Does your GitLab CI/CD pipeline fail, does a job sit on "pending", or do your
builds take 20 minutes when they could take 5? This progressive course takes you from
your first .gitlab-ci.yml to industrial, secure and measurable
pipelines. Each lesson builds on the previous ones, with hands-on exercises
and real production incident scenarios.
The course is free and open to everyone. It is aimed at developers, DevOps engineers, SREs and platform teams. You need the basics of Git, some habit of using a Linux terminal, and a machine able to run a virtual machine: the labs set up your own GitLab CE forge on it, with no account on gitlab.com. Its first goal is to prepare you for the GitLab Certified CI/CD Associate certification.
What you will learn
- Write a complete, clear and maintainable GitLab CI/CD pipeline
- Debug the common failures: pending jobs, skipped pipelines, ineffective cache
- Scale up your workflows with templates, DAGs, parallelism and parent/child pipelines
- Secure secrets, deployments and the CI supply chain (SBOM, attestations)
- Steer delivery with DORA metrics and compliance policies (pipeline execution policies; compliance pipelines are deprecated)
Which GitLab certification should you prepare?
This course does not stop at explaining GitLab CI/CD: it helps you build a progression that is useful in real situations and prepare the most relevant GitLab certifications for your profile.
| Certification | Who is it for? | How it fits with this course |
|---|---|---|
| Git Associate | Beginners without solid Git basics | A good upstream stepping stone, to be completed by real Git practice |
| GitLab Certified Fundamentals Associate | Users who want an overview of GitLab | Partly covered; complete it with the platform features outside CI/CD |
| GitLab Certified CI/CD Associate | Main target of this course | Strong match with levels C1 to C3 |
| GitLab security certifications | DevSecOps / security profiles | A good base with level C4, depending on the exam you aim for |
Target certification: GitLab CI/CD Associate
If your goal is to master GitLab CI/CD and be able to prove it, the certification that fits this course best is the GitLab Certified CI/CD Associate. The GitLab CI Fundamentals Learning Path is the official preparation path.
Levels C1 to C3 cover the skills the exam expects:
- pipeline structure and
.gitlab-ci.ymlsyntax - runners, variables, artifacts and cache
rules, templates, includes and components- common troubleshooting and DRY best practices
Two pages of the course are dedicated to this preparation: the overview of GitLab certifications, which compares the paths and helps you pick the right order, and the guide Preparing for GitLab CI/CD Associate, which details the skills assessed, a preparation plan and the mistakes to avoid on exam day.
Going further: security and governance
Level C4 extends this progression to security, compliance, audit and CI/CD supply chain topics. It is a good base for profiles who want to strengthen their DevSecOps level in GitLab before aiming for a GitLab security certification.
C1, Write a pipeline and read its failures
Level C1 takes you from "a pipeline that prints Hello World" to a pipeline you
can read when it fails. You will learn to structure your .gitlab-ci.yml
files, manage variables, control execution with rules, use
artifacts and cache, and read the logs of a failing job. The lessons
are listed in course order. Every lesson that teaches a hands-on move carries
its lab at the bottom of the page, on a GitLab CE forge of your own:
there is no separate exercise series to follow alongside the course.
| Lesson | Difficulty | Focus |
|---|---|---|
| Getting started with GitLab CI/CD | Beginner | pipeline, stage, job |
| Writing a .gitlab-ci.yml file | Beginner | stages, jobs, script, image |
| Validating a pipeline | Beginner | CI Lint, Pipeline Editor, API |
| Debug: reading the logs | Beginner | logs, sections, errors |
| Runners: how a job runs | Beginner | runner, tags, executor |
| Artifacts and cache | Beginner | storage, performance, retention |
| Variables and secrets | Beginner | variables, scopes, CI_* |
| Execution conditions (rules) | Intermediate | workflow:rules, rules, when |
| Pipeline triggers | Intermediate | MR, tags, schedules, API |
C2, Deliver
Level C2 moves from writing to delivering. You declare deployment environments, use job reports (JUnit, coverage, quality), publish to the GitLab registries, enable the built-in scanners, and learn to debug the two most frequent failures: the job stuck on "pending" and the "skipped" pipeline. The summary assembles everything into a complete, clean pipeline.
| Lesson | Difficulty | Focus |
|---|---|---|
| Environments (deploy targets) | Intermediate | environment:name, stop actions |
| Quality reports | Intermediate | JUnit, coverage, code quality |
| Debug: job stuck on pending | Intermediate | runner, tags, quotas |
| Debug: skipped pipeline | Intermediate | rules, workflow, only/except |
| Summary: a complete pipeline | Intermediate | C1 and C2 mini-capstone |
| GitLab registries: images and packages | Intermediate | Container Registry, Package Registry, pinning |
| GitLab CI security scanners | Intermediate | SAST, DAST, secrets, dependencies |
C3, Industrialise
Level C3 turns your hand-made pipelines into industrial pipelines: fast thanks to the DAG and parallelism, reusable thanks to templates and CI/CD Components, and orchestrated with parent/child and dynamic pipelines.
| Lesson | Difficulty | Focus |
|---|---|---|
| extends and YAML anchors | Intermediate | anchors, extends, merge keys |
| Shared templates (include) | Intermediate | include project/remote |
| CI/CD Components and Catalog | Advanced | inputs, versioning, governance |
| DAG and parallelism (needs) | Advanced | graph, performance, fail-fast |
| Job matrices (parallel:matrix) | Advanced | multi-version tests |
| CI services and advanced cache | Advanced | Docker services, distributed cache |
| Parent-child pipelines | Advanced | splitting, orchestration |
| Dynamic pipelines | Advanced | YAML generation, monorepo |
| Multi-project and downstream | Advanced | triggers, variable propagation |
| CI/CD workflows | Advanced | MR, branches, releases |
| Pipeline reliability | Advanced | targeted retry, timeouts, idempotence |
| Scaling-up capstone | Advanced | fast, modular pipeline |
C4, Secure and tool
Level C4 covers securing your CI/CD pipelines: a realistic threat model, secrets management, configuration hardening, the supply chain (SBOM, SLSA attestations) and compliance (audit, compliance frameworks, pipeline execution policies; compliance pipelines are deprecated).
| Lesson | Focus |
|---|---|
| 7 attacks that target your pipelines | CI/CD threat model, injection, exfiltration |
| Managing secrets without exposing them | Protected variables, masking, Vault integration |
| Protected branches and approvals | Merge request approvals, protected environments |
| Hardening your pipelines in 10 measures | Least privilege, runner isolation, image pinning |
| Supply chain: SBOM and attestations | CycloneDX, SLSA, cosign, traceability |
| Audit, compliance and traceability | Audit events, compliance frameworks, pipeline execution policies (compliance pipelines are deprecated), reports |
Incident scenarios (cross-cutting)
Throughout the course you will meet incident scenarios taken from production. The goal: learn to make a diagnosis before applying a fix, exactly as in a real setting.
| # | Symptom | Actual cause | Level |
|---|---|---|---|
| 1 | Job stuck on "pending" | No runner, or tags mismatch | C2 |
| 2 | No pipeline created by the push | workflow:rules too restrictive | C2 |
| 3 | Builds always slow | Cache key not tied to the lockfile | C1 |
| 4 | Next job fails | Wrong artifacts paths/expire_in | C1 |
| 5 | Unexpected behavior | Variable scope/precedence | C1 |
| 6 | Tests "randomly red" | Flaky tests, network dependencies | C3 |
| 7 | Jobs start too early | needs badly defined (DAG) | C3 |
| 8 | Secrets exposed in logs | Echo + no masking | C4 |
Where should you start?
The entry point depends on what you can already do. Pick the tab that matches your situation: it names the exact lesson to start with.
Follow the lessons in order, starting with level C1. Take the time to practice each concept before moving on to the next.
First lesson: Getting started with GitLab CI/CD
If you can already write a basic .gitlab-ci.yml, go straight to the lesson
on rules or to level C3 for scaling up.
Recommended lesson: Execution conditions (rules)
Prioritize level C3 (templates, components, governance) and level C4 (security, audit, compliance) for architecture decisions.
Recommended lesson: CI/CD Components and Catalog
Tools
The tools belong to level C4. Two utilities come up constantly in the course:
glab, to drive GitLab without leaving the terminal, and Plumber, to check your
.gitlab-ci.yml files before you push them.
| Tool | Description |
|---|---|
| GitLab CLI (glab) | Manage pipelines, MRs and issues from the terminal |
| Plumber | Compliance scanner for .gitlab-ci.yml files |
Additional resources
Keep these four pages at hand during the course: the .gitlab-ci.yml
reference and the list of predefined variables answer most
syntax questions on their own.
- Official CI/CD documentation: docs.gitlab.com/ci
- Predefined variables: docs.gitlab.com/ci/variables
- GitLab University: university.gitlab.com (official courses and certifications)
.gitlab-ci.ymlreference: docs.gitlab.com/ci/yaml
Key takeaways
- GitLab CI/CD is learned progressively: a simple pipeline first, scaling up next, security last
- A good pipeline is readable, fast, reusable and secure
- Debugging is a skill in its own right: pending jobs, skipped pipelines and ineffective cache each have specific causes
- Scaling up relies on templates, CI/CD Components and the DAG, not on duplicated code
- CI/CD security is not optional: exposed secrets, unpinned images and unaudited pipelines are real attack vectors
- This course prepares you for the GitLab Certified CI/CD Associate, with bridges to Git Associate and the GitLab security certifications