:
    KUBE_CONTEXT: mygroup/myproject:my-agent
  script:
    - kubectl apply -f manifests/
    - kubectl rollout status deployment/app

# 变量设为 Masked（日志自动替换）
# 变量设为 File 类型（写入临时文件，避免命令行传递）

before_script:
  - export MASKED_VAR=$MY_SECRET

test_job:
  stage: test
  variables:
    MY_SECRET: ""  # 覆盖为全局变量，Job 内不可见
  script:
    - echo $MY_SECRET  # 输出为空

graph TD
    A[User Push Code] --> B[GitLab Rails - Web UI + API]
    B --> C[Workhorse - 请求代理]
    B --> D[Sidekiq - 异步任务队列]
    B --> E[Runner - Job 执行]
    D --> F[Pipeline 创建和调度]
    E --> G[Executor - Docker / K8s / Shell / SSH]