如何在GitLab CI脚本中动态修改继承的BUILD_ARGS变量？

我有如下GitLab CI作业配置：

.build-image:
  extends: .build-docker-image
  stage: build
  variables:
    COMPOSER_HOME_DIR: /kaniko/.composer
    BUILD_ARGS: >
      COMPOSER_HOME=${COMPOSER_HOME_DIR}
      COMPOSER_CACHE_READ_ONLY=1
    ADD_KANIKO_ARGS: >
      --reproducible=${REPRODUCIBLE},
      --skip-unused-stages=true,
      --target=${BUILD_TARGET}
    BUILD_ARGS: >
      BUILD_VERSION=${BUILD_VERSION},
    REPRODUCIBLE: "false"
  rules:
    - *push_to_main_branch
    - *merge_request
  id_tokens: !reference [ .gcp_jwt_token, id_tokens ]
  before_script:
    - mkdir -p $COMPOSER_HOME_DIR
    - echo "${COMPOSER_AUTH}" > $COMPOSER_HOME_DIR/auth.json

build-app-image:
  stage: release
  extends: .build-image
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: on_success
    - if: '$CI_MERGE_REQUEST_ID'
      changes:
        - src/**/*
      when: on_success
  variables:
    BUILD_TARGET: production

  before_script:
    # What I would like to happen
    - export COMPOSER_LOCK_HASH=$(sha1sum composer.lock | cut -d' ' -f1)
    - export YARN_LOCK_HASH=$(sha1sum yarn.lock | cut -d' ' -f1)
    - export PREBUILT_APP_IMAGE="europe-docker.pkg.dev/${ORG_PROJECT}/blabla/blabla-deps:sha-${COMPOSER_LOCK_HASH}"
    - export PREBUILT_ASSETS_IMAGE="europe-docker.pkg.dev/${ORG_PROJECT}/mcp/blabla-other-deps:sha-${YARN_LOCK_HASH}"
    - export BUILD_ARGS="COMPOSER_HOME=${COMPOSER_HOME_DIR}, APP_IMAGE_REF=${PREBUILT_APP_IMAGE},ASSETS_IMAGE_REF=${PREBUILT_ASSETS_IMAGE}"
    - !reference [ ".build-image", "before_script" ]

实际场景中，build-app-image作业继承自.build-image，后者又继承了公司级通用作业，这些作业通过Kaniko执行Dockerfile指令，用BUILD_ARGS变量向Dockerfile传递参数。我希望在build-app-image的before_script里动态计算镜像标签，并注入到BUILD_ARGS变量中，但遇到两个问题：

• 在build-app-image的variables里定义BUILD_ARGS的话，无法用before_script的逻辑动态覆盖它；
• 用export只能定义shell级变量，无法作用于GitLab CI/CD层面。

请问有没有办法动态修改GitLab CI/CD级别的变量？

GitLab CI本身不支持在作业执行阶段（如before_script）直接修改CI级别的声明式变量，但可以通过以下替代方案实现需求：

1. 直接重写Kaniko执行命令 #

如果公司级的.build-docker-image作业是通过脚本调用Kaniko的，你可以在build-app-image中生成动态参数，然后覆盖Kaniko的执行命令，把动态计算的参数直接传入：

build-app-image:
  # 保留原有extends、rules、variables等配置
  stage: release
  extends: .build-image
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: on_success
    - if: '$CI_MERGE_REQUEST_ID'
      changes:
        - src/**/*
      when: on_success
  variables:
    BUILD_TARGET: production

  before_script:
    - export COMPOSER_LOCK_HASH=$(sha1sum composer.lock | cut -d' ' -f1)
    - export YARN_LOCK_HASH=$(sha1sum yarn.lock | cut -d' ' -f1)
    - export PREBUILT_APP_IMAGE="europe-docker.pkg.dev/${ORG_PROJECT}/blabla/blabla-deps:sha-${COMPOSER_LOCK_HASH}"
    - export PREBUILT_ASSETS_IMAGE="europe-docker.pkg.dev/${ORG_PROJECT}/mcp/blabla-other-deps:sha-${YARN_LOCK_HASH}"
    - export DYNAMIC_BUILD_ARGS="COMPOSER_HOME=${COMPOSER_HOME_DIR}, APP_IMAGE_REF=${PREBUILT_APP_IMAGE},ASSETS_IMAGE_REF=${PREBUILT_ASSETS_IMAGE}"
    - !reference [ ".build-image", "before_script" ]
  script:
    # 替换为实际的Kaniko调用命令，将动态参数传入
    - /kaniko/executor $(echo $DYNAMIC_BUILD_ARGS | sed 's/, / --build-arg /g') $ADD_KANIKO_ARGS --destination $IMAGE_NAME

2. 使用dotenv报告传递动态变量 #

通过生成.env文件并标记为dotenv报告，可以让当前作业的脚本读取到动态变量，实现对BUILD_ARGS的覆盖：

build-app-image:
  # 保留原有配置
  before_script:
    - !reference [ ".build-image", "before_script" ]
    - export COMPOSER_LOCK_HASH=$(sha1sum composer.lock | cut -d' ' -f1)
    - export YARN_LOCK_HASH=$(sha1sum yarn.lock | cut -d' ' -f1)
    - export PREBUILT_APP_IMAGE="europe-docker.pkg.dev/${ORG_PROJECT}/blabla/blabla-deps:sha-${COMPOSER_LOCK_HASH}"
    - export PREBUILT_ASSETS_IMAGE="europe-docker.pkg.dev/${ORG_PROJECT}/mcp/blabla-other-deps:sha-${YARN_LOCK_HASH}"
    - echo "BUILD_ARGS=COMPOSER_HOME=${COMPOSER_HOME_DIR}, APP_IMAGE_REF=${PREBUILT_APP_IMAGE},ASSETS_IMAGE_REF=${PREBUILT_ASSETS_IMAGE}" > build_args.env
  artifacts:
    reports:
      dotenv: build_args.env
  script:
    # 读取动态生成的变量
    - source build_args.env
    # 执行Kaniko命令时使用该变量
    - /kaniko/executor $(echo $BUILD_ARGS | sed 's/, / --build-arg /g') $ADD_KANIKO_ARGS --destination $IMAGE_NAME

3. 拆分变量为基础+动态部分 #

在.build-image中将BUILD_ARGS拆分为基础固定部分和动态扩展部分，然后在子作业中拼接组合：

.build-image:
  extends: .build-docker-image
  stage: build
  variables:
    COMPOSER_HOME_DIR: /kaniko/.composer
    # 定义基础固定参数
    BASE_BUILD_ARGS: "COMPOSER_HOME=${COMPOSER_HOME_DIR}"
    # 留空供子作业填充动态内容
    DYNAMIC_BUILD_ARGS: ""
    ADD_KANIKO_ARGS: >
      --reproducible=${REPRODUCIBLE},
      --skip-unused-stages=true,
      --target=${BUILD_TARGET}
    REPRODUCIBLE: "false"
  rules:
    - *push_to_main_branch
    - *merge_request
  id_tokens: !reference [ .gcp_jwt_token, id_tokens ]
  before_script:
    - mkdir -p $COMPOSER_HOME_DIR
    - echo "${COMPOSER_AUTH}" > $COMPOSER_HOME_DIR/auth.json

build-app-image:
  stage: release
  extends: .build-image
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: on_success
    - if: '$CI_MERGE_REQUEST_ID'
      changes:
        - src/**/*
      when: on_success
  variables:
    BUILD_TARGET: production

  before_script:
    - !reference [ ".build-image", "before_script" ]
    - export COMPOSER_LOCK_HASH=$(sha1sum composer.lock | cut -d' ' -f1)
    - export YARN_LOCK_HASH=$(sha1sum yarn.lock | cut -d' ' -f1)
    - export PREBUILT_APP_IMAGE="europe-docker.pkg.dev/${ORG_PROJECT}/blabla/blabla-deps:sha-${COMPOSER_LOCK_HASH}"
    - export PREBUILT_ASSETS_IMAGE="europe-docker.pkg.dev/${ORG_PROJECT}/mcp/blabla-other-deps:sha-${YARN_LOCK_HASH}"
    - echo "DYNAMIC_BUILD_ARGS=APP_IMAGE_REF=${PREBUILT_APP_IMAGE},ASSETS_IMAGE_REF=${PREBUILT_ASSETS_IMAGE}" > dynamic_args.env
  artifacts:
    reports:
      dotenv: dynamic_args.env
  script:
    - source dynamic_args.env
    # 组合基础和动态参数，转换为Kaniko需要的--build-arg格式
    - COMBINED_BUILD_ARGS="${BASE_BUILD_ARGS}, ${DYNAMIC_BUILD_ARGS}"
    - /kaniko/executor $(echo $COMBINED_BUILD_ARGS | sed 's/, / --build-arg /g') $ADD_KANIKO_ARGS --destination $IMAGE_NAME

4. 规则级变量（仅适合静态场景） #

如果动态值可通过GitLab预定义变量或简单表达式生成，可使用rules:variables，但此方式不支持基于文件内容的哈希计算：

build-app-image:
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: on_success
      variables:
        BUILD_ARGS: "COMPOSER_HOME=${COMPOSER_HOME_DIR}, APP_IMAGE_REF=xxx"
    - if: '$CI_MERGE_REQUEST_ID'
      changes:
        - src/**/*
      when: on_success
      variables:
        BUILD_ARGS: "COMPOSER_HOME=${COMPOSER_HOME_DIR}, APP_IMAGE_REF=yyy"
  # 其他配置不变

内容的提问来源于stack exchange，提问作者Tarta