Day 6 : Variables, Secrets, Artifacts & Complete CI/CD Workflow

Master GitLab CI/CD Variables, Secrets Management, Artifacts & Best Practices

📖 Introduction

In the previous article, we learned how GitLab Runners execute CI/CD pipelines and how to configure Self-Hosted Runners.

Now it's time to learn one of the most important topics in GitLab CI/CD—Variables, Secrets, and Artifacts.

Instead of hardcoding sensitive information like API keys, passwords, or cloud credentials, GitLab provides a secure way to manage them using CI/CD Variables. You'll also learn how to store build outputs using Artifacts and follow best practices for building secure and maintainable pipelines.

By the end of this article, you'll be able to create more secure, production-ready GitLab CI/CD pipelines.

🎯 What You'll Learn

After completing this article, you'll understand:

• ✅ What are CI/CD Variables?

• ✅ Protected Variables

• ✅ Masked Variables

• ✅ Expanded Variables

• ✅ Secrets Management

• ✅ Artifacts

• ✅ Artifact Expiry

• ✅ Common CI/CD Errors

• ✅ CI/CD Best Practices

📚 Prerequisites

Before continuing, make sure you have:

• A GitLab account

• A GitLab repository

• A working GitLab CI/CD pipeline

• Basic knowledge of GitLab CI/CD

🔐 What are CI/CD Variables?

CI/CD Variables are key-value pairs used to store configuration values and sensitive information securely. Instead of hardcoding values inside the .gitlab-ci.yml file, you can store them as variables and use them during pipeline execution.

For example, instead of writing an API key directly in your pipeline, you can reference it as a variable.

variables:
  APP_NAME: "GitLab Practice"

build:
  script:
    - echo $APP_NAME

🛡️ Protected Variables

Protected Variables are only available to pipelines running on protected branches or protected tags.

They are commonly used for production credentials such as:

• Production API Keys

• Database Passwords

• Cloud Credentials

This prevents sensitive data from being exposed in feature branches.

🙈 Masked Variables

Masked Variables hide sensitive values from pipeline logs.

For example, if a variable contains an API key or password, GitLab replaces the actual value with **** in the job logs.

This helps prevent accidental exposure of secrets.

🔄 Expanded Variables

Expanded Variables allow one variable to reference another.

Example:

variables:
  APP_NAME: "gitlab-app"
  IMAGE_NAME: "$APP_NAME:v1"

GitLab automatically expands the referenced value during pipeline execution.

🔑 Secrets Management

Sensitive information such as passwords, API keys, AWS credentials, and database URLs should never be stored directly in your repository.

Instead, save them in Settings → CI/CD → Variables and reference them inside your pipeline.

deploy:
  script:
    - echo "$AWS_ACCESS_KEY_ID"

📦 Artifacts

Artifacts are files generated during a pipeline that can be stored and downloaded after a job completes.

Common examples include:

• Build output

• Reports

• Log files

• Test results

Example:

build:
  script:
    - mkdir dist
    - echo "Build Complete" > dist/output.txt

  artifacts:
    paths:
      - dist/

⏳ Artifact Expiry

Artifacts can be configured to expire automatically after a specific period.

artifacts:
  paths:
    - dist/
  expire_in: 7 days

⚠️ Common CI/CD Errors

Some common issues you may encounter include:

• Invalid .gitlab-ci.yml syntax

• Runner Offline

• Missing CI/CD Variables

• Permission Denied

• Pipeline Failed

Review the pipeline logs to identify and resolve these errors quickly.

✅ Best Practices

• Store secrets using CI/CD Variables.

• Never hardcode passwords or tokens.

• Use Protected Variables for production.

• Mask sensitive credentials.

• Configure artifact expiry.

• Validate your .gitlab-ci.yml before deployment.

🎯 Summary

Congratulations! 🎉 You have completed Day 6 of the GitLab learning series.

In this article, you learned how to securely manage CI/CD Variables, protect sensitive information using Protected and Masked Variables, use Artifacts to store build outputs, configure Artifact Expiry, and follow CI/CD best practices for production-ready pipelines.

🎉 Congratulations!

You have successfully completed the GitLab DevOps Learning Series.

You now have a solid understanding of GitLab fundamentals, repositories, CI/CD pipelines, GitLab Runners, Variables, Secrets, and Artifacts. These concepts provide a strong foundation for building secure and production-ready DevOps workflows using GitLab.