# Validate GitLab pipeline options at creation time with typed inputs

> Typed inputs can reject invalid pipeline choices before jobs begin, but they are not runtime variables.

- Canonical URL: https://update.dsesecurity.com/updates/gitlab-ci-inputs-creation-time-validation-scope/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-15T13:33:45+00:00
- Modified: 2026-10-15T13:36:17+00:00
- Last reviewed by DSE: 2026-10-15
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Typed inputs can reject invalid pipeline choices before jobs begin, but they are not runtime variables.

## Potentially affected

This covers GitLab CI/CD input configuration on supported versions. It does not make arbitrary script interpolation safe or turn user-supplied pipeline options into protected secret storage.

## DSE recommendation

DSE recommends using bounded inputs for operational choices such as an approved environment or deployment mode.

## Article

Typed inputs can reject invalid pipeline choices before jobs begin, but they are not runtime variables.

## Source facts

GitLab CI/CD inputs provide typed parameters and validation when a pipeline is created. Their values are interpolated at initialization and remain fixed for the pipeline run. Inputs can restrict values through types, predefined options, and regular expressions. Their scope is the configuration file where they are defined; another included file or downstream pipeline needs an explicit input handoff. An input without a default is mandatory. GitLab warns that automatically triggered pipelines can fail to start if required inputs have no available values.

Source: [GitLab — CI/CD inputs](https://docs.gitlab.com/ci/inputs/).

## Applicability

This covers GitLab CI/CD input configuration on supported versions. It does not make arbitrary script interpolation safe or turn user-supplied pipeline options into protected secret storage.

## DSE recommendation

DSE recommends using bounded inputs for operational choices such as an approved environment or deployment mode. Define the smallest useful option set and describe the consequence of each choice in plain language. Review how manual, scheduled, merge-request, and downstream pipelines obtain their values. Choose safe defaults only where the workflow allows them; otherwise provide an explicit required value through the calling configuration. Keep credentials in the approved secret mechanism and review the scripts that consume inputs as carefully as other pipeline code.

## Verification

Test one valid option, an invalid value, and a missing mandatory input in a nonproduction pipeline. Confirm that validation occurs before jobs run. Exercise an included configuration and a downstream pipeline to verify explicit input passing, and check every automatic trigger path the project actually uses.

## Official reference

[GitLab — CI/CD inputs](https://docs.gitlab.com/ci/inputs/). Reviewed October 15, 2026.

## Primary reference

- Name: GitLab — CI/CD inputs
- Authority: docs.gitlab.com
- URL: https://docs.gitlab.com/ci/inputs/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Validate GitLab pipeline options at creation time with typed inputs,” DSE Security, https://update.dsesecurity.com/updates/gitlab-ci-inputs-creation-time-validation-scope/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.