--- type: resource-type title: Job description: gitlab resource type GitLab::CI::Job name: Job lexicon: gitlab resource_type: GitLab::CI::Job --- `GitLab::CI::Job`, a resource type of the gitlab lexicon. ## Properties - `after_script` (`string | string[]`, optional) - `allow_failure` (`AllowFailure | boolean`, optional) - `artifacts` (`Artifacts`, optional) - `before_script` (`string | string[]`, optional) - `cache` (`Cache | Cache[]`, optional) - `coverage` (`string`, optional): Must be a regular expression, optionally but recommended to be quoted, and must be surrounded with '/'. Example: '/Code coverage: \d+\.\d+/' - `dependencies` (`string[]`, optional): Specify a list of job names from earlier stages from which artifacts should be loaded. By default, all previous artifacts are passed. Use an empty array to skip downloading artifacts. - `environment` (`Environment | string`, optional): Used to associate environment metadata with a deploy. Environment can have a name and URL attached to it, and will be displayed under /environments under the project. - `except` (`any`, optional): Job will run *except* for when these filtering options match. - `extends` (`string | string[]`, optional): The name of one or more jobs to inherit configuration from. - `hooks` (`Record`, optional) - `id_tokens` (`Record`, optional) - `identity` (`"google_cloud"`, optional) - `image` (`Image`, optional) - `inherit` (`Inherit`, optional) - `interruptible` (`boolean`, optional) - `manual_confirmation` (`string`, optional) - `needs` (`Need[]`, optional): The list of jobs in previous stages whose sole completion is needed to start the current job. - `only` (`any`, optional): Job will run *only* when these filtering options match. - `pages` (`Record | boolean`, optional) - `parallel` (`Parallel | number`, optional) - `publish` (`string`, optional): A path to a directory that contains the files to be published with Pages - `release` (`Release`, optional): Indicates that the job creates a Release. - `resource_group` (`string`, optional): Limit job concurrency. Can be used to ensure that the Runner will not run certain jobs simultaneously. - `retry` (`Retry | number`, optional) - `rules` (`Rule[]`, optional) - `run` (`any[]`, optional) - `script` (`string | string[]`, optional) - `secrets` (`Record`, optional) - `services` (`Service[]`, optional) - `stage` (`string | string[]`, optional): Define what stage the job will run in. - `start_in` (`string`, optional) - `tags` (`any[]`, optional) - `timeout` (`string`, optional) - `trigger` (`Trigger | string`, optional) - `variables` (`Record`, optional) - `when` (`"on_success" | "on_failure" | "always" | "never" | "manual" | "delayed"`, optional) ## Governed by - [WGL001](/rules/WGL001.md): Deprecated only/except keywords - [WGL002](/rules/WGL002.md): Missing script - [WGL003](/rules/WGL003.md): Missing stage - [WGL010](/rules/WGL010.md): Job references a stage not in the stages list - [WGL011](/rules/WGL011.md): Job has rules that always evaluate to never (unreachable) - [WGL013](/rules/WGL013.md): Invalid needs: target — dangling reference or self-reference - [WGL014](/rules/WGL014.md): Invalid extends: target — references a template not in the pipeline - [WGL017](/rules/WGL017.md): Insecure registry — Docker push/pull to non-HTTPS registry - [WGL018](/rules/WGL018.md): Missing timeout — jobs without explicit timeout may run too long - [WGL019](/rules/WGL019.md): Missing retry — deploy jobs without retry strategy - [WGL020](/rules/WGL020.md): Duplicate job names — multiple jobs resolving to same name - [WGL022](/rules/WGL022.md): Missing artifacts expiry — artifacts without expire_in cause disk bloat - [WGL023](/rules/WGL023.md): Overly broad rules — job with only when: always rule (no conditions) - [WGL024](/rules/WGL024.md): Manual without allow_failure — manual jobs block pipeline without allow_failure: true - [WGL025](/rules/WGL025.md): Missing cache key — cache without key causes collisions - [WGL026](/rules/WGL026.md): Privileged services without TLS — DinD services without DOCKER_TLS_CERTDIR - [WGL027](/rules/WGL027.md): Empty script — jobs with empty or blank script entries - [WGL028](/rules/WGL028.md): Redundant needs — needs listing jobs already implied by stage ordering - [WGL031](/rules/WGL031.md): Container image not pinned to an immutable digest - [WGL033](/rules/WGL033.md): OIDC id_token without a scoped audience - [WGL034](/rules/WGL034.md): OIDC id_token mintable from a merge-request pipeline - [WGL035](/rules/WGL035.md): Untrusted CI variable interpolated into a script command - [WGL036](/rules/WGL036.md): Privileged service / DinD reachable from merge-request pipelines - [WGL037](/rules/WGL037.md): Security gate on a regex match of an untrusted ref variable - [WGL038](/rules/WGL038.md): Secret-like variable reachable from a merge-request pipeline - [WGL039](/rules/WGL039.md): Secret-like variable printed to job logs - [WGL040](/rules/WGL040.md): Hardcoded credential in a registry login command - [WGL041](/rules/WGL041.md): Logically unsound (tautological) rules:if condition - [WGL042](/rules/WGL042.md): Unreachable rules after an unconditional match - [WGL043](/rules/WGL043.md): Match-anything regex gate in rules:if - [WGL044](/rules/WGL044.md): Public artifacts expose build output - [WGL045](/rules/WGL045.md): Artifact path that may capture a credential file - [WGL046](/rules/WGL046.md): Cache populated in a merge-request pipeline (poisoning risk) - [WGL047](/rules/WGL047.md): Software fetched and piped to a shell without verification