Pipeline lint component

The lint-pipeline component validates either the current project's compiled GitLab CI configuration or a pipeline YAML file in the repository. It creates a job named lint:pipeline:<name> and reports the CI Lint API response when the configuration is invalid.

Validate the current project configuration

Leave template empty to validate the configuration for the current commit. This mode checks the expanded configuration without simulating job creation, so it does not consume the project's active-job quota.

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/lint-pipeline@stable
    inputs:
      name: project

The default rules require GITLAB_TOKEN and run the lint job only on protected refs. Store the token as a masked, protected CI/CD variable with read_api access to the project.

Validate a pipeline file in merge requests

Set template to a project-relative YAML path to validate that file with a CI Lint dry run. In merge request pipelines, the component evaluates the file in the target branch context. Override rules when the check should also run for merge requests.

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/lint-pipeline@stable
    inputs:
      name: deployment
      template: .gitlab/ci/deployment.yml
      rules:
        - if: '$GITLAB_TOKEN == null || $GITLAB_TOKEN == ""'
          when: never
        - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
        - if: '$CI_COMMIT_REF_PROTECTED == "true"'

The job fails before calling the API when the configured file does not exist. The dry run requests the expanded configuration and compiled jobs, which also catches invalid includes, inputs, rules, and job dependencies.

Validate a generated pipeline

Use needs when another job produces the pipeline file as an artifact. The lint job can run in any existing stage.

generate:pipeline:
  stage: build
  script:
    - ./scripts/generate-pipeline > generated-pipeline.yml
  artifacts:
    paths:
      - generated-pipeline.yml

include:
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/common@stable
  - component: $CI_SERVER_FQDN/xrow-public/ci-tools/lint-pipeline@stable
    inputs:
      name: generated
      stage: test
      template: generated-pipeline.yml
      needs:
        - job: generate:pipeline
          artifacts: true

Each inclusion must use a unique name, because the value is part of the generated job name.

Inputs

Name	Description	Default	Type
---	---	---	---
name	The name of the pipeline to lint	$CI_PROJECT_NAME	string
needs	The jobs that this job depends on.	[]	array
rules	The jobs that this job depends on.	[{"if":"$GITLAB_TOKEN == null || $GITLAB_TOKEN == \"\"","when":"never"},{"if":"$CI_COMMIT_REF_PROTECTED == \"true\"","when":"on_success"}]	array
stage	The name of the stage.	lint	string
template	The path to the pipeline template. Leave empty to validate the existing project configuration.		string