GitLab CI

gitlab-ciCI/CD32 lines

Pipelines defined in .gitlab-ci.yml with built-in environments and approvals.

Current — as published in v1.3.2. Written by hand for GitLab CI, not generated.

The rule

Variables

Secrets live in Settings → CI/CD → Variables, never in .gitlab-ci.yml.
Mark every secret Masked (hidden in logs) and Protected (available only to protected branches and tags). Both switches matter and they do different things.
Never unprotect a variable so a fork merge request can use it — that is the leak the setting exists to prevent.

Pipelines

interruptible: true so a new push cancels superseded pipelines.
rules rather than the older only/except.
Cache keyed on the lockfile, caching the package manager's cache directory — not node_modules itself.

Deployment

Production deploys are when: manual, against a protected environment.
A green pipeline means the code is safe to ship, not that now is the moment.

Runners

Jobs touching production credentials run on project runners, not shared ones.
Shared runners execute your job on infrastructure you do not control.

Never

Never echo a variable to debug it — that defeats masking.
Never commit a credential and rely on history rewriting; rotate it instead.

As each tool receives it

The same guidance, in the shape each editor reads. Cursor and Claude Code are written separately by hand; the rest are derived from the Cursor rule.

→ .cursor/rules/gitlab-ci.mdchand-written for this tool

.cursor/rules/gitlab-ci.mdc

---
description: GitLab CI conventions
globs: [".gitlab-ci.yml", "ci/**"]
alwaysApply: false
---

# GitLab CI

## Variables

- Secrets live in **Settings → CI/CD → Variables**, never in `.gitlab-ci.yml`.
- Mark every secret **Masked** (hidden in logs) and **Protected** (available
  only to protected branches and tags). Both switches matter and they do
  different things.
- Never unprotect a variable so a fork merge request can use it — that is the
  leak the setting exists to prevent.

## Pipelines

- `interruptible: true` so a new push cancels superseded pipelines.
- `rules` rather than the older `only`/`except`.
- Cache keyed on the lockfile, caching the package manager's cache directory —
  not `node_modules` itself.

## Deployment

- Production deploys are `when: manual`, against a protected environment.
- A green pipeline means the code is safe to ship, not that now is the moment.

## Runners

- Jobs touching production credentials run on project runners, not shared ones.
- Shared runners execute your job on infrastructure you do not control.

## Never

- Never `echo` a variable to debug it — that defeats masking.
- Never commit a credential and rely on history rewriting; rotate it instead.

What else this module writes

Selecting GitLab CI contributes more than a rule file — all of it merged with every other module you pick, with conflicts resolved rather than duplicated.

Environment

CIoptionalSet by the runner. Use it to skip prompts and enable machine-readable output.

conflicts withGitHub Actions

Put this in your repo

Adds GitLab CI to a project this tool generated, without starting over. Files you have hand-edited are left alone.