A GitLab CI child pipeline failing isn’t about the child pipeline itself throwing a tantrum; it’s usually the parent pipeline’s needs or trigger job failing to properly hand off or acknowledge the child’s status.
Common Causes and Fixes for Failing Child Pipelines
-
Child Pipeline Never Started (Trigger Job Timeout/Failure):
- Diagnosis: Check the
triggerjob in the parent pipeline. Look at its logs for errors related to API calls to GitLab or network issues. If the job completed successfully but the child pipeline isn’t appearing, it’s likely a permission or configuration issue. - Cause 1: Insufficient Permissions for Triggering User/Token: The user or CI/CD token used to trigger the child pipeline might not have the necessary permissions (e.g.,
create_pipelineorread_pipelineon the target project).- Fix: Ensure the project access token or user has at least "Reporter" role on the target project if it’s a different project. If it’s the same project, the CI job token usually has sufficient permissions.
- Why it works: GitLab’s API requires specific scopes and roles to initiate new pipelines. Without them, the
triggerjob will fail silently or with an authorization error.
- Cause 2: Incorrect
strategy: dependConfiguration (forneeds): If you’re usingneedsto link to a child pipeline that’s triggered by a job in the same pipeline, and that triggering job fails, theneedsdependency will also fail.- Fix: Ensure the job that triggers the child pipeline is configured correctly and doesn’t have its own dependencies that are failing. Often, the
triggerjob itself is the one that needs to be reliable. - Why it works: The
needskeyword creates a directed acyclic graph (DAG). If a preceding job in the graph fails, all subsequent jobs thatneedit will also be marked as failed.
- Fix: Ensure the job that triggers the child pipeline is configured correctly and doesn’t have its own dependencies that are failing. Often, the
- Cause 3: Network Issues or GitLab API Unavailability: Transient network problems or GitLab API downtime can prevent the trigger job from successfully initiating the child pipeline.
- Fix: Re-run the parent pipeline. If the issue persists, check GitLab’s status page for outages.
- Why it works: The
triggerjob makes an API call to GitLab. If that call fails due to network or server-side issues, the child pipeline won’t be created.
- Diagnosis: Check the
-
Child Pipeline Started but Parent Doesn’t See its Status:
- Diagnosis: The child pipeline exists and is running or has completed. However, the parent pipeline’s
needsjob is stuck in a "pending" or "failed" state without clear reasons in its logs. Check theneedsjob’s configuration fortrigger: project: pipeline: ref:. - Cause 4: Incorrect
refintriggerorneeds: Theref(branch or tag) specified in thetriggerjob’s configuration or theneedsdependency doesn’t match the branch/tag on which the child pipeline is actually running.- Fix: Ensure the
refin the parent pipeline’striggerjob (if explicitly set) or the implicitrefderived from theneedsdependency correctly targets the branch or tag. For example, if the child pipeline is triggered ondevelop, the parent’sneedsshould be looking for a pipeline ondevelop. - Why it works: GitLab matches pipelines to
needsdependencies based on the project and theref. A mismatch means the parent can’t find the child pipeline’s status.
- Fix: Ensure the
- Cause 5: Incorrect
pipeline_triggerortrigger_token: If you’re using apipeline_triggeror atrigger_tokenfor cross-project pipeline creation, and it’s expired, revoked, or has insufficient scope, the trigger will fail to create the pipeline, or the parent won’t be able to poll its status.- Fix: Regenerate or verify the
pipeline_triggerortrigger_token. Ensure it has theapiscope and is associated with a user or service account with sufficient permissions on the target project. - Why it works: These tokens are credentials for API authentication. If they are invalid, the API calls to create or monitor pipelines will be rejected.
- Fix: Regenerate or verify the
- Cause 6: Child Pipeline Not Properly Linked via
trigger:orneeds:: You might have a job that intends to trigger a child pipeline, but the syntax for linking it vianeeds:or thetrigger:keyword in the child’s.gitlab-ci.ymlis missing or incorrect.- Fix: In the parent pipeline’s
.gitlab-ci.yml, ensure the job that relies on the child pipeline has aneeds:entry pointing to the job name that triggers the child. The triggering job itself needs to correctly specify the child pipeline’s project andref(if different from the parent’s). - Example Fix:
# Parent Pipeline .gitlab-ci.yml trigger_child: stage: build trigger: project: my-group/my-project # Target project for child pipeline branch: main # If you need to pass variables: # variables: # CHILD_VAR: "value" wait_for_child: stage: test needs: - trigger_child # This job waits for the trigger_child job to complete script: - echo "Child pipeline finished. Proceeding." - Why it works: The
needs:keyword creates a dependency. GitLab associates the status of thetrigger_childjob (which initiated the child pipeline) with thewait_for_childjob.
- Fix: In the parent pipeline’s
- Diagnosis: The child pipeline exists and is running or has completed. However, the parent pipeline’s
-
Child Pipeline Completed with Errors, Parent Doesn’t Reflect It:
- Diagnosis: The child pipeline ran and finished, but the parent’s
needsjob is marked as failed. Examine the child pipeline’s logs to find the actual failure. - Cause 7: Child Pipeline Job Failure Not Propagated: Sometimes, a job within the child pipeline might fail, but the
triggerjob in the parent doesn’t correctly pick up this failure status, leading the parent’sneedsjob to incorrectly show aspassedorpendingindefinitely. This is less common with modern GitLab versions but can occur with complex DAGs or specific GitLab runner configurations.- Fix: Ensure your
.gitlab-ci.ymlin the child pipeline has jobs that are correctly marked as failed (non-zero exit codes). The parent’sneedsshould automatically reflect this. If it doesn’t, consider adding a final "check" job in the parent that explicitly queries the child pipeline’s status via the API and fails if the child has failed jobs. - Why it works: The
needsdependency relies on the upstream job’s final state. If the upstream job (thetriggerjob) doesn’t correctly report the child’s failure, the dependency chain breaks.
- Fix: Ensure your
- Diagnosis: The child pipeline ran and finished, but the parent’s
The next error you’ll likely hit after fixing child pipeline failures is the parent pipeline’s trigger job failing due to rate limiting if you’re creating too many pipelines too quickly.