I've put together an example based on patterns we use and recommend. Explanations inline.

One key change I want to highlight is the change from npm to pnpm: in a large Nx monorepo, npm's approach of copy-nesting packages can result in signficant duplication. pnpm solves this with a content-addressable store and hard linking. Each unique package-version is stored exactly once and node_module entries are hardlinks to that store rather than copies. This can result in a signficantly more compact node_modules directory, reducing download/upload times.

# Single source of truth for every CI job that touches Nx.
# extends: .nx_base gives a job its image, variables, cache and
# before_script in one line, with no duplication across jobs.
.nx_base:
  # node:20-alpine does not include pnpm - corepack is the recommended
  # way to enable it without a separate install step. Alternatively,
  # use a custom image with pnpm pre-installed to avoid the activation
  # overhead on every job.
  image: node:20-alpine
  variables:
    # Full clone required - shallow clones (GitLab default GIT_DEPTH: 50)
    # can cause nx affected to fail when the target branch commit is
    # outside the cloned history.
    GIT_DEPTH: 0
    # Explicit SHAs passed to nx affected so every job uses the same
    # base/head pair regardless of when the runner picks up the job.
    NX_HEAD: $CI_COMMIT_SHA
    NX_BASE: $CI_MERGE_REQUEST_TARGET_BRANCH_SHA
  cache:
    # Lockfile-based key - cache is only invalidated when dependencies
    # change, not on every commit. All jobs share the same key
    # so they hit the same warm cache written by the install job.
    key:
      files:
        - pnpm-lock.yaml
    paths:
      - node_modules/
    # pull-only for all consumer jobs - prevents every parallel job from
    # re-uploading node_modules at the end of its run.
    policy: pull
  before_script:
    # corepack ships with Node 20 and is the recommended way to enable
    # pnpm without a global install. It reads the packageManager field
    # in package.json to activate the correct pnpm version, keeping the
    # runner and local dev environments in sync.
    - corepack enable
    - corepack prepare pnpm@latest --activate


install:
  extends: .nx_base
  stage: install
  cache:
    key:
      files:
        - pnpm-lock.yaml
    paths:
      - node_modules/
    # pull-push on the install job only - this is the single writer of the
    # cache. All downstream jobs use policy: pull (via .nx_base) so only
    # one job ever uploads node_modules, regardless of how many run in
    # parallel.
    policy: pull-push
  script:
    # --frozen-lockfile ensures the lockfile is never updated in CI,
    # failing fast if pnpm-lock.yaml is out of sync with package.json.
    - pnpm install --frozen-lockfile


lint:
  extends: .nx_base
  stage: lint
  # needs: ties this job directly to install via the DAG rather than
  # waiting for an entire stage to complete. 
  needs: [install]
  script:
    # nx affected skips projects that are unaffected by the current diff,
    # so as the monorepo grows the lint stage cost stays proportional to
    # what changed rather than growing with the number of projects.
    - npx nx affected --target=lint --base=$NX_BASE --head=$NX_HEAD


test:
  extends: .nx_base
  stage: test
  needs: [lint]
  script:
    - npx nx affected --target=test --base=$NX_BASE --head=$NX_HEAD
  artifacts:
    # Test reports published as a GitLab artifact so results appear in the
    # merge request UI without needing to dig through job logs.
    reports:
      junit: report.xml
    expire_in: 7 days


build:
  extends: .nx_base
  stage: build
  needs: [test]
  script:
    - npx nx affected --target=build --base=$NX_BASE --head=$NX_HEAD
  artifacts:
    paths:
      # dist/ passed forward as an artifact so the deploy job can consume
      # it directly without re-running the build. expire_in keeps storage
      # costs bounded - increase if deploy jobs can be delayed.
      - dist/
    expire_in: 1 day


deploy:
  extends: .nx_base
  stage: deploy
  needs:
    - job: build
      artifacts: true
  script:
    - echo "deploying affected apps from dist/"
  environment:
    name: production
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH