Application pipelines¶
Backend and frontend share the same composition: each .gitlab-ci.yml imports build.yml, test.yml and deploy.yml from cicd-templates. Only the manifest repository URL differs. In both projects, DEPLOY_TARGET is gke in the snapshot.
Stages and jobs¶
| Declared stage | Custom or imported jobs | Output |
|---|---|---|
quality |
code_quality |
Code quality report |
security |
secret_detection |
Secret detection report |
test |
Imported SAST analyzers | Static analysis; semgrep-sast in observed runs |
results-scanners |
results-code-quality, results-secret-detection |
Human-readable log summaries |
build |
generate-maven-jar, generate-image |
JAR and published image |
container-security |
container_scanning |
Analysis of the published image |
container-security-results |
results-container-scanning |
Container analysis summary |
deploy |
update-k8s-manifests, deploy |
Image commit and manifest application |
The consuming project's stage list completes and overrides the partial lists in the templates. The actual SAST job depends on GitLab templates, detected files and instance configuration; it is not defined directly in test.yml.
Execution rules¶
| Family | Versioned condition | Behavior |
|---|---|---|
| Build | Protected reference | Rules use when: always |
| Quality and its summary | Protected reference and ENABLE_QUALITY == 'true' |
Conditional execution |
| Secrets and containers | Protected reference and ENABLE_SECURITY == 'true' |
Conditional execution |
| SAST | Rules from imported templates | Inspect the expanded configuration |
| Manifest update and deployment | Protected reference and literal main branch |
Automatic with default success semantics |
The custom templates do not implement a complete merge request validation policy. An unprotected branch does not execute protected jobs even when relevant code changes. The deployment branch is written as main, rather than $CI_DEFAULT_BRANCH.
Actual dependencies¶
generate-image needs the artifact from generate-maven-jar; both belong to build. deploy needs update-k8s-manifests with optional: true. Jobs without needs follow stage order. The visual column order therefore does not describe every dependency or blocking condition.
Build rules use when: always, and security summary jobs inherit allow_failure: true. The effective policy does not form a security gate that blocks every release with findings. See quality and security.
Public execution evidence¶
| Service | Observed pipeline | Result | Commit |
|---|---|---|---|
| Backend | 2604545913 | 11 successful jobs | 2c8e6ef861de7 |
| Frontend | 2604607441 | 11 successful jobs | 1e56e856d4cf3 |
The 26 October 2026 query confirms job status, not every report's contents or current service health. The deployment job does not wait for rollout completion or run HTTP tests: a successful pipeline has that specific scope.
Infrastructure and documentation use separate pipelines with different rules.