Mastering GitLab Parent‑Child Pipelines: Interactive Playbook

Hands-on Lab

CI/CD & Deployment Rollback Lab

Click modules on the left to simulate changes, run core deployments with safe parallel locks, or hit the Emergency Rollback Panic Button to verify instant automated reversions.

Monorepo Directory Tree Click a module to edit

. (Root Aggregator)

parent-pom/

Edit Config

pom.xml

project/

mmm-security/

Foundation

mmm-core/

Core App

mmm-search/

Search App

mmm-report/

Ghost Aggregator

Selected branch context:

main

LAST EVENT DETECTED: None. Click a module above!

Orchestrator Stage Flow & Deployment Locks

Pipeline Status: IDLE

Config deploy-parent-pom

Foundation mmm-security

Build & Verify mmm-core / search

Deploy Prod resource_group

Rollback Emergency Manual

Interactive Monorepo Terminal Console

[info] Ready for pipeline execution simulation. Click elements to trigger actions.

Double-Pipeline suppression

Excludes redundant pipeline trigger sequences on branches with active open MRs.

Deploy locks

Mutex lock "core-deploy-prod" prevents race conditions on deployments.

kubectl rollout undo

Emergency rollback job reverts target components instantly on failure events.

Jump to Section

Introduction

Background & Strategic Objectives

To resolve persistent pain points including double pipeline runs on Merge Requests, fragile artifact retention, and spotty JaCoCo test visibility, we designed a comprehensive monorepo restructuring. By containerizing independent steps into self-contained sub-stages, we reduced build noise while reinforcing pipeline speed and scale.

Double Pipelines Fixed

Prevented both branch and MR pipelines from triggering for identical commits.

Centralized Blueprint

Leveraged spec:inputs and modular reference configs to cleanly reuse configurations.

Optimal Performance

Leveraged FastZip & tiered JVM optimization flags to decrease runtimes.

Structure

Multi-Module Project Layout

Our codebase leverages parent/child boundaries cleanly. The introduction of mmm-report acts as a code-free aggregation point.

. (Root Aggregator)
├── .gitlab-ci.yml           # Root Orchestrator
├── .gitlab-ci-base.yml      # Central CI Blueprint
├── pom.xml                  # Root Aggregator POM
├── parent-pom/              # Shared configuration & dependency management
│   └── pom.xml
└── project/                 # Functional module aggregator
    ├── pom.xml
    ├── mmm-security/        # Foundation module
    │   ├── .gitlab-ci.yml   # Child Pipeline
    │   └── pom.xml
    ├── mmm-core/            # Core application module
    │   ├── .gitlab-ci.yml   # Child Pipeline
    │   └── pom.xml
    ├── mmm-search/          # Search module
    │   ├── .gitlab-ci.yml   # Child Pipeline
    │   └── pom.xml
    └── mmm-report/          # Coverage reporter (Ghost Aggregator)
        └── pom.xml

Root Config

Root Orchestrator Configuration

The core router (`.gitlab-ci.yml`) determines the stage sequence, defines trigger criteria, and filters target paths to avoid running tests for unchanged directories.

workflow:
  rules:
    - if: $CI_FULL_PIPELINE == "true"
    - if: $CI_PIPELINE_SOURCE == "parent_pipeline"
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS # Suppress double pipeline runs
      when: never
    - if: $CI_COMMIT_BRANCH

stages:
  - configuration
  - foundation
  - application
  - test
  - report

.trigger-rules:
  rules:
    - if: "$CI_FULL_PIPELINE == 'true'"
      when: always
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      changes:
        compare_to: $CI_MERGE_REQUEST_TARGET_BRANCH_NAME
        paths:
          - $MODULE_PATH/**/*
          - parent-pom/**/*
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_COMMIT_BEFORE_SHA != "0000000000000000000000000000000000000000"
      changes:
        - $MODULE_PATH/**/*
        - parent-pom/**/*

Templates

Central Blueprint & Job Reference Definition

Declares global variables, cache strategies, and reusable snippets via !reference tags to streamline child pipeline builds.

variables:
  MAVEN_REPO_LOCAL: ".m2/repository"
  SONAR_USER_HOME: ".sonar"
  MAVEN_OPTS: "-Dhttps.protocols=TLSv1.2 -Djava.awt.headless=true -Xmx2048m -XX:+TieredCompilation -XX:TieredStopAtLevel=1"
  MAVEN_CLI_OPTS: "--batch-mode --errors --fail-at-end --show-version --no-transfer-progress --threads 1C -DinstallAtEnd=true -DdeployAtEnd=true"
  FF_USE_FASTZIP: "true"
  ARTIFACT_COMPRESSION_LEVEL: "fast"
  CACHE_COMPRESSION_LEVEL: "fast"

cache:
  key: "maven-$CI_COMMIT_REF_SLUG"
  paths:
    - .m2/repository/
  policy: pull-push

Deployment Rollbacks

Resource Locking & Emergency Rollbacks

To avoid concurrent deployment race conditions, we use resource groups to serialize operations, paired with manual rollback fallback commands using standard kubectl rollout undo actions.

deploy-manifests-prod:
  extends: .deploy-cluster-template
  stage: deploy
  resource_group: core-deploy-prod
  environment:
    name: prod
  script:
    - kubectl apply -k project/mmm-core/k8s/overlays/prod

rollback-prod:
  extends: .rollback-template
  stage: rollback
  needs: ["deploy-manifests-prod"]
  when: manual
  resource_group: core-deploy-prod
  variables:
    DEPLOYMENT_NAME: "mmm-core"
    K8S_NAMESPACE: "prod"
  script:
    - echo "Executing rollback deployment revert..."
    - kubectl rollout undo deployment/$DEPLOYMENT_NAME -n $K8S_NAMESPACE

Security Analysis

Shift-Left Security & SonarQube Project Splitting

By integrating automated SAST, secret detection, and dependency scanning early in developer workflow loops, security checks occur alongside active MR reviews. For SonarQube quality checks on multi-module structures, we configure isolated scanner profiles directly in each Maven module definition to prevent subsequent pipelines from overwriting metrics.

1. GitLab CI Templates Configuration (.gitlab-ci.yml)

include:
  - template: Jobs/SAST.gitlab-ci.yml
  - template: Jobs/Secret-Detection.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml

2. Independent SonarQube Maven Properties (pom.xml)

<properties>
    <sonar.version>5.5.0.6356</sonar.version>
    <sonar.projectKey>bwgjoseph:\${project.artifactId}</sonar.projectKey>
    <sonar.projectName>bwgjoseph:\${project.artifactId}</sonar.projectName>
    <sonar.organization>bwgjoseph</sonar.organization>
    <sonar.coverage.jacoco.xmlReportPaths>\${project.build.directory}/site/jacoco/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>

    <!-- SonarQube Scanner Configuration -->
    <sonar.scanner.skipSystemTruststore>true</sonar.scanner.skipSystemTruststore>
    <sonar.scanner.skipJreProvisioning>true</sonar.scanner.skipJreProvisioning>
    <!-- Java 25 support: Allow Sonar plugins to access restricted native methods -->
    <sonar.scanner.javaOpts>--enable-native-access=ALL-UNNAMED</sonar.scanner.javaOpts>
    <!-- Use CI project dir for scanner home if available, fallback to local .sonar -->
    <sonar.userHome>\${env.CI_PROJECT_DIR}/.sonar</sonar.userHome>
</properties>

Interactive CI Blueprint Config Builder

Configure pipeline performance options interactively below. See how optimization tweaks immediately update your reusable `.gitlab-ci-base.yml` configuration template.

Control Panel

Enable GitLab FastZip

Accelerates artifact/cache packing speed under heavy monorepos.

Compression Strategy

Maven Build Concurrency

Enable Safe Deploy Locks

Adds module-specific resource locking to secure production deployments.

Generated .gitlab-ci-base.yml

# Custom settings applied below

GitLab Parent-Child Pipelines