GitLab CICD deployment with GitLab Environment branches flow

Question

I'm trying to setup a gitlab cicd pipeline flow for my docker-based web app projects. The idea is to use the gitlab environment branches flow to make developed code bubble towards the prod environment, which is publicly exposed on the internet.

From the master branch, I develop a feature on a dedicated branch, then I open a merge request into master. If tests pass and the merge request is accepted, a particular job creates a build tagged docker image for my app, which is stored on the project container registry. This is done through a job which uses kaniko to create an image tagged both with latest and the CI_COMMIT_SHORT_SHA, to ensure image reproducibility.

Then, a merge request is opened into staging to deploy the latest tagged image into staging. If everything goes fine and I subsequently want to deploy into prod, I git tag the current commit with semantic versioning (i.e. vX.Y.Z). The tagging procedure triggers a tag pipeline with which I create a new semantic versioned image tag out of the staging image version thanks to crane (which avoids me to rebuild a new image).

Now I open a merge request into prod, which is supposed to do the deployment in production. Here I have a problem. Ideally, imho, it would be better to deploy the image with the semantic versioning tag. This is the best way to ensure reproducibility over time, and helps understanding exactly which image version is run in prod. The problem is that gitlab CICD pipeline alternatively provides the tag name or the branch name. Meaning: there is no way to access both the git tag name and the branch within a pipeline, independently of its type (branch/ tag). To me, both of them should be on the contrary available in both types of pipelines.

If I have the tag, I lose the possibility to know in which branch I am. This can cause to redeploy to prod from wherever I am tagging, which could lead to undesired deployments. Conversely, if I have the branch name, I'm sure I'm deploying when I'm merging into production, but I cannot deploy the image version I want through the git tag. Yes, I could use the COMMIT_SHORT_SHA, but this makes it useless to produce a semantic versioned tagged image in the registry, which would be the best option to know exactly what is deployed into prod.

Any idea on how to solve this problem? Thanks!

Answer 1

If I understand your question properly, you want to be able to get both commit tag and branch name in the pipeline. You can use CI_COMMIT_TAG for the tag and execute the following command to get the branch name in the variable TAG_BRANCH TAG_BRANCH=$(git branch --contains tags/CI_COMMIT_TAG).