ci-cd-gitlab-rails

GitLab CI for Rails

The same principles as GitHub Actions, different YAML. If you're on GitLab, use the platform's native CI rather than mixing in Jenkins / GitHub Actions. Auto DevOps is tempting but opinionated — overrides are common.

The opinion

One .gitlab-ci.yml per repo, stages in order (build → test → security → deploy). Use cache for gems / yarn. Use services for Postgres + Redis. Use parallel: N for RSpec sharding. Deploy via Kamal in a deploy stage gated on protected main branch + manual approval for production. Use OIDC (GitLab CI ID Token) for cloud auth — never static keys in CI variables.

Pattern 1: Top-level structure

# .gitlab-ci.yml
default:
  image: ruby:3.3
  before_script:
    - apt-get update -qq && apt-get install -y nodejs yarn
  cache:
    key:
      files: [Gemfile.lock, yarn.lock]
    paths:
      - vendor/bundle
      - node_modules

stages:
  - build
  - test
  - security
  - deploy

variables:
  POSTGRES_HOST_AUTH_METHOD: trust
  DATABASE_URL: postgres://postgres@postgres:5432/myapp_test
  REDIS_URL: redis://redis:6379/1
  BUNDLE_PATH: vendor/bundle
  RAILS_ENV: test

cache.key.files hashes the lockfiles → cache hit only when deps actually match.

Pattern 2: Test stage

test:
  stage: test
  parallel: 4    # GitLab runs 4 parallel jobs
  services:
    - postgres:16
    - redis:7
  script:
    - bundle install --jobs 4
    - bin/rails db:prepare
    - bundle exec rspec --tag ~slow

  artifacts:
    when: always
    paths:
      - tmp/screenshots/
      - coverage/
    reports:
      junit: tmp/rspec-junit.xml

parallel: 4 sets $CI_NODE_TOTAL=4 and $CI_NODE_INDEX=1..4 for sharding. Pair with knapsack_pro or flatware.

artifacts.reports.junit populates GitLab's MR test report UI.

Pattern 3: Linting + security in parallel

rubocop:
  stage: test
  script:
    - bundle install --jobs 4
    - bundle exec rubocop --parallel

brakeman:
  stage: security
  script:
    - bundle install --jobs 4
    - bundle exec brakeman -q --no-pager --no-progress --color
  allow_failure: false

bundle_audit:
  stage: security
  script:
    - bundle install --jobs 4
    - bundle exec bundle-audit check --update
  allow_failure: false

sast:
  stage: security
  include:
    - template: Security/SAST.gitlab-ci.yml