# Day  6 : Variables, Secrets, Artifacts & Complete CI/CD Workflow 

**Master GitLab CI/CD Variables, Secrets Management, Artifacts & Best Practices**

### 📖 Introduction

In the previous article, we learned how GitLab Runners execute CI/CD pipelines and how to configure Self-Hosted Runners.

Now it's time to learn one of the most important topics in GitLab CI/CD—**Variables, Secrets, and Artifacts**.

Instead of hardcoding sensitive information like API keys, passwords, or cloud credentials, GitLab provides a secure way to manage them using CI/CD Variables. You'll also learn how to store build outputs using Artifacts and follow best practices for building secure and maintainable pipelines.

By the end of this article, you'll be able to create more secure, production-ready GitLab CI/CD pipelines.

### 🎯 What You'll Learn

After completing this article, you'll understand:

*   ✅ What are CI/CD Variables?
    
*   ✅ Protected Variables
    
*   ✅ Masked Variables
    
*   ✅ Expanded Variables
    
*   ✅ Secrets Management
    
*   ✅ Artifacts
    
*   ✅ Artifact Expiry
    
*   ✅ Common CI/CD Errors
    
*   ✅ CI/CD Best Practices
    

### 📚 Prerequisites

Before continuing, make sure you have:

*   A GitLab account
    
*   A GitLab repository
    
*   A working GitLab CI/CD pipeline
    
*   Basic knowledge of GitLab CI/CD
    

### 🔐 What are CI/CD Variables?

CI/CD Variables are key-value pairs used to store configuration values and sensitive information securely. Instead of hardcoding values inside the `.gitlab-ci.yml` file, you can store them as variables and use them during pipeline execution.

For example, instead of writing an API key directly in your pipeline, you can reference it as a variable.

```yaml
variables:
  APP_NAME: "GitLab Practice"

build:
  script:
    - echo $APP_NAME
```

![](https://cdn.hashnode.com/uploads/covers/685cdc0d5ca95e55fac3ab09/5f8b21ec-655a-4691-9ac0-0ab12af2c21b.png align="center")

![](https://cdn.hashnode.com/uploads/covers/685cdc0d5ca95e55fac3ab09/f503473a-b9cc-49da-97a1-4c4ef28e2589.png align="center")

![](https://cdn.hashnode.com/uploads/covers/685cdc0d5ca95e55fac3ab09/c1c4091a-69cb-49c8-9c97-95db42d1428e.png align="center")

### 🛡️ Protected Variables

Protected Variables are only available to pipelines running on **protected branches** or **protected tags**.

They are commonly used for production credentials such as:

*   Production API Keys
    
*   Database Passwords
    
*   Cloud Credentials
    

This prevents sensitive data from being exposed in feature branches.

### 🙈 Masked Variables

Masked Variables hide sensitive values from pipeline logs.

For example, if a variable contains an API key or password, GitLab replaces the actual value with `****` in the job logs.

This helps prevent accidental exposure of secrets.

### 🔄 Expanded Variables

Expanded Variables allow one variable to reference another.

Example:

```yaml
variables:
  APP_NAME: "gitlab-app"
  IMAGE_NAME: "$APP_NAME:v1"
```

GitLab automatically expands the referenced value during pipeline execution.

### 🔑 Secrets Management

Sensitive information such as passwords, API keys, AWS credentials, and database URLs should never be stored directly in your repository.

Instead, save them in **Settings → CI/CD → Variables** and reference them inside your pipeline.

```yaml
deploy:
  script:
    - echo "$AWS_ACCESS_KEY_ID"
```

### 📦 Artifacts

Artifacts are files generated during a pipeline that can be stored and downloaded after a job completes.

Common examples include:

*   Build output
    
*   Reports
    
*   Log files
    
*   Test results
    

Example:

```yaml
build:
  script:
    - mkdir dist
    - echo "Build Complete" > dist/output.txt

  artifacts:
    paths:
      - dist/
```

### ⏳ Artifact Expiry

Artifacts can be configured to expire automatically after a specific period.

```yaml
artifacts:
  paths:
    - dist/
  expire_in: 7 days
```

![](https://cdn.hashnode.com/uploads/covers/685cdc0d5ca95e55fac3ab09/701fcf30-87a4-481f-910b-a952ec9ded94.png align="center")

![](https://cdn.hashnode.com/uploads/covers/685cdc0d5ca95e55fac3ab09/b1b6cad0-a099-499f-9ac3-de75d6cbd2f6.png align="center")

### ⚠️ Common CI/CD Errors

Some common issues you may encounter include:

*   **Invalid** `.gitlab-ci.yml` **syntax**
    
*   **Runner Offline**
    
*   **Missing CI/CD Variables**
    
*   **Permission Denied**
    
*   **Pipeline Failed**
    

Review the pipeline logs to identify and resolve these errors quickly.

### ✅ Best Practices

*   Store secrets using CI/CD Variables.
    
*   Never hardcode passwords or tokens.
    
*   Use Protected Variables for production.
    
*   Mask sensitive credentials.
    
*   Configure artifact expiry.
    
*   Validate your `.gitlab-ci.yml` before deployment.
    

### 🎯 Summary

Congratulations! 🎉 You have completed **Day 6** of the GitLab learning series.

In this article, you learned how to securely manage **CI/CD Variables**, protect sensitive information using **Protected** and **Masked Variables**, use **Artifacts** to store build outputs, configure **Artifact Expiry**, and follow CI/CD best practices for production-ready pipelines.

## 🎉 Congratulations!

You have successfully completed the **GitLab DevOps Learning Series**.

You now have a solid understanding of GitLab fundamentals, repositories, CI/CD pipelines, GitLab Runners, Variables, Secrets, and Artifacts. These concepts provide a strong foundation for building secure and production-ready DevOps workflows using GitLab.