When should you use CI/CD variables versus environment-scoped variables in GitLab?

A regular CI/CD variable, set at the project or group level, applies to every job in every pipeline run, regardless of which branch or environment it's deploying to. That's the right choice for values that never change, like an API base URL for an internal build tool, or a package registry token.

An environment-scoped variable only applies when a job's environment matches the scope you set, such as production or staging/*. Use this when the same variable name needs a different value depending on target: a database connection string for staging shouldn't be the same value used in production, but both jobs can still reference $DATABASE_URL in their scripts without the pipeline definition changing.

Getting this wrong is a common source of incidents: a variable meant to be staging-only that's accidentally left unscoped (applying everywhere) can leak a staging credential into a production deploy job, or vice versa. Scoping variables by environment is the guardrail against that class of mistake.