Summary and Schedule

In this lesson you will learn how to run jobs that require a CMS-specific software stack and how to access protected files in GitLab CI using the GitLab installation at CERN. We will use the use case of running CMS software (CMSSW) jobs as an example.

Prerequisite

Basic understanding of the purpose of GitLab CI and of its use. Basic understanding of using and developing in CMSSW.

Key Points

• “Special GitLab CVMFS runners are required to run CI jobs that need CVMFS, e.g. to run CMSSW.”
• “If the setup script tries to access unset variables, then that can cause the CI to fail when using strict shell scripting checks.”

	Setup Instructions	Download files required for the lesson
Duration: 00h 00m	1. Introduction to CERN GitLab CI/CD	What is GitLab CI and why should I use it? How does a GitLab pipeline work in practice? ::::::
Duration: 00h 20m	2. A simple CMSSW example	How can I compile my CMSSW analysis code? What is the correct way to add and organize my analysis code in a CMSSW work area? How can I verify that my code changes produce the expected results?
Duration: 00h 40m	3. Setting up CMSSW in GitLab CI/CD	How do I run CMSSW in GitLab CI instead of on LXPLUS or cmslpc? Which runner tags provide CVMFS access, and how do I select them? What minimal steps must go into .gitlab-ci.yml to set up CMSSW?
Duration: 01h 00m	4. Running a CMSSW analysis in GitLab CI/CD	How do I run my CMSSW analysis with GitLab CI instead of locally? How can I avoid re-downloading and rebuilding CMSSW on every CI job? How do artifacts help share build outputs between pipeline stages?
Duration: 01h 20m	5. Securely adding passwords and files to GitLab	How can I securely store my grid certificate and password in GitLab without exposing them? Why can’t I simply copy my grid certificate files into my GitLab repository? How do I restore and use grid credentials in a CI job?
Duration: 01h 40m	6. CAT services for GitLab CI	How can I access CMS data stored on EOS from GitLab CI without managing my own grid certificates? What are CAT services and why do they only work in the cms-analysis namespace? How do I request authentication tokens for EOS access and VOMS proxies in CI jobs?
Duration: 02h 00m	7. Putting It All Together: Final Run with CAT Services	How do I combine CMSSW compilation, data access, and authentication into a single CI/CD pipeline? What are the trade-offs between using personal grid credentials versus CAT services? How can I use both CAT EOS and VOMS proxy services in the same pipeline?
Duration: 02h 20m	8. EXTRA: Building a Container Image in GitLab CI/CD	How can I build a container image with my own code in a GitLab CI/CD pipeline? How can I reuse the same container building configuration across multiple jobs?
Duration: 02h 40m	Finish

The actual schedule may vary slightly depending on the topics and exercises chosen by the instructor.

Software Setup

---

To work with CERN GitLab CI/CD, you need to have Git installed on your local machine and set up SSH keys for secure communication with the GitLab server.

---

Adding Your SSH Key to CERN GitLab

To push code to your GitLab repository using SSH, you need to add your public SSH key to your CERN GitLab account.

Step 1: Check for an existing SSH key

Open a terminal and run:

BASH

ls ~/.ssh/id_rsa.pub

If the file exists, you already have an SSH key. If not, generate one with:

BASH

ssh-keygen -t rsa -b 4096 -C "your.email@cern.ch"

Press Enter to accept the default file location and set a passphrase if you wish.

Step 2: Copy your public SSH key

Run:

BASH

cat ~/.ssh/id_rsa.pub

Copy the entire output (the key).

Step 3: Add the SSH key to CERN GitLab

1. Go to CERN GitLab SSH Keys page.
2. Paste your public key into the Key field.
3. Optionally, add a title (e.g., “My Laptop”).
4. Click Add key.

You can now use SSH to interact with your GitLab repositories.

Windows

We dont have instructions for windows. Do you want to add some? Follow CONTRIBUTING.md guidelines to propose a change.

---

Create a New GitLab Project to Follow Along

To get the most out of this tutorial, create your own GitLab project and follow each step hands-on.

Step 1: Create a new project on GitLab

1. Go to GitLab CERN New Project.
2. Click “Create blank project”.
3. Enter a project name, for example: cmsdas-gitlab-cms.
4. In Project URL, ensure it reads something like gitlab.cern.ch/YOUR_USERNAME/cmsdas-gitlab-cms.
5. Set the project visibility. The default Private is fine for this tutorial.
6. Click “Create project”.

Step 2: Clone your new project locally

We recommend working in a directory called cmsdas in your home folder. Replace ${USER} with your CERN username if it differs from your local username.

BASH

mkdir -p ~/nobackup/cmsdas  #### ~/nobackup for cmslpc users
cd ~/nobackup/cmsdas
git clone ssh://git@gitlab.cern.ch:7999/${USER}/cmsdas-gitlab-cms.git
cd cmsdas-gitlab-cms

You are now ready to start adding files and configuring your project.