Gitlab CI pipeline rules seems not take into account variables set during pipeline execution

Question

I have a pipeline used to build and deploy docker images on many environments : dev, preprod and prod. We use two different repositories for docker images in dev and prod. Creation and deployment are selected at launch time, and have defaut values. I created a job to validate values, to avoid deploy a snapshot version in production, and set docker repository to use. But it seems that rules doesn't reevaluate variables after pipeline start.

Here an simplified extract of my gitlab-ci.yaml :

variables:
  BUILD_DOCKER:
    description: Must be true to build docker images
    value: "false"
    options:
      - "true"
      - "false"
  ENVIRONNEMENT:
    description: Deployment environment
    value: "NONE"
    options:
      - "NONE"
      - "DEV"
      - "PREPROD"
      - "PROD"
  DEPLOY_SERVER: ""

stages:
  - version
  - validation
  - build
  - build-image

get-version:
  stage: version
  script:
    - 'VERSION=$(./mvnw --non-recursive help:evaluate -Dexpression=project.version -q -DforceStdout | tail -n 1)'
    - 'echo "APP_VERSION=$VERSION" >> build.env'
  artifacts:
    reports:
      dotenv:
        - build.env

# Check we don't deploy a snapshot version in production
Validate:
  stage: validation
  rules:
    - if: '$APP_VERSION =~ /SNAPSHOT$/i'
      variables:
        SNAPSHOT: "true"
        REPOSITORY: "stages"
    - if: '$APP_VERSION !~ /SNAPSHOT$/i'
      variables:
        SNAPSHOT: "false"
        REPOSITORY: "releases"
  script: |
    echo "IS_SNAPSHOT=$SNAPSHOT" >> build.env
    echo "DOCKER_REPOSITORY=$REPOSITORY" >> build.env
    if [[ $IS_SNAPSHOT == "true" ]]; then
      if [[ $ENVIRONNEMENT != "NONE" && $ENVIRONNEMENT != "DEV" ]]; then
        echo "Version SNAPSHOT can be deployed only in DEV environment."
        exit 1
      fi
    else
      if [[ $ENVIRONNEMENT == "DEV" ]]; then
        echo "Non SNAPSHOT version cannot be deployed on DEV environment."
        exit 1
      fi
    fi
  artifacts:
    reports:
      dotenv:
        - build.env

Debug:
  stage: build-image
  script: |
    echo "version : $APP_VERSION"
    echo "is snapshot : $IS_SNAPSHOT"
    echo "docker_repository : $DOCKER_REPOSITORY"
    echo "environnement : $ENVIRONNEMENT"

In logs, in debug stage, values of IS_SNAPSHOT and DOCKER_REPOSITORY are always false and releases, even if APP_VERSION is 1.0.0-SNAPSHOT.

How I can check value of APP_VERSION after it is setted during pipeline execution ?

Thanks for your help.

Edit : thanks the answer of Chris Doyle, I updated my job validate :

Validate:
  stage: validation
  script: |
    IS_SNAPSHOT=$(echo $APP_VERSION | grep -Eq 'SNAPSHOT$' && echo true || echo false)
    if [ $IS_SNAPSHOT = "true" ] ; then
      if [ $ENVIRONNEMENT != "NONE" ] && [ $ENVIRONNEMENT != "DEV" ] ; then
        echo "For a snapshot version, only the environment of DEV is allowed."
        exit 1
      fi
    else
      if [ $ENVIRONNEMENT = "DEV" ]; then
        echo "For a non -snapshot version, only the environments of Preprod or Prod are authorized."
        exit 1
      fi
    fi

Answer 1

This is exactly the documented behaviour in the docs https://docs.gitlab.com/ee/ci/yaml/#rules

Rules are evaluated when the pipeline is created, and evaluated in order.

Gitlab pipeline process evaluates the rules at pipeline creation to know which jobs to create. Since at the time of pipeline creation there is no variable called APP_VERSION then this correctly doesnt match your regex.

If you want to check it at run time then check it in the script block as shell code.