Legend
Build
Build configuration for this moduleModuleBuild
Build configuration — discriminated by module build typeDiscriminated union. Thetype field selects which schema applies.DisabledModuleBuild
Disabled build configuration for a module. Additional fields are ignored.enum
required
Build type discriminatorAllowed values:
disabledImageModuleBuild
Image build configuration for a module.enum
required
Build type discriminatorAllowed values:
image(templateable)integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
InputProperty[]
required
Build-specific inputs shown when running a module build.
Same types as module inputs — reuses the InputProperty union.See: InputProperty
string[] | null
Glob patterns, relative to the repository root, that gate this module’s
pipeline
build and deploy steps. Usually templated from a module
input so each instance sets its own, e.g.
watch_paths: << module.input.watch_paths >> with a string_array
input. Unset or empty builds and deploys on every run.When set, each pipeline run compares the commit it would build with the
commit of the instance’s latest successful deployment. If no changed
file matches a pattern, the module’s build and deploy steps are both
skipped with the cause NO_WATCHED_CHANGES. Patterns support *, **,
?, [abc] and {a,b}, and match dotfiles; a pattern starting with
! excludes files. The deploy step must be given commit_sha for the
deployment to record the commit compared against. Invalid patterns never
skip work.(templateable)Pipeline.GitSource
required
Pipeline.ImageBuildConfig
required
Builder configuration — dockerfile, nixpacks, or railpack settings.See: Pipeline.ImageBuildConfig(templateable)
Pipeline.EnvironmentVariablesValue
Environment variables available during the build.See: Pipeline.EnvironmentVariablesValue(templateable)
boolean | null
Enable verbose build output for debugging build issues.(templateable)
boolean | null
Build a SOCI-enabled image for lazy loading on AWS Fargate.
When enabled, image layers are gzip-compressed (SOCI cannot index zstd)
and a SOCI index manifest v2 is generated and pushed alongside the image.(templateable)
Pipeline.EcrDestination[]
required
ECR destinations where the built Docker image will be pushed.See: Pipeline.EcrDestination(minItems:1; templateable)
Pipeline.StepInfrastructure
required
Execution environment configuration used for the build.See: Pipeline.StepInfrastructure(templateable)
LambdaModuleBuild
Lambda build configuration for a module. Produces a zip artifact uploaded to S3, sized for the Lambda Zip package type. Wraps the existingPipeline.BuildLambdaCiStep flow — the module build
resolver hands its fields directly to that CI step. Modules that
need an ECR-packaged Lambda use a regular image-type
ModuleBuild and reference the resulting image URI from the deploy
step.enum
required
Build type discriminatorAllowed values:
lambda(templateable)integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
InputProperty[]
required
Build-specific inputs shown when running a module build.
Same types as module inputs — reuses the InputProperty union.See: InputProperty
string[] | null
Glob patterns, relative to the repository root, that gate this module’s
pipeline
build and deploy steps. Usually templated from a module
input so each instance sets its own, e.g.
watch_paths: << module.input.watch_paths >> with a string_array
input. Unset or empty builds and deploys on every run.When set, each pipeline run compares the commit it would build with the
commit of the instance’s latest successful deployment. If no changed
file matches a pattern, the module’s build and deploy steps are both
skipped with the cause NO_WATCHED_CHANGES. Patterns support *, **,
?, [abc] and {a,b}, and match dotfiles; a pattern starting with
! excludes files. The deploy step must be given commit_sha for the
deployment to record the commit compared against. Invalid patterns never
skip work.(templateable)Pipeline.GitSource
required
Pipeline.LambdaBuildConfig
required
Builder configuration — dockerfile or nixpacks settings for the
Lambda zip build. Reuses the existing
Pipeline.LambdaBuildConfig
shape so module builds and free-form CI builds stay structurally
identical.See: Pipeline.LambdaBuildConfig(templateable)Pipeline.EnvironmentVariablesValue
Environment variables available during the build.See: Pipeline.EnvironmentVariablesValue(templateable)
boolean | null
Enable verbose build output for debugging build issues.(templateable)
Pipeline.S3Destination[]
required
S3 destinations where the Lambda deployment package will be
uploaded. At least one is required; the resulting key is passed to
the deploy step as
deploy.input.s3_key.See: Pipeline.S3Destination(minItems:1; templateable)Pipeline.StepInfrastructure
required
Execution environment configuration used for the build.See: Pipeline.StepInfrastructure(templateable)
StaticModuleBuild
Static build configuration for a module.enum
required
Build type discriminatorAllowed values:
static(templateable)integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
InputProperty[]
required
Build-specific inputs shown when running a module build.
Same types as module inputs — reuses the InputProperty union.See: InputProperty
string[] | null
Glob patterns, relative to the repository root, that gate this module’s
pipeline
build and deploy steps. Usually templated from a module
input so each instance sets its own, e.g.
watch_paths: << module.input.watch_paths >> with a string_array
input. Unset or empty builds and deploys on every run.When set, each pipeline run compares the commit it would build with the
commit of the instance’s latest successful deployment. If no changed
file matches a pattern, the module’s build and deploy steps are both
skipped with the cause NO_WATCHED_CHANGES. Patterns support *, **,
?, [abc] and {a,b}, and match dotfiles; a pattern starting with
! excludes files. The deploy step must be given commit_sha for the
deployment to record the commit compared against. Invalid patterns never
skip work.(templateable)Pipeline.GitSource
required
Pipeline.StaticBuildConfig
required
Builder configuration — dockerfile, nixpacks, or railpack settings.See: Pipeline.StaticBuildConfig(templateable)
Pipeline.EnvironmentVariablesValue
Environment variables available during the build.See: Pipeline.EnvironmentVariablesValue(templateable)
boolean | null
Enable verbose build output for debugging build issues.(templateable)
Pipeline.S3Destination[]
required
S3 destinations where the built static assets will be uploaded.See: Pipeline.S3Destination(minItems:1; templateable)
Pipeline.StepInfrastructure
required
Execution environment configuration used for the build.See: Pipeline.StepInfrastructure(templateable)
Pipeline.EnvironmentVariablesValue
Environment variable map value.Supports either:- a literal map of environment variables, or
- a full template block like << pipeline.input.env_variables >> that resolves to such a map.
Pipeline.StepInfrastructure
Step infrastructure configuration, discriminated bytypeNote: Additional validation via CEL:- every infrastructure type needs exactly one target mode: execution_environment_id, or aws_account_id plus region
- an instance_size list must not mix x86_64 and ARM64 (Graviton) types
- a sandbox with disk_cache: auto needs a git source to name its disk by (a github:runner step names it by its job)
- a sandbox’s cache_paths need disk_cache, and are clean absolute directories outside the guest’s own
type field selects which schema applies.Pipeline.EnvironmentVariable
Environment variable — can be a plain string, Parameter Store reference, or Secrets Manager referenceOne of: string | null, Pipeline.ParameterStoreEnvVar, Pipeline.SecretsManagerEnvVar.Pipeline.Ec2SpotStepInfrastructure
Spot EC2 instance infrastructureenum
required
Infrastructure type — a spot EC2 instanceAllowed values:
ec2-spot(templateable)Pipeline.AwsPermissions
IAM permissions for the runner role — “attach” to add managed policies to the step defaults, or “replace” to use the listed managed policies instead of the step defaults. Accepts AWS managed and customer managed policy ARNs. EC2 runners always keep AmazonSSMManagedInstanceCore, CloudWatchAgentServerPolicy, and any inline policies Ravion adds (such as access to referenced secrets).See: Pipeline.AwsPermissions(templateable)
string | null
ID or given ID of a pre-configured execution environment(templateable)
string | null
AWS account reference for automatic network selection.Accepts either the Ravion AWS account database ID (e.g.
awsact_123) or the user-provided givenId configured on the AWS
account. The resolver normalizes the value to the DB id before any
downstream use; the givenId form is an input alias only and is never
persisted as the canonical reference.(templateable)string | null
AWS region for automatic network selection(templateable)
Pipeline.ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution environment.
Valid with or without
execution_environment_id — without one, they apply
on top of the default environment or the auto-selected network.
The whole block and each field inside it accept template tokens.See: Pipeline.ExecutionEnvironmentOverrides(templateable)string | null
AMI ID for the runner instance(templateable)
Pipeline.StorageConfig
string | string[]
required
One EC2 instance type, or a list tried in order when spot capacity is short(templateable)
Pipeline.Ec2StepInfrastructure
On-demand EC2 instance infrastructureenum
required
Infrastructure type — an on-demand EC2 instanceAllowed values:
ec2(templateable)Pipeline.AwsPermissions
IAM permissions for the runner role — “attach” to add managed policies to the step defaults, or “replace” to use the listed managed policies instead of the step defaults. Accepts AWS managed and customer managed policy ARNs. EC2 runners always keep AmazonSSMManagedInstanceCore, CloudWatchAgentServerPolicy, and any inline policies Ravion adds (such as access to referenced secrets).See: Pipeline.AwsPermissions(templateable)
string | null
ID or given ID of a pre-configured execution environment(templateable)
string | null
AWS account reference for automatic network selection.Accepts either the Ravion AWS account database ID (e.g.
awsact_123) or the user-provided givenId configured on the AWS
account. The resolver normalizes the value to the DB id before any
downstream use; the givenId form is an input alias only and is never
persisted as the canonical reference.(templateable)string | null
AWS region for automatic network selection(templateable)
Pipeline.ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution environment.
Valid with or without
execution_environment_id — without one, they apply
on top of the default environment or the auto-selected network.
The whole block and each field inside it accept template tokens.See: Pipeline.ExecutionEnvironmentOverrides(templateable)string | null
AMI ID for the runner instance(templateable)
Pipeline.StorageConfig
string | string[]
required
EC2 instance type — a single type like “t3.large” or an array like [“t3.large”, “t3.xlarge”]; when an array is given the first entry is used(templateable)
Pipeline.SandboxStepInfrastructure
Firecracker microVM infrastructure on the sandbox host pool of the resolved execution environment. With an AWS account and region target, the matching environment is created on first use if needed. A newly created environment has no sandbox pool, so the step fails until a pool is enabled on it.enum
required
Infrastructure type — a Firecracker microVM on the resolved execution environment’s sandbox host poolAllowed values:
sandbox(templateable)Pipeline.AwsPermissions
IAM permissions for the runner role — “attach” to add managed policies to the step defaults, or “replace” to use the listed managed policies instead of the step defaults. Accepts AWS managed and customer managed policy ARNs. EC2 runners always keep AmazonSSMManagedInstanceCore, CloudWatchAgentServerPolicy, and any inline policies Ravion adds (such as access to referenced secrets).See: Pipeline.AwsPermissions(templateable)
string | null
ID or given ID of a pre-configured execution environment(templateable)
string | null
AWS account reference for automatic network selection.Accepts either the Ravion AWS account database ID (e.g.
awsact_123) or the user-provided givenId configured on the AWS
account. The resolver normalizes the value to the DB id before any
downstream use; the givenId form is an input alias only and is never
persisted as the canonical reference.(templateable)string | null
AWS region for automatic network selection(templateable)
integer | auto
required
vCPUs given to the sandbox microVM.
auto lets Ravion size it from
earlier runs. Non-interruptible steps use conservative sizing and are not
automatically retried. Set interruptible: true for adaptive sizing.(min:1; templateable)integer | auto
required
Memory in GiB given to the sandbox microVM.
auto lets Ravion size it
from earlier runs. Non-interruptible steps start with at least 16 GiB, then
can use less memory based on representative measurements, with extra
headroom. They are not automatically retried. Set interruptible: true
to also let Ravion test smaller memory sizes.(min:1; templateable)integer | auto
GiB of host disk the sandbox microVM may write — the restored lineage
overlay plus everything the step builds before it is frozen. A host takes
the sandbox only when it has this much free, and stops it if it writes
more, failing the step with SandboxDiskExceeded, so a step that writes
more than the default must say so.
auto lets Ravion size it from earlier
runs. Non-interruptible steps keep extra disk headroom and reduce disk only
after representative measurements. They are not automatically retried.(min:1; templateable)string | null
Whether the sandbox keeps its disk between runs, and which disk.
off
boots the pool’s base image every run and keeps nothing. auto keeps the
step’s own disk, named by its git source and step (a GitHub runner job’s
by its repository, workflow and job), so it needs a git source. Any other
value is a key: every step in the same execution environment that names
the same key shares one disk, across repositories, pipelines and branches.
The last run to finish that succeeded, or failed in one of its own commands, publishes it.
Include repository or branch
in the key when you want that separation. Explicit keys use the fixed
main head with no branch fallback. Only auto restores from the run’s
branch, falling back to its base and default branches, and publishes to
the run’s branch. Keys are up to 200 lowercase letters, digits, ”.”,
”_” or ”-”.(minLen:1; templateable)string[] | null
Directories to keep with the build caches. A sandbox that keeps its disk
keeps everything on it between runs. A new version of the pool’s base
image moves the disk onto the new image at its next run: the build caches
go with it, and everything else starts again from the new image. A new
major version of the base image starts the build caches again too. Docker’s
images, layers and volumes, the GitHub Actions tool cache and job
workspaces, the checkout and the home directory
/root are always kept.
List another directory here when a step keeps a cache somewhere else,
such as a tool under /opt or /usr/local. Up to 16 absolute
directories, outside /proc, /sys, /dev, /run, /tmp,
/etc/ravion and /var/lib/ravion.(templateable)boolean | null
Whether the step can be stopped partway and started over. Only an
interruptible step can be placed on a spot host, and it is run again on
another host if its host is lost or reclaimed. Leave it off for steps that
change things outside the sandbox and can’t safely be cut off and repeated,
such as database migrations.(templateable)
Pipeline.ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution environment.
A sandbox runs on a host of the environment’s pool, so the host’s network
is the step’s: a step whose overrides name another security group or
subnet runs on a pool host launched into them, which is ended at its idle
timer rather than kept. The whole block and each field inside it accept
template tokens.See: Pipeline.ExecutionEnvironmentOverrides(templateable)
Pipeline.ParameterStoreEnvVar
Environment variable from AWS Parameter StorePipeline.ParameterStoreReferenceValue
required
Pipeline.SecretsManagerEnvVar
Environment variable from AWS Secrets ManagerPipeline.SecretsManagerReferenceValue
required
Pipeline.AwsPermissions
IAM policies configuration for runner roles Used by EC2-backed steps to specify additional permissionsOne of: Pipeline.AwsPermissionsAttach, Pipeline.AwsPermissionsReplace.Pipeline.ExecutionEnvironmentOverrides
Overrides applied on top of the resolved execution environment.An execution environment is a saved network placement. These fields replace individual attributes of whichever environment the step resolved — the one named byexecution_environment_id, the AWS account’s default when none was
named, or the network selected from aws_account_id plus region. Every
attribute that is not overridden keeps the resolved value.Replace semantics, not append: an overridden attribute is the only value
used. Overriding does not require naming an environment.Both the block as a whole and each field inside it are templateable, so a
security group produced by an earlier step can be wired straight in.string | null
Security group ID the runner is launched with, replacing the resolved
execution environment’s security group.(minLen:1; templateable)
string | null
Subnet ID the runner is launched into, replacing the resolved execution
environment’s subnet. It must be in the environment’s VPC, or in the VPC
vpc names.(minLen:1; templateable)string | null
VPC ID the runner runs in, replacing the resolved execution environment’s
VPC. A subnet and a security group belong to one VPC, so a VPC other than
the environment’s is taken only with
subnet and security_group naming
a subnet and a security group in it.(minLen:1; templateable)Pipeline.InstanceSize
Instance size can be a single string or array of stringsOne of: string, string[].Pipeline.StorageConfig
Root volume storage configurationenum
Volume typeAllowed values:
gp3 | gp2 | io2 | io1(templateable)integer | null
Volume size in GiB(format:int32; templateable)
integer | null
Provisioned IOPS(format:int32; templateable)
integer | null
Provisioned throughput in MiB/s(format:int32; templateable)
Pipeline.ParameterStoreReferenceValue
Parameter Store reference — shorthand string or object with optional version metadataOne of: string, Pipeline.ParameterStoreReference.Pipeline.SecretsManagerReferenceValue
Secrets Manager reference — shorthand string or object with optional JSON key/version metadataOne of: string, Pipeline.SecretsManagerReference.Pipeline.AwsPermissionsAttach
IAM policies to attach alongside step default policiesstring[]
required
IAM managed policy ARNs to attach alongside step default policies — AWS managed policies or customer managed policies in the runner’s AWS account(templateable)
Pipeline.AwsPermissionsReplace
IAM policies to replace step default policies entirelystring[]
required
IAM managed policy ARNs to use instead of step default policies — AWS managed policies or customer managed policies in the runner’s AWS account. Removes every step default policy, including AdministratorAccess on terraform:apply; EC2 runner baseline policies still apply.(templateable)
Pipeline.EbsVolumeType
EBS volume type for the runner root volumeAllowed values:gp3gp2io2io1
Pipeline.ParameterStoreReference
Parameter Store reference with optional version metadatastring
required
Parameter Store parameter name or path(templateable)
string | null
Parameter version number — defaults to latest if omitted(templateable)
Pipeline.SecretsManagerReference
Secrets Manager reference with optional JSON key and version metadatastring
required
Secret name or ARN in Secrets Manager(templateable)
string | null
JSON key to extract from a JSON-structured secret(templateable)
string | null
Secret version ID or stage — defaults to latest if omitted(templateable)