我开发了一个GitLab CI/CD流水线，在一个作业中，我调用下游流水线来执行一个作业。

在这个下游流水线中，我传递了两个变量；第一个变量可以正确传递，但第二个变量却不行。

我收到了来自GitLab的错误信息：

无法运行流水线

• ci/sf-deploy.gitlab-ci.yml: SF\_ENV 输入: $SF\_ENV 不能使用，因为它不在允许的选项列表中

以下是我的流水线：

.gitlab-ci.yml:

default:
  tags:
    - aws-docker

stages:
  - validate
  - default-pipeline

variables:
  SF_ENV: "dev"
  DEV_BRANCH: "develop"
  QUAL_BRANCH: "release/1.48"
  VALIDATION_BRANCH: "release/1.47"
  DOCKER_IMAGE: "sfdx-20260423"

workflow:
  rules:
    - if: '$CI_COMMIT_BRANCH =~ /(master|develop|release\/)/'
    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /(master|develop|release\/)/'
    - if: '$CI_PIPELINE_SOURCE == "schedule"'
    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "$DEV_BRANCH" || $CI_COMMIT_BRANCH == "$DEV_BRANCH"'
  variables:
    SF_ENV: "dev"
- if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "$QUAL_BRANCH" || $CI_COMMIT_BRANCH == "$QUAL_BRANCH"'
  variables:
    SF_ENV: "qual"
- if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "$VALIDATION_BRANCH" || $CI_COMMIT_BRANCH == "$VALIDATION_BRANCH"'
  variables:
    SF_ENV: "validation"
- if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master" || $CI_COMMIT_BRANCH == "master"'
  variables:
    SF_ENV: "staging"

# Validate a Pull Request
validate-merge-request:
  stage: validate
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /(master|develop|release\/)/'
      when: on_success
    - when: never
  trigger:
    include:
      - local: "ci/sf-deploy.gitlab-ci.yml"
        inputs:
          DOCKER_IMAGE: "$DOCKER_IMAGE"
          SF_ENV: "$SF_ENV"

default-pipeline:
  needs: []
  rules:
    - if: '$CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /(master|develop|release\/)/'
      when: on_success
    - when: never
  stage: default-pipeline
  script:
    - echo "$SF_ENV";

sf-deploy-ci.yml:

spec:
  inputs:
    SF_ENV:
      description: "The SF environment to target"
      options: ["dev", "qual", "staging", "validation", "production"]
    DOCKER_IMAGE:
      description: "The docker image name to use from JFrog"
      type: string
    JOB_NAME:
      description: "Job to perform"
      options: ["validate", "deploy"]
      default: "validate"
---
stages:
  - validate-merge-request

.base-deploy:
  image: **************/sf-ci:$[[ inputs.DOCKER_IMAGE ]]

validate-$[[ inputs.SF_ENV ]]:
  extends: .base-deploy
  rules:
    - if: '"$[[ inputs.JOB_NAME ]]" == "validate"'
      when: on_success
    - when: never
  stage: validate-merge-request
  environment:
    name: $[[ inputs.SF_ENV ]]
  script:
    - echo "$SF_ENV";

我不明白为什么参数DOCKER_IMAGE可以正确传递，但SF_ENV不能？

在“default-pipeline”作业中，我可以读取到“dev”的值。

另外，如果我想根据目标分支来更新SF_ENV，在工作流中这样做是否正确？

解决方案

啊。GitLab仅在少数地方明确支持环境变量 ，并且大多以带有 $ 的字符串传递，让它们在目标端进行展开。

在这种情况下，当你按如下方式传递一个变量时

  trigger:
    include:
      - local: "ci/sf-deploy.gitlab-ci.yml"
        inputs:
          DOCKER_IMAGE: "$DOCKER_IMAGE"
          SF_ENV: "$SF_ENV"

它将SF_ENV作为字面量值 "$SF_ENV" 传递出去，这并不是允许的值之一。

我还没有找到一个特别优雅的解决办法，除了像以前那样把这样的值作为变量传递。

在你的场景中，这段片段可能会工作：

validate-dev-merge-request:
  extends:
    .validate-merge-request
  rules:
  - if: $SF_ENV == "dev"
  trigger:
    include:
    - local: "..."
      inputs:
        sf_env: dev

validate-prod-merge-request:
  extends:
    .validate-merge-request
  rules:
  - if: $SF_ENV == "prod"
  trigger:
    include:
    - local: "..."
      inputs:
        sf_env: prod

同样让人尴尬的替代方案是移除校验，但inputs至少让你非常明确地表述何时需要对变量进行求值：你“绝对需要它们被求值”的时候:

...
validate-merge-request:
  trigger:
    include:
    - local: "..."
      inputs:
        sf_env: $SF_ENV

spec:
  inputs:
    sf_env:
      # no options: here, so we can accept vars.
      type: string
---

# be sure to expand it so the job name isn't literally "workflow-$SF_ENV"
workflow-$[[ inputs.sf_env | expand_vars ]]:
   ...