GitLab CI子流水线触发作业规则不生效问题排查

问题场景 #

我在GitLab CI流水线中使用以下配置生成并触发子流水线：

generate-child-pipeline:
  stage: make_child_pipeline
  needs:
    - job: image-build
      optional: true
  script:
    - ./generate_pipeline.sh
  artifacts:
    paths:
      - child_pipeline-gitlab-ci.yml
  rules:
    - <assorted rules>
  tags:
  - my_tag

trigger-child-pipeline:
  stage: make_child_pipeline
  needs:
    - job: generate-child-pipeline
  trigger:
    include:
      - artifact: child_pipeline-gitlab-ci.yml
        job: generate-child-pipeline
  rules:
    - !reference [generate-child-pipeline, rules]

问题现象 #

当规则条件满足时，配置可正常运行。但规则条件不满足时，trigger-child-pipeline作业仍会被加入流水线（尽管它与generate-child-pipeline引用了完全相同的规则），直接导致流水线因YAML错误失败，错误信息如下：

'trigger-child-pipeline' job needs 'generate-child-pipeline' job, but 'generate-child-pipeline' is not in any previous stage

我尝试在trigger-child-pipeline的规则末尾添加以下配置，但完全无效——只有删除其他规则仅保留该规则时，trigger-child-pipeline才不会被加入流水线：

- if: $CI_PIPELINE_SOURCE == $CI_PIPELINE_SOURCE
      when: never

原因分析 #

GitLab CI的作业评估逻辑存在优先级差异：needs依赖检查会在规则评估的早期阶段执行。当generate-child-pipeline被规则过滤后，trigger-child-pipeline的needs依赖不存在，此时系统会直接抛出错误，而规则评估可能还未完成，导致触发作业被错误地加入流水线。此外，trigger类型作业的规则评估逻辑与普通作业存在差异，!reference引用的规则在不同作业类型下的匹配结果可能不一致。

解决方案 #

方案1：为触发作业的needs添加optional: true #

修改trigger-child-pipeline的needs配置，允许依赖作业不存在，这样当generate-child-pipeline被规则过滤时，不会触发依赖缺失错误，同时规则会控制该作业是否运行：

trigger-child-pipeline:
  stage: make_child_pipeline
  needs:
    - job: generate-child-pipeline
      optional: true  # 允许依赖作业不存在
  trigger:
    include:
      - artifact: child_pipeline-gitlab-ci.yml
        job: generate-child-pipeline
  rules:
    - !reference [generate-child-pipeline, rules]

方案2：显式添加依赖存在的规则判断 #

在引用规则后，添加条件确保只有当generate-child-pipeline的产物存在时才运行触发作业：

trigger-child-pipeline:
  stage: make_child_pipeline
  needs:
    - job: generate-child-pipeline
  trigger:
    include:
      - artifact: child_pipeline-gitlab-ci.yml
        job: generate-child-pipeline
  rules:
    - !reference [generate-child-pipeline, rules]
    # 额外判断：只有当generate-child-pipeline的产物存在时才执行
    - exists:
        - child_pipeline-gitlab-ci.yml
      when: on_success
    - when: never

内容的提问来源于stack exchange，提问作者Ben Farmer