Master GitLab CI/CD Variables, Secrets Management, Artifacts & Best Practices
📖 Introduction
In the previous article, we learned how GitLab Runners execute CI/CD pipelines and how to configure Self-Hosted Runners.
Now it's time to learn one of the most important topics in GitLab CI/CD—Variables, Secrets, and Artifacts.
Instead of hardcoding sensitive information like API keys, passwords, or cloud credentials, GitLab provides a secure way to manage them using CI/CD Variables. You'll also learn how to store build outputs using Artifacts and follow best practices for building secure and maintainable pipelines.
By the end of this article, you'll be able to create more secure, production-ready GitLab CI/CD pipelines.
🎯 What You'll Learn
After completing this article, you'll understand:
📚 Prerequisites
Before continuing, make sure you have:
🔐 What are CI/CD Variables?
CI/CD Variables are key-value pairs used to store configuration values and sensitive information securely. Instead of hardcoding values inside the .gitlab-ci.yml file, you can store them as variables and use them during pipeline execution.
For example, instead of writing an API key directly in your pipeline, you can reference it as a variable.
variables:
APP_NAME: "GitLab Practice"
build:
script:
- echo $APP_NAME
🛡️ Protected Variables
Protected Variables are only available to pipelines running on protected branches or protected tags.
They are commonly used for production credentials such as:
Production API Keys
Database Passwords
Cloud Credentials
This prevents sensitive data from being exposed in feature branches.
🙈 Masked Variables
Masked Variables hide sensitive values from pipeline logs.
For example, if a variable contains an API key or password, GitLab replaces the actual value with **** in the job logs.
This helps prevent accidental exposure of secrets.
🔄 Expanded Variables
Expanded Variables allow one variable to reference another.
Example:
variables:
APP_NAME: "gitlab-app"
IMAGE_NAME: "$APP_NAME:v1"
GitLab automatically expands the referenced value during pipeline execution.
🔑 Secrets Management
Sensitive information such as passwords, API keys, AWS credentials, and database URLs should never be stored directly in your repository.
Instead, save them in Settings → CI/CD → Variables and reference them inside your pipeline.
deploy:
script:
- echo "$AWS_ACCESS_KEY_ID"
📦 Artifacts
Artifacts are files generated during a pipeline that can be stored and downloaded after a job completes.
Common examples include:
Build output
Reports
Log files
Test results
Example:
build:
script:
- mkdir dist
- echo "Build Complete" > dist/output.txt
artifacts:
paths:
- dist/
⏳ Artifact Expiry
Artifacts can be configured to expire automatically after a specific period.
artifacts:
paths:
- dist/
expire_in: 7 days
⚠️ Common CI/CD Errors
Some common issues you may encounter include:
Review the pipeline logs to identify and resolve these errors quickly.
✅ Best Practices
Store secrets using CI/CD Variables.
Never hardcode passwords or tokens.
Use Protected Variables for production.
Mask sensitive credentials.
Configure artifact expiry.
Validate your .gitlab-ci.yml before deployment.
🎯 Summary
Congratulations! 🎉 You have completed Day 6 of the GitLab learning series.
In this article, you learned how to securely manage CI/CD Variables, protect sensitive information using Protected and Masked Variables, use Artifacts to store build outputs, configure Artifact Expiry, and follow CI/CD best practices for production-ready pipelines.
🎉 Congratulations!
You have successfully completed the GitLab DevOps Learning Series.
You now have a solid understanding of GitLab fundamentals, repositories, CI/CD pipelines, GitLab Runners, Variables, Secrets, and Artifacts. These concepts provide a strong foundation for building secure and production-ready DevOps workflows using GitLab.
