GitLab CI/CD for iGaming projects

(Section: Technology and Infrastructure)

Brief Summary

GitLab CI/CD is a delivery pipeline for iGaming applications, analytics and ML services. It combines: repository, pipelines as code, environment and security management, its own container/package registry, integrations with Kubernetes and Terraform, as well as vulnerability and license scanning. The key to success is the same pipeline templates, ephemeral runners with auto-skale, a strict rights and secrets model, GitOps processes and cost control.

1) Architecture and roles

GitLab (SaaS or Self-Managed): groups/projects, Protected branches/tags, Merge Request Approvals.
Runners: Docker/Kubernetes/Virtual Machine executors. Ephemeral hearths in the K8s minimize medium drift.
Registers: Container/Package/Dependency Proxy - cache base images and dependencies.
Observability: job logs, job artifacts, pipeline insights, export metrics to monitoring.

Roles: developers (MR), maintainers (approve/release), SecOps (scanning policies), Platform/DevOps (runners, templates, GitOps).

2) Fundamentals' .gitlab-ci. yml ': phases, rules, constraints

yaml stages: [lint, test, build, security, package, deploy]

variables:
DOCKER_DRIVER: overlay2
IMAGE: "$CI_REGISTRY_IMAGE/app:$CI_COMMIT_SHA"

workflow:
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"
- if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

.default:
image: alpine:3. 20 before_script: [ 'apk add --no-cache bash curl jq' ]

lint:
stage: lint script: [ "make lint" ]
rules: [ { if: '$CI_PIPELINE_SOURCE == "merge_request_event"' } ]

unit:
stage: test script: [ "make test" ]
artifacts:
when: always reports: { junit: "reports/junit. xml" }
needs: [ "lint" ]

build_image:
stage: build image: docker:27 services: [ 'docker:27-dind' ]
variables: { DOCKER_TLS_CERTDIR: "" }
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build -t $IMAGE.
- docker push $IMAGE cache:
key: "docker-${CI_COMMIT_REF_SLUG}"
paths: [ "/var/lib/docker" ]
policy: pull-push needs: [ "unit" ]

• 'rules' for branches/MR/tags; 'needs' for DAG parallelism; 'artifacts: reports' for JUnit/coverage; 'workflow' - so as not to run unnecessary pipelines.

3) Runners and auto-scale

Kubernetes executor (recommended)

Ephemeral pods, CPU/RAM quotas, nodeSelector/tains, secret isolation.
Cache/artifacts: object storage; dependency proxy для NPM/Maven/PyPI/Docker.

Docker executor

Simple start; use DinD or Kaniko/BuildKit to build without privileges.

• Separate runner pools by load types (Build/Test/Security/ML); concurrency limits per group/project; runner tags ('k8s', 'gpu', 'security').

4) Cache, artifacts and matrices

yaml cache:
key: "pip-${CI_COMMIT_REF_SLUG}"
paths: [ "venv/", ".cache/pip/" ]
policy: pull-push

test:py:
stage: test parallel:
matrix:
- PY: ["3. 10", "3. 12"]
image: python:${PY}
script:
- python -m venv venv &&. venv/bin/activate
- pip install -r requirements. txt
- pytest -q

Use the global dependency proxy to save traffic and time, split-tests by matrix, artifacts:expire_in for hygiene.

5) Safety and compliance (Shift-Left)

yaml sast:
stage: security image: registry. gitlab. com/security-products/sast:latest script: [ "analyzer run" ]
artifacts: { reports: { sast: "gl-sast-report. json" } }
rules: [ { if: '$CI_PIPELINE_SOURCE == "merge_request_event"' } ]

secret_detection:
stage: security image: registry. gitlab. com/security-products/secret-detection:latest script: [ "analyzer run" ]
artifacts: { reports: { secret_detection: "gl-secret-report. json" } }

sbom:
stage: security image: alpine:3. 20 script:
- apk add syft cosign
- syft $IMAGE -o cyclonedx-json > sbom. json
- cosign sign --key $COSIGN_KEY $IMAGE artifacts:
reports: { cyclonedx: "sbom. json" }

Also: DAST for stands, Dependency/License Compliance, mandatory MR-approvals for critical findings, masking variables.

6) Environments, Review Apps and Releases

yaml review:
stage: deploy image: bitnami/kubectl environment:
name: review/$CI_COMMIT_REF_SLUG url: https://$CI_COMMIT_REF_SLUG. apps. example. com on_stop: stop_review script:
-./deploy. sh --env=review --image=$IMAGE rules: [ { if: '$CI_PIPELINE_SOURCE == "merge_request_event"' } ]

stop_review:
stage: deploy when: manual environment:
name: review/$CI_COMMIT_REF_SLUG action: stop script: [ "./deploy. sh --env=review --delete" ]

Release/Tag pipeline: publishing Helm chart/artifacts, generating release notes, signing images.

7) Progressive delivery: canary/blue-green

yaml deploy_canary:
stage: deploy script: [ "./helm_upgrade. sh --set canary. weight=10 --image=$IMAGE" ]
environment: { name: production }
rules: [ { if: '$CI_COMMIT_TAG' } ]

promote_100:
stage: deploy when: manual script: [ "./helm_upgrade. sh --set canary. weight=100" ]
needs: [ "deploy_canary" ]

Add quality gates: SLO latency/error-rate from monitoring → resolution/rollback.

8) Parent/Child and multi-project pipelines

Parent/Child: accelerate large monorepos (each component is a child pipeline).

yaml trigger_components:
stage: build trigger:
include: [ "ci/component-a. yml", "ci/component-b. yml" ]
strategy: depend

Multi-Project: "Release" project triggers CD to manifest repo (GitOps).

9) GitOps и Terraform/IaC

GitOps via MR to manifest repository

yaml gitops_bump:
stage: deploy image: alpine/git script:
- git clone $MANIFESTS_REPO manifests
- yq -i '.image = env(IMAGE)' manifests/apps/app/values. yaml
- cd manifests && git commit -am "bump $CI_COMMIT_SHA" && git push origin HEAD:$TARGET_BRANCH

Terraform в CI

yaml terraform:
stage: deploy image: hashicorp/terraform:1. 9 script:
- terraform init -backend-config="bucket=$TF_BUCKET"
- terraform plan -out tfplan
- terraform apply -auto-approve tfplan rules: [ { if: '$CI_COMMIT_BRANCH == "infra"'} ]

10) Secrets and accesses

CI Variables: masked/protected; separate by environment/group.
Protected branches/tags: release in prod - only from protected branches and with manual confirmation.
External secrets: integrations with Secrets Manager/HashiCorp Vault (JWT/OIDC), mounting on runners only for the duration of the job.

11) Pipeline and SLO observability

Pipeline DORA/KPI: lead time, deployment frequency, change fail rate, MTTR.
Tools: retrays/timeouts, 'allow _ failure' for non-blocking tasks, code coverage report.
Export metrics: duration of stages, runner queue, success ratio; alerts in ChatOps.

12) FinOps: cost and performance

Dependency Proxy + Docker dependency and layer cache.
Split runner pools (prod/security/ML) with concurrency limits.
Auto-pause Review Apps and inactive environments; 'artifacts: expire _ in'.
Large assemblies - on spot/prefabricated pools; pre-heating of basic images.

13) Templates for iGaming cases

Backend/API service

yaml include: [ "ci/includes/security. yml", "ci/includes/docker. yml" ]
deploy_prod:
stage: deploy environment: { name: production, url: https://api. example. com }
script: [ "./helm_upgrade. sh --env=prod --image=$IMAGE" ]
rules: [ { if: '$CI_COMMIT_TAG' } ]

ETL/DBT model

yaml dbt_run:
stage: build image: ghcr. io/dbt-labs/dbt-snowflake:latest script: [ "dbt deps", "dbt run --profiles-dir. ", "dbt test" ]
artifacts: { paths: [ "target/" ], expire_in: 3 days }

ML/LLM artifact

yaml ml_pack:
stage: package image: nvidia/cuda:12. 1. 0-runtime-ubuntu22. 04 tags: [ "gpu" ]
script:
- python export_onnx. py
- trtexec --onnx=model. onnx --saveEngine=model. plan artifacts: { paths: [ "model. plan", "model. onnx" ] }

14) Implementation checklist

1. Define the piping and Shared Includes patterns for the commands (lint/test/build/security/deploy).
2. Deploy ephemeral K8s runners, enable dependency proxy, object storage for artifacts/cache.
3. Enter rules/needs/DAG, matrices, and concurrency.
4. Configure SAST/DAST/Secret/SBOM/License and MR-approvals by policy.
5. Organize Environments/Review Apps, auto-close and neat URLs.
6. Include GitOps: standalone manifesto repo, MR-bump looks/charts.
7. Provide secret management (masked/protected, Vault/OIDC), protected branches/tags.

8. Connect Terraform/IaC and "monitor as code."

9. Enter FinOps practices: runner limits, cache/proxy, expire artifacts, auto-pause stands.
10. Regular game-days: runner drop, cache fill, registry unavailability.

15) Antipatterns

One "universal" runner without isolation and quotas.
Pipelines without 'rules' (run 'always'), without 'needs' (slowly).
Privileged DinD builds in unlimited production runners.
Storing secrets in the repository/job logs.
Lack of security stage and MR-approvals.
Infinite Review Apps without 'on _ stop' and 'expire _ in'.
Manual releases in prod without protected tags.

Summary

GitLab CI/CD gives iGaming teams fast and predictable releases: uniform templates, auto-skale runners, high-quality security gates, environments and progressive deploes, GitOps and Terraform integration. Add observability and FinOps - and your apps, ETL and ML services will be released regularly, securely and at a controlled cost.