How to be able to pass variable to rules in gitlab ci pipeline?

Question

I want to use rules in my GitLab CI pipeline to be able to check if commit is commited from desired branch and if I have any fixable issues in image that I pushed on Harbor registry.

I push that image to registry and do scan of that image on Harbor registry, then get those results in previous stages and now I want to be able to check if I have any fixable issues in that image, if I have I would like to create that job to be manual but to leave the possibility to continue with execution of pipeline and other stages that come after this. If I don't find any of those issues ( I don't have it in my APIs output form Harbor ) I just set that variable to 0 and I wat to continue with execution of pipeline normaly. That varibale for fixable issues in pipeline is called FIXABLE, I tried many ways to assign value to this varibale so rules can be able to read value of that varibale but non of these worked. I will post mu latest work down below so that anyone, who has an idea or advice can look at this. Any help would mean a lot to me. I know that rules are created immediately after the pipeline itself is created so at this moment I am not really sure how can I deal with this. Thanks in advance!

I have added value of 60 to varibale FINAL_FIXABLE to check if job would run manualy. Issue is that only this job procession results (dev branch, case one) is running even though FINAL_FIXABLE is set to 60.

After I do build and push of image, those are the stages in pipeline related to this problem:

get results (dev branch):
  stage: Results of scanning image
  image: alpine
  variables:
    RESULTS: ""
    STATUS: ""
    SEVERITY: ""
    FIXABLE: ""
  before_script:
    - apk update && apk upgrade
    - apk --no-cache add curl
    - apk add jq
    - chmod +x ./scan-script.sh
  script:
    - 'RESULTS=$(curl -H "Authorization: Basic `echo -n ${HARBOR_USER}:${HARBOR_PASSWORD} | base64`" -X GET "https://myregistry/projects/myproject/artifacts/latest?page=1&page_size=10&with_tag=true&with_label=true&with_scan_overview=true&with_signature=true&with_immutable_status=true")'
    - STATUS=$(./scan-script.sh "STATUS" "$RESULTS")
    - SEVERITY=$(./scan-script.sh "SEVERITY" "$RESULTS")
    - FIXABLE=$(./scan-script.sh "FIXABLE" "$RESULTS")
    # - echo "$FIXABLE">fixableValue.txt
    - echo "Printing the results of the image scanning process on Harbor registry:"
    - echo "status of scan:$STATUS"
    - echo "severity of scan:$SEVERITY"
    - echo "number of fixable issues:$FIXABLE"
    - echo "For more information of scan results please visit Harbor registry!"
    - FINAL_FIXABLE=$FIXABLE
    - echo $FINAL_FIXABLE
    - FINAL_FIXABLE="60"
    - echo $FINAL_FIXABLE
    - echo "$FINAL_FIXABLE">fixableValue.txt
  only:
     refs:
       - dev
       - some-test-branch
  artifacts:
    paths:
      - fixableValue.txt

get results (other branches):
  stage: Results of scanning image
  dependencies:
    - prep for build (other branches)
  image: alpine
  variables:
    RESULTS: ""
    STATUS: ""
    SEVERITY: ""
    FIXABLE: ""
  before_script:
    - apk update && apk upgrade
    - apk --no-cache add curl
    - apk add jq
    - chmod +x ./scan-script.sh
  script:
    - LATEST_TAG=$(cat tags.txt)
    - echo "Latest tag is $LATEST_TAG"
    - 'RESULTS=$(curl -H "Authorization: Basic `echo -n ${HARBOR_USER}:${HARBOR_PASSWORD} | base64`" -X GET "https://myregistry/myprojects/artifacts/"${LATEST_TAG}"?page=1&page_size=10&with_tag=true&with_label=true&with_scan_overview=true&with_signature=true&with_immutable_status=true")'
    - STATUS=$(./scan-script.sh "STATUS" "$RESULTS")
    - SEVERITY=$(./scan-script.sh "SEVERITY" "$RESULTS")
    - FIXABLE=$(./scan-script.sh "FIXABLE" "$RESULTS")
    # - echo "$FIXABLE">fixableValue.txt
    - echo "Printing the results of the image scanning process on Harbor registry:"
    - echo "status of scan:$STATUS"
    - echo "severity of scan:$SEVERITY"
    - echo "number of fixable issues:$FIXABLE"
    - echo "For more information of scan results please visit Harbor registry!"
    - FINAL_FIXABLE=$FIXABLE
    - echo $FINAL_FIXABLE
    - FINAL_FIXABLE="60"
    - echo $FINAL_FIXABLE
    - echo "$FINAL_FIXABLE">fixableValue.txt
  only:
      refs:
        - master
        - /^(([0-9]+)\.)?([0-9]+)\.x/
        - rc
  artifacts:
    paths:
      - fixableValue.txt

procession results (dev branch, case one):
  stage: Scan results processing
  dependencies:
    - get results (dev branch)
  image: alpine
  script:
    - FINAL_FIXABLE=$(cat fixableValue.txt)
    - echo $CI_COMMIT_BRANCH
    - echo $FINAL_FIXABLE
  rules:
    - if: ($CI_COMMIT_BRANCH == "dev" || $CI_COMMIT_BRANCH == "some-test-branch") && ($FINAL_FIXABLE=="0")
      when: always

procession results (dev branch, case two):
  stage: Scan results processing
  dependencies:
    - get results (dev branch)
  image: alpine
  script:
    - FINAL_FIXABLE=$(cat fixableValue.txt)
    - echo $CI_COMMIT_BRANCH
    - echo $FINAL_FIXABLE
  rules:
    - if: ($CI_COMMIT_BRANCH == "dev" || $CI_COMMIT_BRANCH == "some-test-branch") && ($FINAL_FIXABLE!="0")
      when: manual
      allow_failure: true

procession results (other branch, case one):
  stage: Scan results processing
  dependencies:
    - get results (other branches)
  image: alpine
  script:
    - FINAL_FIXABLE=$(cat fixableValue.txt)
    - echo $CI_COMMIT_BRANCH
    - echo $FINAL_FIXABLE
  rules:
    - if: ($CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "rc" || $CI_COMMIT_BRANCH =~ "/^(([0-9]+)\.)?([0-9]+)\.x/") && ($FINAL_FIXABLE=="0")
      when: always

procession results (other branch, case two):
  stage: Scan results processing
  dependencies:
    - get results (other branches)
  image: alpine
  script:
    - FINAL_FIXABLE=$(cat fixableValue.txt)
    - echo $CI_COMMIT_BRANCH
    - echo $FINAL_FIXABLE
  rules:
    - if: ($CI_COMMIT_BRANCH == "master" || $CI_COMMIT_BRANCH == "rc" || $CI_COMMIT_BRANCH =~ "/^(([0-9]+)\.)?([0-9]+)\.x/") && ($FINAL_FIXABLE!="0")
      when: manual
      allow_failure: true

Answer 1

You cannot use these methods for controlling whether jobs run with rules: because rules are evaluated at pipeline creation time and cannot be changed once the pipeline is created.

Your best option to dynamically control pipeline configuration like this would probably be dynamic child pipelines.

---

As a side note, to set environment variables for subsequent jobs, you can use artifacts:reports:dotenv. When this special artifact is passed to subsequent stages/jobs, the variables in the dotenv file will be available in the job, as if it were set in environment:

stages:
  - one
  - two

first:
  stage: one
  script: # create dotenv file with variables to pass
    - echo "VAR_NAME=foo" >> "myvariables.env"
  artifacts:
    reports: # create report to pass variables to subsequent jobs
      dotenv: "myvariables.env"

second:
  stage: two
  script: # variables from dotenv artifact will be in environment automatically
    - echo "${VAR_NAME}" # foo

You are doing basically the same thing with your .txt artifact, which works effectively the same way, but this works with less script steps. One key difference is that this can allow for somewhat more dynamic control and it will apply for some other job configuration keys that use environment variables. For example, you can set environment:url dynamically this way.