GitLab Runner config.toml 設定與常用 CI/CD 變數

sudo gitlab-runner register \
  --non-interactive \
  --url "https://gitlab.example.com/" \
  --token "$RUNNER_TOKEN" \
  --executor "docker" \
  --docker-image alpine:latest \
  --docker-pull-policy "if-not-present" \
  --description "docker-runner"

curl --silent --request POST --url "https://gitlab.example.com/api/v4/user/runners" \
  --data "runner_type=project_type" \
  --data "project_id=<project_id>" \
  --data "description=docker-runner" \
  --data "tag_list=docker,linux" \
  --header "PRIVATE-TOKEN: <project_access_token>"

docker run -d --name gitlab-runner --restart always \
  -v /srv/gitlab-runner/config:/etc/gitlab-runner \
  -v /var/run/docker.sock:/var/run/docker.sock \
  gitlab/gitlab-runner:latest

concurrent = 4          # 所有 runner 合計的同時 job 上限，不能設 0
check_interval = 3      # 向 GitLab 詢問新 job 的間隔（秒），預設 3
log_level = "info"      # debug / info / warn / error / fatal / panic
shutdown_timeout = 30   # 強制關閉前等待的秒數，預設 30

[[runners]]
  name = "docker-runner"                 # 僅供識別
  url = "https://gitlab.example.com/"
  token = "glrt-REDACTED"                # authentication token，不是 registration token
  executor = "docker"                    # shell、docker、kubernetes 等
  limit = 0                              # 此 runner 的同時 job 上限，0 代表不限制
  request_concurrency = 1                # 同時向 GitLab 要 job 的請求數，預設 1
  environment = ["TZ=Asia/Taipei"]       # 附加或覆寫 job 的環境變數

  [runners.docker]
    image = "alpine:latest"              # job 未指定 image 時使用
    privileged = false                   # 開啟會停用 container 隔離，見下方
    volumes = ["/cache"]                 # 額外掛載，語法同 docker -v
    pull_policy = "if-not-present"       # never / if-not-present / always，預設 always
    allowed_images = ["registry.example.com/*"]  # 限制 job 可用的 image，未設定代表全部允許
    shm_size = 0

  [runners.cache]
    Type = "s3"                          # s3 / gcs / azure
    Path = "runner-cache"                # 加在 cache URL 前的路徑
    Shared = true                        # 多個 runner 共用 cache，預設 false
    [runners.cache.s3]
      ServerAddress = "s3.example.com"
      BucketName = "gitlab-runner-cache"
      BucketLocation = "ap-northeast-1"
      AuthenticationType = "iam"         # iam 或 access-key

build-image:
  image: docker:<version>-cli          # 換成團隊驗證過的版本
  services:
    - docker:<version>-dind
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  script:
    - docker build -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" .

# 產生 auth 值；用 printf 避免把換行一起編碼
printf "my_username:my_password" | openssl base64 -A

{
  "auths": {
    "harbor.example.com": {
      "auth": "<base64 of username:password>"
    }
  }
}

script:
  - echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
  - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"

sudo gitlab-runner list        # 列出 config.toml 中的 runner
sudo gitlab-runner verify      # 檢查已註冊的 runner 能否連上 GitLab
sudo gitlab-runner status      # 服務狀態；執行中時 exit code 為 0
sudo gitlab-runner restart     # 停止後再啟動服務
sudo gitlab-runner start
sudo gitlab-runner stop

# 不需重啟，讓 runner 重新讀取 config.toml
sudo kill -SIGHUP <main_runner_pid>

# 移除 GitLab 上已不存在的 runner，會改寫 config.toml
sudo gitlab-runner verify --delete

# 依名稱取消註冊；同名時只移除第一個
sudo gitlab-runner unregister --name docker-runner

# 依 URL 與 token 取消註冊
sudo gitlab-runner unregister --url "https://gitlab.example.com/" --token "$RUNNER_TOKEN"

# 取消註冊所有 runner
sudo gitlab-runner unregister --all-runners

deploy:
  script:
    - echo "Deploy $CI_COMMIT_SHORT_SHA to $CI_ENVIRONMENT_NAME"
  environment:
    name: production
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"   # 排程觸發的 pipeline 不部署
      when: never
    - if: $CI_COMMIT_TAG                       # 只在 tag pipeline 部署