gitlab-ci-validator_skill

Overview

This skill is a comprehensive toolkit for validating, linting, testing, and securing GitLab CI/CD pipeline configurations (.gitlab-ci.yml). It catches YAML and schema errors, highlights best-practice improvements, and performs security scans to detect hardcoded secrets, unsafe scripts, and insecure includes. Use it to enforce consistent pipeline quality and reduce CI runtime failures and security risks.

How this skill works

The validator runs a staged workflow: syntax/schema checks, best-practices analysis, and a security audit. It examines job definitions, stages, includes (component, project, remote, local, template), DAG/needs usage, cache/artifact settings, and variable handling. Outputs include line-level findings, remediation suggestions, severity levels, and optional local pipeline simulation using gitlab-ci-local for runtime validation.

When to use it

• Validating new or changed .gitlab-ci.yml files before merge
• Debugging pipeline failures caused by syntax, missing stages, or undefined jobs
• Enforcing CI/CD best practices during code review or CI validation jobs
• Performing security audits to find hardcoded secrets, unsafe scripts, or unpinned includes
• Optimizing pipelines for performance (caching, DAG, parallelization)

Best practices

• Pin Docker images to versions or digests instead of :latest
• Use cache for dependency installation and set artifact expiration
• Prefer rules over deprecated only/except and use needs for DAG optimization
• Configure timeouts, retries, and interruptible where appropriate
• Use resource_group for serialized deployments and avoid overly broad artifact paths

Example use cases

• CI pipeline job that validates .gitlab-ci.yml in a pre-merge validate stage
• Security scan pre-merge to block commits with hardcoded credentials or unsafe curl | bash patterns
• Refactoring a monorepo pipeline: identify DAG and parallelization opportunities
• Local testing of complex pipeline flows using gitlab-ci-local before pushing changes
• Automated enforcement: run validator in CI with --strict to fail on warnings