DOCKER_IMAGE: \"$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n\ud83d\udd39 Explanation:<\/h3>\n\n\n\nVariable<\/th> Purpose<\/th><\/tr><\/thead> CI_REGISTRY_IMAGE<\/code><\/td>Built-in CI variable \u2014 the full image path for your project\u2019s Container Registry (e.g., registry.gitlab.com\/mygroup\/myproject<\/code>)<\/td><\/tr>CI_COMMIT_REF_SLUG<\/code><\/td>Built-in CI variable \u2014 a simplified, URL-safe version of your branch\/tag name (e.g., main<\/code>, feature-login<\/code>)<\/td><\/tr>DOCKER_IMAGE<\/code><\/td>Custom variable created inside gitlab-ci.yml<\/code><\/strong> by using other variables<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n\u27a1\ufe0f This means you’re building something like:<\/p>\n\n\n
DOCKER_IMAGE=registry.gitlab.com\/mygroup\/myproject:main\n<\/code><\/span><\/pre>\n\n\n
\n\n\n\n\ud83d\udce6 Ways to Define Variables in GitLab<\/h2>\n\n\n\n
Here are all the places where you can define and use GitLab CI\/CD variables<\/strong>, and how they behave:<\/p>\n\n\n\n
\n\n\n\n1. \ud83e\uddfe gitlab-ci.yml<\/code> (Project-Level Static)<\/h3>\n\n\nvariables:\n ENV: \"production\"<\/span>\n DOCKER_IMAGE<\/span>: \"$CI_REGISTRY_IMAGE:$CI_COMMIT_REF_SLUG\"<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n| \u2705 Use Case | Fixed values used across the pipeline (e.g., timeouts, env labels) |
| \u26a0\ufe0f Security | Not encrypted; not for secrets |
| \ud83d\udd01 Scope | Global or job-specific |<\/p>\n\n\n\n
\n\n\n\n2. \ud83d\udd12 GitLab UI \u2192 Project Settings > CI\/CD > Variables<\/strong><\/h3>\n\n\n\nGitLab.com path<\/strong>: Project \u2192 Settings \u2192 CI\/CD \u2192 Variables<\/code><\/p>\n\n\n\n| \u2705 Use Case | Store secrets<\/strong>, API keys, tokens, passwords |
| \ud83d\udd12 Security | Encrypted at rest, not visible in job logs by default |
| \ud83e\udde0 Scope | Project, group, or environment |
| \ud83d\udd04 Runtime options | Protect (only runs on protected branches\/tags), Mask (hide value), File (export as file) |<\/p>\n\n\n\n
\n\n\n\n3. \ud83c\udf0d Group-Level CI\/CD Variables<\/strong><\/h3>\n\n\n\n\nGroup \u2192 Settings \u2192 CI\/CD \u2192 Variables<\/code><\/p>\n<\/blockquote>\n\n\n\n| \u2705 Use Case | Share CI\/CD secrets across multiple projects in a group |
| \ud83d\udce6 Example | Docker credentials, shared API tokens |
| \ud83d\udccc Inherited by | All projects within the group\/subgroup (unless overridden) |<\/p>\n\n\n\n
\n\n\n\n4. \ud83e\udde0 Environment-Specific Variables (Scoped)<\/strong><\/h3>\n\n\n\nIn the UI<\/strong>, add a variable and set its scope:<\/p>\n\n\nKey: AWS_KEY\nEnvironment scope: staging\n<\/code><\/span><\/pre>\n\n\n| \u2705 Use Case | Different values for dev<\/code>, staging<\/code>, production<\/code> |
| \u26a0\ufe0f Behavior | Used only<\/strong> in jobs running for that environment |
| \ud83d\udccc Tip | Use environment:<\/code> keyword in job to match |<\/p>\n\n\n\n
\n\n\n\n5. \ud83e\uddea Job-Level Variable Overrides<\/strong><\/h3>\n\n\ndeploy_prod:\n stage: deploy\n script:\n - echo<\/span> $ENVIRONMENT\n variables:\n ENVIRONMENT: \"production\"<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n| \u2705 Use Case | Override for one job only |
| \ud83d\udd01 Scope | Temporary within that job |
| \ud83e\udde9 Can override global\/project\/group variables \u2705 |<\/p>\n\n\n\n
\n\n\n\n6. \u2328\ufe0f Trigger Pipeline Variables (via API or UI)<\/strong><\/h3>\n\n\n\nTrigger pipeline with dynamic values:<\/p>\n\n\n
curl --request POST \\\n --form token=TRIGGER_TOKEN \\\n --form ref=main \\\n --form \"variables[RELEASE_ENV]=staging\"<\/span> \\\n https<\/span>:\/\/gitlab.com\/api\/v4\/projects\/123456\/trigger\/pipeline<\/span>\n<\/code><\/span>Code language:<\/span> JavaScript<\/span> (<\/span>javascript<\/span>)<\/span><\/small><\/pre>\n\n\n| \u2705 Use Case | External scripts, GitOps, dynamic environments |
| \ud83d\udce9 Value injected | At pipeline run time |<\/p>\n\n\n\n
\n\n\n\n7. \ud83e\uddf1 .gitlab-ci.yml<\/code> Includes + Templates<\/strong><\/h3>\n\n\n\nVariables can also come from included YAML:<\/p>\n\n\n
include<\/span>:\n - project: 'common\/ci-templates'<\/span>\n file: '\/templates\/vars.yml'<\/span>\n<\/code><\/span>Code language:<\/span> PHP<\/span> (<\/span>php<\/span>)<\/span><\/small><\/pre>\n\n\n
\n\n\n\n\u2705 Summary Table<\/h2>\n\n\n\nMethod<\/th> Encrypted?<\/th> Scope<\/th> Best For<\/th><\/tr><\/thead> .gitlab-ci.yml<\/code><\/td>\u274c<\/td> Global\/Job<\/td> Static config vars, labels<\/td><\/tr> Project UI Variables<\/td> \u2705<\/td> Project-wide<\/td> Secrets, tokens, credentials<\/td><\/tr> Group Variables<\/td> \u2705<\/td> Multi-project<\/td> Shared cloud keys, API access<\/td><\/tr> Environment-Scoped Variables<\/td> \u2705<\/td> Per environment<\/td> Per-env secrets (e.g., AWS creds)<\/td><\/tr> Job-Level Variables<\/td> \u274c<\/td> Single job<\/td> Overrides, temp flags<\/td><\/tr> Trigger Variables (API\/UI)<\/td> \u2705<\/td> Pipeline runtime<\/td> GitOps, external triggers<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\nWould you like:<\/p>\n\n\n\n
\n- A visual map<\/strong> of where each variable type fits in CI\/CD flow?<\/li>\n\n\n\n
- A script or
.yml<\/code> template showing overrides<\/strong> in action?<\/li>\n\n\n\n- Best practices to secure variables in shared runners<\/strong>?<\/li>\n<\/ul>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\ud83d\udd0d Example You Gave: \ud83d\udd39 Explanation: Variable Purpose CI_REGISTRY_IMAGE Built-in CI variable \u2014 the full image path for your project\u2019s Container Registry (e.g., registry.gitlab.com\/mygroup\/myproject) CI_COMMIT_REF_SLUG Built-in CI variable \u2014 a… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[2],"tags":[],"class_list":["post-49469","post","type-post","status-publish","format-standard","hentry","category-uncategorised"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49469"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49469\/revisions"}],"predecessor-version":[{"id":49470,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49469\/revisions\/49470"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}