Skill: GitLab CI/CD

Capability Domain: DevOps / CI-CD
Technology Stack: GitLab CI, id_tokens OIDC
Linked Activities: Deploy via GitLab CI

When to use

Lake Scope Contract ci is gitlab_ci. Skip this skill if the lake repo lives on GitHub.

Copy-this

Starter file: .gitlab-ci.yml.example in https://github.com/FeatureFactory-io/ops-lake-starter. Copy to .gitlab-ci.yml only if ci: gitlab_ci. Do not also keep a live GitHub deploy.yml against the same AWS account.

Chicken-and-egg (parity with GitHub Actions)

1. Laptop, same region as the contract: cdk bootstrap then one cdk deploy OpsLakeDeploy to mint the GitLab OIDC IAM role. Read DeployRoleArn from stack outputs.
2. GitLab project → Settings → CI/CD → Variables → AWS_DEPLOY_ROLE_ARN (masked). Never AWS_ACCESS_KEY_ID.
3. Trust aud = https://gitlab.com (or this GitLab instance URL) and the project sub (project_path:{group}/{project}:ref_type:branch:ref:main).
4. After that, never cdk deploy a shared env from a laptop.

Recipe

1. .gitlab-ci.yml: a deploy stage with rules: if: $CI_COMMIT_BRANCH == "main", using GitLab's id_tokens block to mint an OIDC token and assume an AWS role — no AWS_ACCESS_KEY_ID CI/CD variable.
2. id_tokens:
   yaml id_tokens: GITLAB_OIDC_TOKEN: aud: https://gitlab.com
   Then aws sts assume-role-with-web-identity --role-arn $AWS_DEPLOY_ROLE_ARN --role-session-name gitlab-deploy --web-identity-token $GITLAB_OIDC_TOKEN --duration-seconds 3600.
3. Steps: pytest → cdk synth → cdk diff → cdk deploy --require-approval never, with when: manual in front of the production deploy job. Fail the job if cdk diff is not empty and you have not approved the manual job — do not invent a line-count number.
4. Register a GitLab Environment (production) against the deploy job so GitLab's environment view shows current deployment state.
5. After first pipeline, record DeployRoleArn, webhook URL, StreamlitMartUrl in docs/deploy-manifest.yaml.
6. Prove: a main pipeline log shows AssumedRole / successful cdk deploy, not an AccessKey login.

Pitfalls

• This and GitHub Actions CI/CD are alternative paths to the same outcome — running both against the same AWS account invites split-brain deploys; pick the one matching where the repo actually lives, don't stand up the other "just in case."
• Skipping the laptop mint: GitLab OIDC cannot assume a role that does not exist yet.