GitLab CI/CD Integration

GitLab CI/CD provides enterprise-grade continuous integration and deployment workflows that integrate seamlessly with CloudRepo for publishing and consuming artifacts across all supported package types.

This guide covers complete integration patterns for Maven, Gradle, Python (pip, setuptools, Poetry, UV, Pixi), Clojure, and Scala projects, along with advanced pipeline patterns and security best practices.

Benefits & Overview

Why Use CloudRepo with GitLab CI

Cost Effective: Save 90%+ compared to JFrog Artifactory with no egress fees
Native Integration: Works seamlessly with all build tools and package managers
Enterprise Security: Use GitLab CI variables with masking and protection
Performance: Leverage GitLab Runner caching for faster builds
Support Included: All CloudRepo plans include professional support
Compliance Ready: Audit trails and access controls for regulated environments

Repository URL Format

All CloudRepo repositories follow this URL pattern:

https://[organization-id].mycloudrepo.io/repositories/[repository-id]

Replace [organization-id] and [repository-id] with your actual values throughout this guide.

Setting Up GitLab CI Variables

Project-Level Variables

Configure CloudRepo credentials as protected, masked variables:

Navigate to Settings → CI/CD → Variables
Add the following variables:
- CLOUDREPO_USERNAME: Your CloudRepo username
  - Type: Variable
  - Protected: ✓ (only expose to protected branches/tags)
  - Masked: ✓ (hide value in job logs)
- CLOUDREPO_PASSWORD: Your CloudRepo password
  - Type: Variable
  - Protected: ✓
  - Masked: ✓
  - Consider using a CloudRepo API token for enhanced security
Optional repository-specific variables:
- CLOUDREPO_MAVEN_URL: Maven repository URL
- CLOUDREPO_PYTHON_URL: Python repository URL
- CLOUDREPO_RAW_URL: Raw repository URL

Group-Level Variables

For multiple projects, configure variables at the group level:

Navigate to Group Settings → CI/CD → Variables
Add the same variables as above
Configure project inheritance as needed

Environment-Specific Variables

Use GitLab environments for staging and production deployments:

.gitlab-ci.yml - Environment-specific deployment

stages:
  - build
  - deploy

deploy-staging:
  stage: deploy
  environment:
    name: staging
    url: https://staging.example.com
  variables:
    CLOUDREPO_URL: $CLOUDREPO_STAGING_URL
  script:
    - echo "Deploying to staging repository"
    - mvn deploy -DaltDeploymentRepository=cloudrepo::default::$CLOUDREPO_URL
  only:
    - develop

deploy-production:
  stage: deploy
  environment:
    name: production
    url: https://production.example.com
  variables:
    CLOUDREPO_URL: $CLOUDREPO_PRODUCTION_URL
  script:
    - echo "Deploying to production repository"
    - mvn deploy -DaltDeploymentRepository=cloudrepo::default::$CLOUDREPO_URL
  only:
    - tags
  when: manual

Maven Workflows

Basic Maven Publishing

.gitlab-ci.yml - Basic Maven deployment

image: maven:3.9-eclipse-temurin-17

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
  MAVEN_CLI_OPTS: "--batch-mode --errors --fail-at-end --show-version"

cache:
  paths:
    - .m2/repository/
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

stages:
  - build
  - test
  - deploy

build:
  stage: build
  script:
    - mvn $MAVEN_CLI_OPTS compile
  artifacts:
    paths:
      - target/
    expire_in: 1 hour

test:
  stage: test
  script:
    - mvn $MAVEN_CLI_OPTS test
  artifacts:
    reports:
      junit:
        - target/surefire-reports/TEST-*.xml

deploy:
  stage: deploy
  script:
    - |
      cat > settings.xml << EOF
      <settings>
        <servers>
          <server>
            <id>cloudrepo</id>
            <username>${CLOUDREPO_USERNAME}</username>
            <password>${CLOUDREPO_PASSWORD}</password>
          </server>
        </servers>
      </settings>
      EOF
    - mvn $MAVEN_CLI_OPTS deploy -s settings.xml
  only:
    - main
    - tags

Maven with pom.xml Configuration

Configure your pom.xml for CloudRepo:

pom.xml - Distribution management

<project>
  <!-- ... other configuration ... -->

  <distributionManagement>
    <repository>
      <id>cloudrepo</id>
      <name>CloudRepo Maven Repository</name>
      <url>https://myorg.mycloudrepo.io/repositories/maven-releases</url>
    </repository>
    <snapshotRepository>
      <id>cloudrepo</id>
      <name>CloudRepo Maven Snapshots</name>
      <url>https://myorg.mycloudrepo.io/repositories/maven-snapshots</url>
    </snapshotRepository>
  </distributionManagement>
</project>

SNAPSHOT vs Release Workflows

.gitlab-ci.yml - Separate SNAPSHOT and release pipelines

deploy-snapshot:
  stage: deploy
  script:
    - echo "Deploying SNAPSHOT to CloudRepo"
    - |
      cat > settings.xml << EOF
      <settings>
        <servers>
          <server>
            <id>cloudrepo-snapshots</id>
            <username>${CLOUDREPO_USERNAME}</username>
            <password>${CLOUDREPO_PASSWORD}</password>
          </server>
        </servers>
      </settings>
      EOF
    - mvn deploy -s settings.xml -DaltSnapshotDeploymentRepository=cloudrepo-snapshots::default::https://myorg.mycloudrepo.io/repositories/maven-snapshots
  only:
    - develop
    - /^feature\/.*$/

deploy-release:
  stage: deploy
  script:
    - echo "Deploying release to CloudRepo"
    - |
      # Ensure version doesn't contain SNAPSHOT
      VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
      if [[ "$VERSION" == *"SNAPSHOT"* ]]; then
        echo "Error: Cannot deploy SNAPSHOT version as release"
        exit 1
      fi
    - |
      cat > settings.xml << EOF
      <settings>
        <servers>
          <server>
            <id>cloudrepo-releases</id>
            <username>${CLOUDREPO_USERNAME}</username>
            <password>${CLOUDREPO_PASSWORD}</password>
          </server>
        </servers>
      </settings>
      EOF
    - mvn deploy -s settings.xml -DaltDeploymentRepository=cloudrepo-releases::default::https://myorg.mycloudrepo.io/repositories/maven-releases
  only:
    - tags

Multi-Module Maven Projects

.gitlab-ci.yml - Multi-module Maven project

image: maven:3.9-eclipse-temurin-17

variables:
  MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository -Dorg.slf4j.simpleLogger.showDateTime=true"

cache:
  paths:
    - .m2/repository/
  key:
    files:
      - pom.xml
      - "**/pom.xml"

stages:
  - build
  - test
  - deploy

build-all-modules:
  stage: build
  script:
    - mvn clean compile -pl :parent,:module-a,:module-b,:module-common
  artifacts:
    paths:
      - "*/target/"
    expire_in: 1 hour

test-modules:
  stage: test
  parallel:
    matrix:
      - MODULE: [module-a, module-b, module-common]
  script:
    - mvn test -pl :$MODULE
  artifacts:
    reports:
      junit:
        - "$MODULE/target/surefire-reports/TEST-*.xml"

deploy-modules:
  stage: deploy
  script:
    - |
      cat > settings.xml << EOF
      <settings>
        <servers>
          <server>
            <id>cloudrepo</id>
            <username>${CLOUDREPO_USERNAME}</username>
            <password>${CLOUDREPO_PASSWORD}</password>
          </server>
        </servers>
      </settings>
      EOF
    - mvn deploy -s settings.xml -DskipTests
  only:
    - main
    - tags

Gradle Workflows

Basic Gradle Publishing

.gitlab-ci.yml - Gradle deployment

image: gradle:8.5-jdk17

variables:
  GRADLE_OPTS: "-Dorg.gradle.daemon=false"
  GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle"

cache:
  key: "$CI_COMMIT_REF_SLUG"
  paths:
    - .gradle/caches/
    - .gradle/wrapper/

stages:
  - build
  - test
  - publish

build:
  stage: build
  script:
    - gradle assemble
  artifacts:
    paths:
      - build/libs/
    expire_in: 1 hour

test:
  stage: test
  script:
    - gradle test
  artifacts:
    reports:
      junit:
        - build/test-results/test/**/TEST-*.xml

publish:
  stage: publish
  script:
    - gradle publish -PcloudrepoUsername=$CLOUDREPO_USERNAME -PcloudrepoPassword=$CLOUDREPO_PASSWORD
  only:
    - main
    - tags

Gradle build.gradle Configuration

build.gradle - Publishing configuration

plugins {
    id 'java'
    id 'maven-publish'
}

group = 'com.example'
version = '1.0.0'

publishing {
    publications {
        maven(MavenPublication) {
            from components.java
        }
    }
    repositories {
        maven {
            name = 'cloudrepo'
            url = version.endsWith('SNAPSHOT')
                ? 'https://myorg.mycloudrepo.io/repositories/gradle-snapshots'
                : 'https://myorg.mycloudrepo.io/repositories/gradle-releases'
            credentials {
                username = project.findProperty('cloudrepoUsername') ?: System.getenv('CLOUDREPO_USERNAME')
                password = project.findProperty('cloudrepoPassword') ?: System.getenv('CLOUDREPO_PASSWORD')
            }
        }
    }
}

Gradle Kotlin DSL

build.gradle.kts - Kotlin DSL publishing

plugins {
    kotlin("jvm") version "1.9.22"
    `maven-publish`
}

group = "com.example"
version = "1.0.0"

publishing {
    publications {
        create<MavenPublication>("maven") {
            from(components["java"])
        }
    }
    repositories {
        maven {
            name = "cloudrepo"
            url = uri(
                if (version.toString().endsWith("SNAPSHOT")) {
                    "https://myorg.mycloudrepo.io/repositories/gradle-snapshots"
                } else {
                    "https://myorg.mycloudrepo.io/repositories/gradle-releases"
                }
            )
            credentials {
                username = findProperty("cloudrepoUsername")?.toString()
                    ?: System.getenv("CLOUDREPO_USERNAME")
                password = findProperty("cloudrepoPassword")?.toString()
                    ?: System.getenv("CLOUDREPO_PASSWORD")
            }
        }
    }
}

Python Workflows

Publishing with pip/setuptools

.gitlab-ci.yml - Python setuptools deployment

image: python:3.11

cache:
  paths:
    - .cache/pip
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

stages:
  - test
  - build
  - publish

test:
  stage: test
  script:
    - pip install -e .[test]
    - pytest tests/ --junitxml=report.xml
  artifacts:
    reports:
      junit: report.xml

build:
  stage: build
  script:
    - pip install build
    - python -m build
  artifacts:
    paths:
      - dist/
    expire_in: 1 hour

publish-to-cloudrepo:
  stage: publish
  script:
    - pip install twine
    - |
      cat > ~/.pypirc << EOF
      [distutils]
      index-servers = cloudrepo

      [cloudrepo]
      repository = https://myorg.mycloudrepo.io/repositories/python
      username = ${CLOUDREPO_USERNAME}
      password = ${CLOUDREPO_PASSWORD}
      EOF
    - twine upload -r cloudrepo dist/*
  only:
    - tags

Publishing with Poetry

.gitlab-ci.yml - Poetry deployment

image: python:3.11

variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  POETRY_HOME: "$CI_PROJECT_DIR/.poetry"
  POETRY_VIRTUALENVS_IN_PROJECT: "true"

cache:
  paths:
    - .cache/pip
    - .poetry
    - .venv
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

before_script:
  - curl -sSL https://install.python-poetry.org | python3 -
  - export PATH="$POETRY_HOME/bin:$PATH"
  - poetry --version

stages:
  - test
  - build
  - publish

test:
  stage: test
  script:
    - poetry install --with test
    - poetry run pytest tests/ --junitxml=report.xml
  artifacts:
    reports:
      junit: report.xml

build:
  stage: build
  script:
    - poetry build
  artifacts:
    paths:
      - dist/
    expire_in: 1 hour

publish-to-cloudrepo:
  stage: publish
  script:
    - |
      poetry config repositories.cloudrepo https://myorg.mycloudrepo.io/repositories/python
      poetry config http-basic.cloudrepo ${CLOUDREPO_USERNAME} ${CLOUDREPO_PASSWORD}
    - poetry publish -r cloudrepo
  only:
    - tags

Publishing with UV (Ultra-Fast)

.gitlab-ci.yml - UV deployment

image: python:3.11

variables:
  UV_CACHE_DIR: "$CI_PROJECT_DIR/.cache/uv"
  UV_SYSTEM_PYTHON: "1"

cache:
  paths:
    - .cache/uv
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

before_script:
  - curl -LsSf https://astral.sh/uv/install.sh | sh
  - source $HOME/.cargo/env
  - uv --version

stages:
  - test
  - build
  - publish

test:
  stage: test
  script:
    - uv pip install -e .[test]
    - uv run pytest tests/ --junitxml=report.xml
  artifacts:
    reports:
      junit: report.xml

build:
  stage: build
  script:
    - uv pip install build
    - uv run python -m build
  artifacts:
    paths:
      - dist/
    expire_in: 1 hour

publish-to-cloudrepo:
  stage: publish
  script:
    - uv pip install twine
    - |
      cat > ~/.pypirc << EOF
      [distutils]
      index-servers = cloudrepo

      [cloudrepo]
      repository = https://myorg.mycloudrepo.io/repositories/python
      username = ${CLOUDREPO_USERNAME}
      password = ${CLOUDREPO_PASSWORD}
      EOF
    - uv run twine upload -r cloudrepo dist/*
  only:
    - tags

Publishing with Pixi

.gitlab-ci.yml - Pixi deployment

image: condaforge/miniforge3:latest

variables:
  PIXI_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pixi"

cache:
  paths:
    - .cache/pixi
    - .pixi
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

before_script:
  - curl -fsSL https://pixi.sh/install.sh | bash
  - export PATH="$HOME/.pixi/bin:$PATH"
  - pixi --version

stages:
  - test
  - build
  - publish

test:
  stage: test
  script:
    - pixi run test
  artifacts:
    reports:
      junit: test-results.xml

build:
  stage: build
  script:
    - pixi run build
  artifacts:
    paths:
      - dist/
    expire_in: 1 hour

publish-to-cloudrepo:
  stage: publish
  script:
    - |
      # Configure pixi to use CloudRepo
      pixi config set-channel cloudrepo https://myorg.mycloudrepo.io/repositories/conda
      pixi auth login cloudrepo --username ${CLOUDREPO_USERNAME} --password ${CLOUDREPO_PASSWORD}
    - pixi upload dist/*.tar.bz2 --channel cloudrepo
  only:
    - tags

Wheel and sdist Distribution

.gitlab-ci.yml - Building both wheel and sdist

build-distributions:
  stage: build
  image: python:3.11
  script:
    - pip install build
    - python -m build --sdist --wheel
    - ls -la dist/
  artifacts:
    paths:
      - dist/*.whl
      - dist/*.tar.gz
    expire_in: 1 week

publish-all-formats:
  stage: publish
  image: python:3.11
  dependencies:
    - build-distributions
  script:
    - pip install twine
    - |
      # Configure CloudRepo repository
      cat > ~/.pypirc << EOF
      [distutils]
      index-servers = cloudrepo

      [cloudrepo]
      repository = https://myorg.mycloudrepo.io/repositories/python
      username = ${CLOUDREPO_USERNAME}
      password = ${CLOUDREPO_PASSWORD}
      EOF
    - |
      # Upload both wheel and source distribution
      echo "Uploading wheel and sdist to CloudRepo..."
      twine upload -r cloudrepo dist/*.whl dist/*.tar.gz
  only:
    - tags

Clojure Workflows

Publishing with Leiningen

.gitlab-ci.yml - Leiningen deployment

image: clojure:temurin-17-lein-2.11.2

cache:
  paths:
    - ~/.m2/repository
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

stages:
  - test
  - deploy

test:
  stage: test
  script:
    - lein test

deploy-to-cloudrepo:
  stage: deploy
  script:
    - |
      # Create credentials file
      mkdir -p ~/.lein
      cat > ~/.lein/credentials.clj << EOF
      {#"cloudrepo" {:username "${CLOUDREPO_USERNAME}"
                     :password "${CLOUDREPO_PASSWORD}"}}
      EOF
      chmod 600 ~/.lein/credentials.clj
    - |
      # Update project.clj with CloudRepo repository
      cat >> project.clj << EOF
      :repositories [["cloudrepo" {:url "https://myorg.mycloudrepo.io/repositories/clojure"
                                   :sign-releases false}]]
      :deploy-repositories [["cloudrepo" {:url "https://myorg.mycloudrepo.io/repositories/clojure"
                                         :sign-releases false
                                         :creds :gpg}]]
      EOF
    - lein deploy cloudrepo
  only:
    - main
    - tags

Publishing with deps.edn and deps-deploy

.gitlab-ci.yml - deps.edn deployment

image: clojure:temurin-17-tools-deps

cache:
  paths:
    - ~/.m2/repository
    - ~/.gitlibs
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

stages:
  - test
  - build
  - deploy

test:
  stage: test
  script:
    - clojure -M:test

build-jar:
  stage: build
  script:
    - clojure -T:build jar
  artifacts:
    paths:
      - target/*.jar
    expire_in: 1 hour

deploy-to-cloudrepo:
  stage: deploy
  dependencies:
    - build-jar
  script:
    - |
      # Create deps.edn with deployment configuration
      cat > deploy-deps.edn << 'EOF'
      {:deps {slipset/deps-deploy {:mvn/version "0.2.2"}}
       :aliases
       {:deploy
        {:exec-fn deps-deploy.deps-deploy/deploy
         :exec-args {:installer :remote
                    :sign-releases? false
                    :repository {"cloudrepo" {:url "https://myorg.mycloudrepo.io/repositories/clojure"}}
                    :coordinates {:group/id "your-group"
                                 :artifact/id "your-artifact"
                                 :version/string "1.0.0"}
                    :jar-file "target/your-artifact-1.0.0.jar"}}}}
      EOF
    - |
      # Set up Maven settings for authentication
      mkdir -p ~/.m2
      cat > ~/.m2/settings.xml << EOF
      <settings>
        <servers>
          <server>
            <id>cloudrepo</id>
            <username>${CLOUDREPO_USERNAME}</username>
            <password>${CLOUDREPO_PASSWORD}</password>
          </server>
        </servers>
      </settings>
      EOF
    - clojure -Sdeps-file deploy-deps.edn -M:deploy
  only:
    - tags

Scala Workflows

Publishing with SBT

.gitlab-ci.yml - SBT deployment

image: hseeberger/scala-sbt:17.0.2_1.6.2_3.1.1

cache:
  paths:
    - ~/.sbt
    - ~/.ivy2/cache
    - ~/.cache/coursier
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

variables:
  SBT_OPTS: "-Dsbt.global.base=sbt-cache/.sbtboot -Dsbt.boot.directory=sbt-cache/.boot -Dsbt.ivy.home=sbt-cache/.ivy"

stages:
  - test
  - publish

test:
  stage: test
  script:
    - sbt clean test

publish-to-cloudrepo:
  stage: publish
  script:
    - |
      # Create credentials file
      mkdir -p ~/.sbt/1.0
      cat > ~/.sbt/1.0/cloudrepo.credentials << EOF
      realm=CloudRepo
      host=myorg.mycloudrepo.io
      user=${CLOUDREPO_USERNAME}
      password=${CLOUDREPO_PASSWORD}
      EOF
    - sbt "set publishTo := Some(\"CloudRepo\" at \"https://myorg.mycloudrepo.io/repositories/scala\")" publish
  only:
    - main
    - tags

Cross-Compilation for Multiple Scala Versions

.gitlab-ci.yml - Scala cross-compilation

image: hseeberger/scala-sbt:17.0.2_1.6.2_3.1.1

cache:
  paths:
    - ~/.sbt
    - ~/.ivy2/cache
  key: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"

stages:
  - test
  - publish

test-cross-versions:
  stage: test
  parallel:
    matrix:
      - SCALA_VERSION: ["2.12.18", "2.13.12", "3.3.1"]
  script:
    - sbt "++$SCALA_VERSION test"

publish-cross-versions:
  stage: publish
  script:
    - |
      # Configure CloudRepo credentials
      mkdir -p ~/.sbt/1.0
      cat > ~/.sbt/1.0/cloudrepo.credentials << EOF
      realm=CloudRepo
      host=myorg.mycloudrepo.io
      user=${CLOUDREPO_USERNAME}
      password=${CLOUDREPO_PASSWORD}
      EOF
    - |
      # Publish for all Scala versions
      sbt +publish
  only:
    - tags

SBT build.sbt Configuration

build.sbt - Publishing configuration

lazy val root = (project in file("."))
  .settings(
    name := "my-scala-library",
    organization := "com.example",
    version := "1.0.0",
    scalaVersion := "2.13.12",
    crossScalaVersions := Seq("2.12.18", "2.13.12", "3.3.1"),

    publishTo := {
      val cloudrepo = "https://myorg.mycloudrepo.io/repositories/"
      if (isSnapshot.value)
        Some("snapshots" at cloudrepo + "scala-snapshots")
      else
        Some("releases" at cloudrepo + "scala-releases")
    },

    credentials += Credentials(Path.userHome / ".sbt" / "1.0" / "cloudrepo.credentials"),

    publishMavenStyle := true,
    publishArtifact in Test := false,
    pomIncludeRepository := { _ => false }
  )

Advanced GitLab CI Features

Pipeline Rules and Conditions

.gitlab-ci.yml - Advanced pipeline rules

workflow:
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
    - if: '$CI_COMMIT_TAG'

variables:
  DEPLOY_TYPE: "snapshot"

.deploy-rules:
  rules:
    - if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
      variables:
        DEPLOY_TYPE: "release"
        REPOSITORY_URL: "https://myorg.mycloudrepo.io/repositories/releases"
    - if: '$CI_COMMIT_BRANCH == "develop"'
      variables:
        DEPLOY_TYPE: "snapshot"
        REPOSITORY_URL: "https://myorg.mycloudrepo.io/repositories/snapshots"
    - if: '$CI_COMMIT_BRANCH =~ /^feature\/.*$/'
      variables:
        DEPLOY_TYPE: "feature"
        REPOSITORY_URL: "https://myorg.mycloudrepo.io/repositories/feature-builds"

deploy:
  extends: .deploy-rules
  stage: deploy
  script:
    - echo "Deploying $DEPLOY_TYPE to $REPOSITORY_URL"
    - mvn deploy -DaltDeploymentRepository=cloudrepo::default::$REPOSITORY_URL

Matrix Builds for Multiple Versions

.gitlab-ci.yml - Matrix builds

test:
  stage: test
  parallel:
    matrix:
      - JAVA: ["11", "17", "21"]
        OS: ["ubuntu", "alpine"]
  image: openjdk:${JAVA}-${OS}
  script:
    - ./gradlew test

publish-matrix:
  stage: deploy
  parallel:
    matrix:
      - TARGET: ["jvm", "android"]
        VERSION: ["7.0", "8.0"]
  script:
    - ./gradlew publish -Ptarget=$TARGET -Pversion=$VERSION

Deployment Environments

.gitlab-ci.yml - Environment deployments

stages:
  - build
  - deploy

.deploy-template:
  stage: deploy
  script:
    - echo "Deploying to $CI_ENVIRONMENT_NAME"
    - |
      REPO_URL="https://myorg.mycloudrepo.io/repositories/${CI_ENVIRONMENT_NAME}"
      mvn deploy -DaltDeploymentRepository=cloudrepo::default::${REPO_URL}

deploy-dev:
  extends: .deploy-template
  environment:
    name: development
    url: https://dev.example.com
  only:
    - develop

deploy-staging:
  extends: .deploy-template
  environment:
    name: staging
    url: https://staging.example.com
    on_stop: stop-staging
  only:
    - main

deploy-production:
  extends: .deploy-template
  environment:
    name: production
    url: https://example.com
  when: manual
  only:
    - tags

stop-staging:
  stage: deploy
  script:
    - echo "Stopping staging environment"
  environment:
    name: staging
    action: stop
  when: manual

Release Automation with Semantic Versioning

.gitlab-ci.yml - Semantic versioning

stages:
  - version
  - build
  - release

calculate-version:
  stage: version
  image: node:18
  script:
    - npm install -g semantic-release @semantic-release/git @semantic-release/gitlab
    - semantic-release --dry-run
  artifacts:
    reports:
      dotenv: version.env

build-and-tag:
  stage: build
  dependencies:
    - calculate-version
  script:
    - echo "Building version ${VERSION}"
    - mvn versions:set -DnewVersion=${VERSION}
    - mvn clean package

create-release:
  stage: release
  image: registry.gitlab.com/gitlab-org/release-cli:latest
  script:
    - echo "Creating release ${VERSION}"
  release:
    tag_name: 'v${VERSION}'
    description: 'Release ${VERSION}'
    assets:
      links:
        - name: 'JAR'
          url: 'https://myorg.mycloudrepo.io/repositories/releases/com/example/app/${VERSION}/app-${VERSION}.jar'

Docker-in-Docker for Containerized Builds

.gitlab-ci.yml - Docker-in-Docker builds

image: docker:24

services:
  - docker:24-dind

variables:
  DOCKER_HOST: tcp://docker:2376
  DOCKER_TLS_CERTDIR: "/certs"
  DOCKER_TLS_VERIFY: 1
  DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"

stages:
  - build
  - test
  - publish

build-in-docker:
  stage: build
  script:
    - |
      # Build application in Docker
      cat > Dockerfile.build << EOF
      FROM maven:3.9-eclipse-temurin-17 AS builder
      WORKDIR /app
      COPY pom.xml .
      COPY src ./src
      RUN mvn clean package -DskipTests
      EOF
    - docker build -f Dockerfile.build -t build-env .
    - docker create --name extract build-env
    - docker cp extract:/app/target ./target
    - docker rm extract

test-in-docker:
  stage: test
  script:
    - |
      docker run --rm \
        -v ${PWD}:/workspace \
        -w /workspace \
        maven:3.9-eclipse-temurin-17 \
        mvn test

publish-from-docker:
  stage: publish
  script:
    - |
      docker run --rm \
        -v ${PWD}:/workspace \
        -w /workspace \
        -e CLOUDREPO_USERNAME \
        -e CLOUDREPO_PASSWORD \
        maven:3.9-eclipse-temurin-17 \
        bash -c "
          cat > settings.xml << 'EOL'
          <settings>
            <servers>
              <server>
                <id>cloudrepo</id>
                <username>\${env.CLOUDREPO_USERNAME}</username>
                <password>\${env.CLOUDREPO_PASSWORD}</password>
              </server>
            </servers>
          </settings>
          EOL
          mvn deploy -s settings.xml
        "
  only:
    - tags

Dependency Scanning and Security

.gitlab-ci.yml - Security scanning

include:
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/License-Scanning.gitlab-ci.yml

stages:
  - build
  - test
  - deploy
  - scan

dependency-check:
  stage: scan
  image: owasp/dependency-check:latest
  script:
    - |
      /usr/share/dependency-check/bin/dependency-check.sh \
        --project "$CI_PROJECT_NAME" \
        --scan . \
        --format ALL \
        --out reports
  artifacts:
    reports:
      dependency_scanning: reports/dependency-check-report.json
    paths:
      - reports/

license-check:
  stage: scan
  image: licensefinder/license_finder:latest
  script:
    - license_finder report --format json > licenses.json
  artifacts:
    paths:
      - licenses.json

publish-if-secure:
  stage: deploy
  dependencies:
    - dependency-check
    - license-check
  script:
    - |
      # Only deploy if security scans pass
      if [ -f reports/dependency-check-report.json ]; then
        VULNS=$(jq '.vulnerabilities | length' reports/dependency-check-report.json)
        if [ "$VULNS" -gt 0 ]; then
          echo "Found $VULNS vulnerabilities. Blocking deployment."
          exit 1
        fi
      fi
    - mvn deploy
  only:
    - main

Performance Optimization

GitLab Runner Caching

.gitlab-ci.yml - Advanced caching strategies

variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip"
  MAVEN_OPTS: >-
    -Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository
    -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN
    -Dorg.slf4j.simpleLogger.showDateTime=true
    -Djava.awt.headless=true
  GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle"

# Global cache configuration
cache: &global_cache
  key:
    files:
      - pom.xml
      - package-lock.json
      - requirements.txt
      - build.gradle
    prefix: ${CI_JOB_NAME}
  paths:
    - .m2/repository/
    - .gradle/caches/
    - .cache/pip/
    - node_modules/
  policy: pull-push

.maven-cache:
  cache:
    <<: *global_cache
    paths:
      - .m2/repository/
    policy: pull

.gradle-cache:
  cache:
    <<: *global_cache
    paths:
      - .gradle/caches/
      - .gradle/wrapper/
    policy: pull

.python-cache:
  cache:
    <<: *global_cache
    paths:
      - .cache/pip/
      - venv/
    policy: pull

maven-build:
  extends: .maven-cache
  stage: build
  script:
    - mvn clean compile

gradle-build:
  extends: .gradle-cache
  stage: build
  script:
    - gradle build

python-build:
  extends: .python-cache
  stage: build
  script:
    - pip install -r requirements.txt

Artifact Management

.gitlab-ci.yml - Efficient artifact handling

stages:
  - build
  - test
  - package
  - deploy

build:
  stage: build
  script:
    - mvn clean compile
  artifacts:
    paths:
      - target/classes/
    expire_in: 2 hours
    when: always

test:
  stage: test
  dependencies:
    - build
  script:
    - mvn test
  artifacts:
    reports:
      junit:
        - target/surefire-reports/TEST-*.xml
      coverage_report:
        coverage_format: cobertura
        path: target/site/cobertura/coverage.xml
    paths:
      - target/test-classes/
    expire_in: 1 day
    when: always

package:
  stage: package
  dependencies:
    - build
    - test
  script:
    - mvn package -DskipTests
  artifacts:
    paths:
      - target/*.jar
      - target/*.war
    expire_in: 1 week
    when: on_success

deploy:
  stage: deploy
  dependencies:
    - package
  script:
    - |
      # Only download required artifacts
      echo "Deploying artifacts to CloudRepo"
      for artifact in target/*.jar target/*.war; do
        if [ -f "$artifact" ]; then
          curl -u ${CLOUDREPO_USERNAME}:${CLOUDREPO_PASSWORD} \
            -T "$artifact" \
            https://myorg.mycloudrepo.io/repositories/releases/
        fi
      done
  only:
    - tags

Parallel Jobs

.gitlab-ci.yml - Parallel execution

stages:
  - build
  - test
  - deploy

build:
  stage: build
  parallel: 3
  script:
    - |
      # Split build across parallel jobs
      MODULES=(module-a module-b module-c module-d module-e module-f)
      TOTAL=${#MODULES[@]}
      PER_JOB=$(( (TOTAL + CI_NODE_TOTAL - 1) / CI_NODE_TOTAL ))
      START=$(( (CI_NODE_INDEX - 1) * PER_JOB ))
      END=$(( START + PER_JOB ))

      for i in $(seq $START $((END - 1))); do
        if [ $i -lt $TOTAL ]; then
          MODULE=${MODULES[$i]}
          echo "Building $MODULE"
          mvn clean package -pl :$MODULE -am
        fi
      done

test-suite:
  stage: test
  parallel:
    matrix:
      - TEST_SUITE: [unit, integration, e2e]
        BROWSER: [chrome, firefox]
  script:
    - |
      echo "Running $TEST_SUITE tests with $BROWSER"
      mvn test -Dtest.suite=$TEST_SUITE -Dbrowser=$BROWSER

deploy-regions:
  stage: deploy
  parallel:
    matrix:
      - REGION: [us-east-1, eu-west-1, ap-southeast-1]
  script:
    - |
      REPO_URL="https://${REGION}.myorg.mycloudrepo.io/repositories/releases"
      mvn deploy -DaltDeploymentRepository=cloudrepo::default::${REPO_URL}

DAG Pipelines

.gitlab-ci.yml - Directed Acyclic Graph pipelines

stages:
  - build
  - test
  - deploy

build-core:
  stage: build
  script:
    - mvn clean compile -pl :core

build-api:
  stage: build
  needs: ["build-core"]
  script:
    - mvn clean compile -pl :api

build-web:
  stage: build
  needs: ["build-api"]
  script:
    - mvn clean compile -pl :web

build-cli:
  stage: build
  needs: ["build-api"]
  script:
    - mvn clean compile -pl :cli

test-unit:
  stage: test
  needs: ["build-core"]
  script:
    - mvn test -pl :core

test-integration:
  stage: test
  needs: ["build-api", "build-web"]
  script:
    - mvn verify -Pintegration

test-e2e:
  stage: test
  needs: ["build-web", "build-cli"]
  script:
    - mvn verify -Pe2e

deploy-all:
  stage: deploy
  needs:
    - job: test-unit
      artifacts: false
    - job: test-integration
      artifacts: false
    - job: test-e2e
      artifacts: false
  script:
    - mvn deploy

Troubleshooting Common Issues

Authentication Failures

Problem: 401 Unauthorized errors when publishing

Solutions:

Verify credentials are correctly set in GitLab CI variables
Check if variables are marked as protected (only available on protected branches/tags)
Ensure credentials are properly masked to avoid exposure
Test authentication with curl:

curl -u ${CLOUDREPO_USERNAME}:${CLOUDREPO_PASSWORD} \
  https://myorg.mycloudrepo.io/repositories/maven-releases/

Certificate Issues

Problem: SSL certificate verification failures

Solutions:

For self-signed certificates, add to GitLab Runner’s trust store:

before_script:
  - apt-get update && apt-get install -y ca-certificates
  - cp /path/to/cert.crt /usr/local/share/ca-certificates/
  - update-ca-certificates

For testing only (not recommended for production):

variables:
  MAVEN_OPTS: "-Dmaven.wagon.http.ssl.insecure=true -Dmaven.wagon.http.ssl.allowall=true"

Large File Uploads

Problem: Timeout or failure when uploading large artifacts

Solutions:

Increase GitLab Runner timeout:

deploy:
  timeout: 2 hours
  script:
    - mvn deploy

Use chunked upload for very large files:

split -b 100M large-artifact.jar chunk_
for chunk in chunk_*; do
  curl -u ${CLOUDREPO_USERNAME}:${CLOUDREPO_PASSWORD} \
    -T $chunk \
    https://myorg.mycloudrepo.io/repositories/raw/$chunk
done

Cache Corruption

Problem: Build failures due to corrupted cache

Solutions:

Clear cache in GitLab UI: CI/CD → Pipelines → Clear Runner Caches
Use cache versioning:

cache:
  key: "v2-${CI_JOB_NAME}-${CI_COMMIT_REF_SLUG}"

Implement cache validation:

before_script:
  - |
    if [ -d .m2/repository ]; then
      find .m2/repository -name "*.jar" -exec jar tf {} \; > /dev/null 2>&1 || {
        echo "Cache corrupted, clearing..."
        rm -rf .m2/repository
      }
    fi

Pipeline Performance

Problem: Slow pipeline execution

Solutions:

Use DAG pipelines to parallelize independent jobs
Implement selective testing based on changes:

test:
  script:
    - |
      CHANGED_FILES=$(git diff --name-only HEAD~1)
      if echo "$CHANGED_FILES" | grep -q "^core/"; then
        mvn test -pl :core
      fi

Use GitLab’s distributed cache:

cache:
  key: "$CI_JOB_NAME"
  paths:
    - .m2/repository/
  policy: pull
  untracked: false
  when: on_success

Best Practices Summary

Security

Always use masked, protected variables for credentials
Rotate credentials regularly
Use least-privilege access for CI/CD service accounts
Enable dependency scanning and security pipelines
Never commit credentials to repository

Performance

Leverage caching aggressively but validate cache integrity
Use parallel jobs and matrix builds for multi-version testing
Implement DAG pipelines for complex workflows
Set appropriate artifact expiration times
Use shallow clones for faster checkout

Reliability

Implement retry logic for network operations
Use atomic deployments (all or nothing)
Version your artifacts properly (especially for SNAPSHOT vs releases)
Maintain separate repositories for different artifact types
Test pipeline changes in feature branches first

Maintainability

Use YAML anchors and templates to reduce duplication
Document pipeline behavior with comments
Keep credentials and configuration external to pipeline definitions
Use semantic versioning for releases
Implement proper logging and error reporting