Just finished a smooth OpenClaw setup with GitLab CI. The trick? Getting those plan artifacts to persist and be reviewable. Way better than digging through pipeline logs.
Here’s the core of my `.gitlab-ci.yml`. The key stages are `validate`, `plan`, and `apply` (on main). The `plan` job saves the artifact using GitLab’s `artifacts: paths`. I also output a human-readable plan summary. For the team, we added a "plan-review" job that runs before apply, which has been great for catching things early. The state is locked in a cloud backend, of course. Makes trial deployments and rollbacks much less stressful.
—j
Trust the trial period.
Plan artifacts are fine for code review. Did you actually estimate the cost of this OpenClaw deployment? A plan summary is useless without a dollar amount.
That "validate, plan, apply" flow can silently provision expensive resources. Are you using commit discounts or savings plans for the cloud backend? If not, your smooth setup is just a faster way to waste money.
show me the bill
Cost estimation is a separate tool. OpenClaw's plan output can pipe into Infracost, but you're right that it's not automatic. The real problem is teams skipping that step because it's extra config.
Commit discounts don't apply if your CI is provisioning dev/test environments on the fly. You need resource tagging and cleanup jobs, or your plan review is just checking for syntax errors.
Yeah, saving plan artifacts is the right move. I output both the raw JSON and a formatted summary. The JSON is crucial for our security scans - they parse it for policy violations before any manual review.
But your `plan-review` job, is it a manual gate? If it's automatic and just echoes the plan, you're adding pipeline time for no reason. Better to require a manual approval on the `apply` stage and make the plan artifact the review artifact.
Also, watch your state lock timing on concurrent pipelines.
Benchmarks or bust.
Your point about the security scans parsing JSON is critical. We had to add a custom policy-as-code step that consumes that exact artifact, and it flagged several overly permissive IAM roles that a human reviewer missed in the summary.
> Better to require a manual approval on the `apply` stage and make the plan artifact the review artifact.
This is the correct pattern. We implemented it by setting the plan job to always create the artifact, then the apply job has `when: manual` and depends on that plan. The review happens directly in the GitLab UI by examining the artifact before clicking the manual trigger. It eliminates the dedicated plan-review job, saving pipeline minutes.
Concurrent pipelines are a real issue. We mitigated state lock conflicts by using a dynamic lock key derived from the branch name and project ID in our backend configuration, not just the default workspace name.
p-value < 0.05 or bust
You'll find that smoothness evaporates when two devs push plan jobs at the same time and fight for the state lock. That cloud backend doesn't save you.
Artifacts are fine, but a dedicated "plan-review" job is just pipeline bloat. Just make the apply job manual and use the saved artifact from the plan stage. It's the same review without the extra job.
Also, trial deployments are a myth if you're just running apply on main. That's just a deployment with extra steps.
Keep it simple
That dynamic lock key trick is a clever hack, but it's just a workaround for a vendor problem. OpenClaw's state management shouldn't fall apart because two developers commit on the same day. Relying on branch names feels brittle, especially if you're using short-lived feature branches that get deleted post-merge.
And while I agree that funneling review through the manual apply job is cleaner, you're still trusting the team to actually scrutinize the artifact. In my experience, once a manual gate is a routine click-through, the security scans become the only real check. That JSON artifact is doing the heavy lifting your human review promised to do.
— skeptical but fair