Skip to main content
Pipeline configuration defines steps, parallel and group blocks, inputs, variants, and triggers. Use this reference when you write pipeline config files or validate generated pipeline definitions. See Pipeline config file to pull, edit, and apply a pipeline config from a version-controllable file. For a compact, machine-readable version, fetch https://api.ravion.com/pipelines/schema.md.
Pipeline builder configs still include nixpacks for existing pipelines, but it is deprecated. Use railpack for new build:image and build:static steps.

​
Legend

​
PipelineConfig

Pipeline configuration - the top-level schema
​
PipelineTrigger[]
Webhook triggers that automatically start pipeline runs on events like git pushSee: PipelineTrigger
​
PipelineInputDefinition[]
User-configurable inputs that can vary per run — environment name, image tag, feature flags, etcSee: PipelineInputDefinition
​
VariantDefinition[]
required
Deployment variants such as production, staging, or dev — each variant can lock specific input valuesSee: VariantDefinition(minItems:1)
​
Step[]
required
Ordered list of steps to execute — steps run sequentially unless wrapped in a parallel blockSee: Step(minItems:1)
​
PipelineConfigTarget
The pipeline this config is for. ravion pipeline config pull writes it, and the Ravion GitHub App reads it to find the pipeline a repository’s ravion-pipeline.yaml configures. Applying a config whose block names another pipeline is refused. It is not stored on a pipeline version.See: PipelineConfigTarget

​
Triggers

Webhook triggers that automatically start pipeline runs on events like git push

​
PipelineTrigger

Pipeline trigger definition. Discriminated by the type field so each webhook type can enforce provider-specific event values.Discriminated union. The type field selects which schema applies.

​
GenericPipelineTrigger

Pipeline trigger for generic webhooks.
​
string
required
Unique identifier for this trigger
​
boolean | null
default:"true"
Whether this trigger is active. Disabled triggers are not registered. Default: true(templateable)
​
string
required
Git repository in owner/repo or host/owner/repo format(templateable)
​
TriggerFilter
Filters to narrow which events trigger the pipelineSee: TriggerFilter
​
ConcurrencyConfig
Concurrency configuration for runs started by this trigger. An explicit key shares its configured concurrency scope with steps and blocks. Without a key, each trigger variant receives its own auto-generated scope.See: ConcurrencyConfig
​
map<string,TriggerRunVariantConfig>
required
Maps variant IDs to run configuration — keys must match declared variant IDs. At least one variant must be specified.See: TriggerRunVariantConfig
​
enum
required
Webhook type for generic webhook triggers.Allowed values: webhook

​
GithubPipelineTrigger

Pipeline trigger for GitHub webhooks.
​
string
required
Unique identifier for this trigger
​
boolean | null
default:"true"
Whether this trigger is active. Disabled triggers are not registered. Default: true(templateable)
​
string
required
Git repository in owner/repo or host/owner/repo format(templateable)
​
TriggerFilter
Filters to narrow which events trigger the pipelineSee: TriggerFilter
​
ConcurrencyConfig
Concurrency configuration for runs started by this trigger. An explicit key shares its configured concurrency scope with steps and blocks. Without a key, each trigger variant receives its own auto-generated scope.See: ConcurrencyConfig
​
map<string,TriggerRunVariantConfig>
required
Maps variant IDs to run configuration — keys must match declared variant IDs. At least one variant must be specified.See: TriggerRunVariantConfig
​
enum
required
Webhook type — determines which events are supported.Allowed values: webhook:github
​
enum
required
Webhook event type to listen for.Allowed values: push | pull_request | pull_request_review | pull_request_review_comment | pull_request_review_thread | release | deployment

​
GitlabPipelineTrigger

Pipeline trigger for GitLab webhooks.
​
string
required
Unique identifier for this trigger
​
boolean | null
default:"true"
Whether this trigger is active. Disabled triggers are not registered. Default: true(templateable)
​
string
required
Git repository in owner/repo or host/owner/repo format(templateable)
​
TriggerFilter
Filters to narrow which events trigger the pipelineSee: TriggerFilter
​
ConcurrencyConfig
Concurrency configuration for runs started by this trigger. An explicit key shares its configured concurrency scope with steps and blocks. Without a key, each trigger variant receives its own auto-generated scope.See: ConcurrencyConfig
​
map<string,TriggerRunVariantConfig>
required
Maps variant IDs to run configuration — keys must match declared variant IDs. At least one variant must be specified.See: TriggerRunVariantConfig
​
enum
required
Webhook type — determines which events are supported.Allowed values: webhook:gitlab
​
enum
required
Webhook event type to listen for.Allowed values: push | merge_request | tag_push

​
SchedulePipelineTrigger

Pipeline trigger that starts runs on a cron schedule.
​
string
required
Unique identifier for this trigger
​
boolean | null
default:"true"
Whether this trigger is active. Disabled triggers are not registered. Default: true(templateable)
​
enum
required
Trigger type for cron schedule triggers.Allowed values: schedule
​
string
required
Cron expression defining when the pipeline runs (UTC unless timezone is set). The five fields are: minute, hour, day of month, month, and day of week. Supports standard 5-field cron plus @hourly, @daily, @midnight, @weekly, @monthly, @yearly, @annually, and @every <duration> (e.g. @every 30m).
​
string
IANA timezone for evaluating the cron expression. Defaults to UTC.
​
ConcurrencyConfig
Concurrency configuration for runs started by this trigger. An explicit key shares its configured concurrency scope with steps and blocks. Without a key, each trigger variant receives its own auto-generated scope.See: ConcurrencyConfig
​
map<string,TriggerRunVariantConfig>
required
Maps variant IDs to run configuration — keys must match declared variant IDs. At least one variant must be specified.See: TriggerRunVariantConfig

​
ConcurrencyConfig

Concurrency configuration for controlling parallel execution
​
string
Unique identifier for the concurrency scope Triggers, steps, and blocks with the same key share a concurrency limit By default, the same key in different pipelines does not conflict Default: auto-generated unique key for the configured trigger, step, or block(minLen:1)
​
enum
default:"pipeline"
Where the concurrency key is shared Organization-scoped concurrency requires an explicit key Default: “pipeline”Allowed values: pipeline | organization
​
integer
default:"0"
Maximum concurrent executions allowed (0 means unlimited, 1 means sequential) Default: 0 (unlimited)(format:int32,min:0)
​
enum
default:"queue"
Behavior when the concurrency limit is reached “queue” waits for a slot; “cancel-in-progress” cancels older contenders; “cancel-intermediate” immediately replaces the oldest contender when its immutable workflow-start age is under 15 seconds and the replacement chain, anchored to the original first workflow start, is under 30 seconds. Replacements never reset the 30-second cap. Replacements can continue below capacity, including at value 1. At either age limit, it preserves the oldest and newest contenders while cancelling intermediates. Built-in deploy and terraform:apply steps cannot be cancelled by this policy after execution starts; manual cancellation and cancel-in-progress are unchanged. “skip” denies the new contender and ends the run as skipped. This controls trigger/step/block admission only and never relaxes the separate deployment-manager serialization used by deploy steps. Default: “queue”Allowed values: queue | cancel-in-progress | cancel-intermediate | skip
​
integer
Maximum queue size for “queue”; for cancelling behaviors, widens the survivor window. Unset means unlimited queue capacity; 0 means no queue and immediate denial. With “queue”, immediate denial is reported as QUEUEING_DISABLED and the pipeline run ends as cancelled with “the trigger concurrency queue was full”; “skip” also denies immediately but ends the run as skipped. For “cancel-in-progress” and “cancel-intermediate”, the survivor window is value + positive queue_size total, including the oldest contender for “cancel-intermediate”; contenders outside it are cancelled or evicted at admission even when queue_size is unset, so unset does not mean unlimited retention. For “cancel-intermediate”, the survivors are the oldest contender plus the newest contenders that fit in that total window. Within the age limits above, the oldest young contender may instead be replaced by the strictly newer run. With “cancel-intermediate” and value: 1, queue_size must be at least 1 to keep the newest waiting run while the current run finishes.(format:int32,min:0)
​
enum
default:"oldest"
Which items to discard when queue overflows Only applies when behavior is “queue” and queue_size > 0 Default: “oldest”Allowed values: oldest | newest

​
TriggerFilter

Trigger filter configuration
​
string | null
Only trigger when this branch is pushed(templateable)
​
string | null
Only trigger when a tag matching this pattern is pushed(templateable)
​
string | string[]
Only trigger for specific webhook actions. Ignored when the event payload does not include an action field.(templateable)
​
string[] | null
Only trigger when files in these paths are changed. Each entry is a glob matched against every changed file path, relative to the repository root: * matches within one path segment, ** matches across segments, and {a,b} and [abc] are supported. Dotfiles are matched, and a leading / is ignored. Prefix a pattern with ! to exclude files: a changed file counts only if it matches at least one non-! pattern and no ! pattern. When every pattern is a ! exclusion, all changed files are included first, so paths: ["!docs/**"] means “any change outside docs/”. The trigger fires when at least one changed file counts.(templateable)
​
PayloadCondition[]
Filter by webhook payload fields using dot-notation paths. All conditions must match.See: PayloadCondition

​
TriggerRepo

Git repository identifier used by webhook triggers.Type: string

​
TriggerRunVariantConfig

Per-variant run configuration for a trigger.
​
string | null
Description for the pipeline run created by this trigger variant(templateable)
​
map<string,any | null>
Input overrides for this variant run(templateable)

​
GithubWebhookEvent

GitHub webhook events that can trigger a pipelineAllowed values:
  • push
  • pull_request
  • pull_request_review
  • pull_request_review_comment
  • pull_request_review_thread
  • release
  • deployment

​
GitlabWebhookEvent

GitLab webhook events that can trigger a pipelineAllowed values:
  • push
  • merge_request
  • tag_push

​
ConcurrencyBehavior

Behavior when the concurrency limit is reachedAllowed values:
  • queue
  • cancel-in-progress
  • cancel-intermediate
  • skip

​
ConcurrencyScope

Scope used to share a concurrency limitAllowed values:
  • pipeline
  • organization

​
QueueOverflowDiscard

Queue overflow discard strategyAllowed values:
  • oldest
  • newest

​
PayloadCondition

Condition to check against a webhook payload field. Operators are evaluated in order and the first configured operator wins.
​
string
required
Dot-notation path to the payload field
​
string | null
Exact string match(templateable)
​
string | null
Substring match(templateable)
​
string | null
Glob pattern match(templateable)
​
string[] | null
Value must be one of these strings(templateable)
​
PayloadConditionMatcher
Negated payload field matcher. The condition fails when this matcher is true.See: PayloadConditionMatcher

​
PayloadConditionMatcher

Payload field matcher used by positive conditions and negated conditions.
​
string | null
Exact string match(templateable)
​
string | null
Substring match(templateable)
​
string | null
Glob pattern match(templateable)
​
string[] | null
Value must be one of these strings(templateable)

​
Inputs

User-configurable inputs that can vary per run — environment name, image tag, feature flags, etc

​
PipelineInputDefinition

Union of all pipeline input definitions, discriminated by type.Discriminated union. The type field selects which schema applies.

​
PipelineBooleanInputDefinition

Boolean pipeline input definition
​
string
required
Unique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
​
enum
required
Input type — determines the field widget and validation rulesAllowed values: boolean
​
boolean
default:"true"
Whether this input must be provided when running the pipeline
​
string
Human-readable description shown in the UI when running the pipeline
​
boolean
Default value used when no value is provided at runtime

​
PipelineNumberInputDefinition

Number pipeline input definition
​
string
required
Unique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
​
enum
required
Input type — determines the field widget and validation rulesAllowed values: number
​
boolean
default:"true"
Whether this input must be provided when running the pipeline
​
string
Human-readable description shown in the UI when running the pipeline
​
integer
Default value used when no value is provided at runtime(format:int32)
​
Module.NumberValueItem[]
Dropdown options restricting allowed valuesSee: Module.NumberValueItem
​
integer
Minimum allowed value (inclusive)(format:int32)
​
integer
Maximum allowed value (inclusive)(format:int32)

​
PipelineObjectInputDefinition

Object pipeline input definition
​
string
required
Unique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
​
enum
required
Input type — determines the field widget and validation rulesAllowed values: object
​
boolean
default:"true"
Whether this input must be provided when running the pipeline
​
string
Human-readable description shown in the UI when running the pipeline
​
any
Default value used when no value is provided at runtime

​
PipelineStringArrayInputDefinition

String array pipeline input definition
​
string
required
Unique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
​
enum
required
Input type — determines the field widget and validation rulesAllowed values: string_array
​
boolean
default:"true"
Whether this input must be provided when running the pipeline
​
string
Human-readable description shown in the UI when running the pipeline
​
string[]
Default value used when no value is provided at runtime
​
Module.ValidationPattern[]
Regex patterns each array element must matchSee: Module.ValidationPattern

​
PipelineStringInputDefinition

String pipeline input definition
​
string
required
Unique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
​
enum
required
Input type — determines the field widget and validation rulesAllowed values: string
​
boolean
default:"true"
Whether this input must be provided when running the pipeline
​
string
Human-readable description shown in the UI when running the pipeline
​
string
Default value used when no value is provided at runtime
​
Module.StringValueItem[]
Dropdown options restricting allowed valuesSee: Module.StringValueItem
​
Module.ValidationPattern[]
Regex patterns the value must matchSee: Module.ValidationPattern

​
PipelineTextInputDefinition

Text pipeline input definition
​
string
required
Unique identifier for this input — used in << pipeline.input.key >> templates(minLen:1)
​
enum
required
Input type — determines the field widget and validation rulesAllowed values: text
​
boolean
default:"true"
Whether this input must be provided when running the pipeline
​
string
Human-readable description shown in the UI when running the pipeline
​
string
Default value used when no value is provided at runtime
​
Module.ValidationPattern[]
Regex patterns the value must matchSee: Module.ValidationPattern

​
Module.NumberValueItem

A selectable option with a numeric value. Used in number input validation.values arrays.
​
string
Text shown in the dropdown — defaults to value if omitted
​
string
Extra detail shown alongside the option
​
string
Groups options under a shared heading in the dropdown
​
integer
required
Actual number sent to Terraform when this option is selected(format:int32)
​
Module.ShowWhen
Only show this option when another field has a specific valueSee: Module.ShowWhen

​
Module.ValidationPattern

A regex pattern with an error message for validation
​
string
required
JavaScript regex the input must match
​
string
required
Error shown to the user when validation fails

​
Module.StringValueItem

A selectable option with a string value. Used in string input validation.values arrays.
​
string
Text shown in the dropdown — defaults to value if omitted
​
string
Extra detail shown alongside the option
​
string
Groups options under a shared heading in the dropdown
​
string
required
Actual value sent to Terraform when this option is selected
​
Module.ShowWhen
Only show this option when another field has a specific valueSee: Module.ShowWhen

​
Module.ShowWhen

Conditional visibility mapping; array source values support contains and contains-all matching. Keys are property names, values are the expected values or conditions. The property is shown only when all conditions are met.Type: map<string,Module.ShowWhenCondition>

​
Module.ShowWhenCondition

A show_when condition.One of: string | integer | boolean | string | integer | boolean[], Module.ShowWhenNotCondition.

​
Module.ShowWhenComparableValue

Value or values to compare against in a show_when condition; arrays mean membership for scalar sources and contains-all for array sources. When the source value is scalar, an array condition matches any listed value. When the source value is an array, a scalar condition matches if the array contains that value. When the source value is an array, an array condition matches if the array contains all listed values.One of: string | integer | boolean, string | integer | boolean[].

​
Module.ShowWhenNotCondition

Negated show_when condition.
​
string | integer | boolean | string | integer | boolean[]
required
Show the property only when the source value does not match this condition.

​
Module.ShowWhenValue

Value that can be used in a show_when condition. Supports string, number, or boolean values for comparison.One of: string, integer, boolean.

​
Variants

Deployment variants such as production, staging, or dev — each variant can lock specific input values

​
VariantDefinition

Variant definition
​
string
required
Unique identifier for this variant, referenced by triggers(minLen:1)
​
string
required
Display name shown in the UI(minLen:1)
​
map<string,any | null>
Hard-coded input values for this variant — keys must match declared inputs, cannot be overridden by triggers

​
Steps

Ordered list of steps to execute — steps run sequentially unless wrapped in a parallel block

​
Step

Step - can be action, parallel, or group. This is the main recursive type for pipeline steps.One of: ActionStep, ParallelStep, GroupStep.

​
ActionStep

Union of all action step types. Discriminated by the type field on each step model. Generates oneOf + discriminator in OpenAPI, which hey-api converts to z.discriminatedUnion(). Some step schemas, such as BuildLambdaCiStep, are generated as standalone types but intentionally excluded here until they are public pipeline steps.Discriminated union. The type field selects which schema applies.

​
GroupStep

Group step - contains nested steps
​
string
required
Human-readable group label shown in pipeline UI
​
string
What this group is for, in plain language, shown in the pipeline UI Not used when running the pipeline
​
Step[]
required
See: Step(minItems:1)
​
ConcurrencyConfig
Concurrency configuration for executions within this groupSee: ConcurrencyConfig

​
ParallelStep

Parallel step - executes children concurrently
​
ParallelChild[]
required
See: ParallelChild(minItems:1)
​
string
What this parallel block is for, in plain language, shown in the pipeline UI Not used when running the pipeline
​
ConcurrencyConfig
Concurrency configuration for executions within this parallel blockSee: ConcurrencyConfig
​
enum
default:"finish-all"
How to handle failures while branches in this parallel block are running Default: “finish-all”Allowed values: cancel-all | finish-running | finish-all

​
ApprovalStep

Approval action step — pauses pipeline execution until a user explicitly approves. If timeout is omitted, the step waits indefinitely.
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: approval

​
BuildImageCiStep

Build image CI action step
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: build:image
​
GitSource
required
Git source configurationSee: GitSource(templateable)
​
ImageBuildConfig
required
Builder configuration — dockerfile, nixpacks, or railpack settings for image buildsSee: ImageBuildConfig(templateable)
​
EnvironmentVariablesValue
Environment variables available during the build — plain strings or AWS secret referencesSee: EnvironmentVariablesValue(templateable)
​
boolean | null
Enable verbose build output for debugging build issues Accepts either a boolean literal or a full template token(templateable)
​
boolean | null
Build a SOCI-enabled image for lazy loading on AWS Fargate When enabled, image layers are gzip-compressed (SOCI cannot index zstd) and a SOCI index manifest v2 is generated and pushed alongside the image Accepts either a boolean literal or a full template token(templateable)
​
EcrDestination[]
required
ECR destinations where the built Docker image will be pushedSee: EcrDestination(minItems:1; templateable)
​
StepInfrastructure
required
Execution environment configuration — required because image builds run on provisioned computeSee: StepInfrastructure(templateable)

​
BuildStaticCiStep

Build static CI action step
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: build:static
​
GitSource
required
Git source configurationSee: GitSource(templateable)
​
StaticBuildConfig
required
Builder configuration — dockerfile, nixpacks, or railpack settingsSee: StaticBuildConfig(templateable)
​
EnvironmentVariablesValue
Environment variables available during the build — plain strings or AWS secret referencesSee: EnvironmentVariablesValue(templateable)
​
boolean | null
Enable verbose build output for debugging build issues Accepts either a boolean literal or a full template token(templateable)
​
S3Destination[]
required
S3 destinations where the built static assets will be uploadedSee: S3Destination(minItems:1; templateable)
​
StepInfrastructure
required
Execution environment configuration — required because static builds run on provisioned computeSee: StepInfrastructure(templateable)

​
BuildStep

General-purpose build action step — triggers a build based on the module’s build config.By default, build steps use value: 2 with behavior: cancel-intermediate, keyed automatically by module instance and, when set, input.branch. The policy starts replacing the oldest run immediately when a strictly newer run arrives, while the oldest workflow is under 15 seconds old and the inherited replacement chain is under 30 seconds old. This lets a rapid burst collapse to its newest build, including before capacity is reached. At either age limit, the oldest and newest builds survive and intermediates are cancelled. Built-in deploy and terraform:apply execution is protected.For example, with value: 2 and arrivals at 0, 6, 12, 18, 24, 30, 36 seconds, run 5 is protected when the 30-second chain cap is reached; runs 5 and 7 survive. An explicit concurrency block opts out of this default.
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
string
required
Module instance reference — accepts the module instance row ID (e.g. mi_…), environmentGivenId.moduleGivenId, or projectGivenId.environmentGivenId.moduleGivenId.(minLen:1; templateable)
​
string | null
Human-readable description of this deployment. Defaults to the pipeline run description if omitted.(templateable)
​
enum
required
Allowed values: build
​
map<string,any | null>
User-defined build parameters passed through to the module build manager. These values are available to module build templates via << build.input.<key> >>.(templateable)

​
CustomCommandCiStep

Custom command CI action step
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
SetupAction[] | null
Setup actions to install tools before the commands run, in order, before any command. Each entry installs a tool via the Flightcontrol actions registry (ravionhq/actions).See: SetupAction(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: custom
​
GitSource
Git source configurationSee: GitSource(templateable)
​
string[]
required
Shell commands to execute in order(minItems:1; templateable)
​
EnvironmentVariablesValue
Environment variables available during command executionSee: EnvironmentVariablesValue(templateable)
​
string[]
Names of the string outputs this step publishes, readable by later steps as << steps.<id>.output.<name> >>. Commands publish values by appending “name=value” lines to the file at $RAVION_OUTPUT; values for names that are not declared here are ignored.(minItems:1)
​
StepInfrastructure
required
Execution environment configuration — required because custom commands run on provisioned computeSee: StepInfrastructure(templateable)

​
DeployStep

General-purpose deploy action step — triggers a deployment based on the module’s deployment config.Deploy steps also acquire a separate deployment-manager lock scoped to the organization and module instance, so deployments of the same module instance serialize across pipelines and other deployment entry points. The effective defaults are max_concurrent=1, queue_size=1, and queue_overflow=oldest; module-level deployment.concurrency may override queue_size and queue_overflow. An entirely zero-valued deployment concurrency object receives queue_size=1, while an explicit queue_size=0 (with the module resolver’s explicit overflow value) disables queuing. When the queue is full and overflow is oldest, the queued deployment is evicted and its workflow is denied with reason queue_rejected, resulting in a deployment failure rather than a pipeline concurrency cancellation. This serialization is independent of trigger/step/block concurrency: cancel-intermediate and other pipeline behaviors do not relax it.
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
string
required
Module instance reference — accepts the module instance row ID (e.g. mi_…), environmentGivenId.moduleGivenId, or projectGivenId.environmentGivenId.moduleGivenId.(minLen:1; templateable)
​
string | null
Human-readable description of this deployment. Defaults to the pipeline run description if omitted.(templateable)
​
string | null
ID or given ID of the execution environment the deploy’s runner is launched into. Applies to aws:eks deployments only.(templateable)
​
ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution environment. Valid with or without execution_environment_id. The whole block and each field inside it accept template tokens.See: ExecutionEnvironmentOverrides(templateable)
​
enum
required
Allowed values: deploy
​
map<string,any | null>
User-defined deploy parameters passed through to the deploy manager. These values are available to module deployment templates via << deploy.input.<key> >>.(templateable)

​
RollbackStep

Rollback action step — reverts a module to a specific previous deployment.
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: rollback
​
string
required
Deployment ID to rollback to(minLen:1; templateable)

​
SleepStep

Sleep action step — pauses pipeline execution for testing and debugging
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: sleep
​
integer
required
Sleep duration in milliseconds(format:int64; templateable)

​
TerraformApplyCiStep

Terraform apply CI action step
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: terraform:apply
​
GitSource
Git source configuration — if omitted, uses the trigger’s repositorySee: GitSource(templateable)
​
EnvironmentVariablesValue
Environment variables available during execution — plain strings or AWS secret referencesSee: EnvironmentVariablesValue(templateable)
​
enum
required
IaC tool implementation used to execute this stepAllowed values: opentofu | terraform(templateable)
​
string
required
Terraform/OpenTofu version to execute(minLen:1; templateable)
​
string | null
Stack ID used for terraform resource/execution tracking Automatically set when triggered from a stack(templateable)
​
string[] | null
Integrations whose credentials are injected into the Terraform/OpenTofu process. Each entry is an integration ID or givenId; at most one per provider.(templateable)
​
string
required
S3 URI of the plan file to apply — typically from a preceding plan step output (e.g. s3://bucket/path/to/plan.tfplan)(templateable)
​
StepInfrastructure
required
Execution environment configuration — required because Terraform apply runs on provisioned computeSee: StepInfrastructure(templateable)

​
TerraformPlanCiStep

Terraform plan CI action step
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: terraform:plan
​
GitSource
Git source configuration — if omitted, uses the trigger’s repositorySee: GitSource(templateable)
​
EnvironmentVariablesValue
Environment variables available during execution — plain strings or AWS secret referencesSee: EnvironmentVariablesValue(templateable)
​
enum
required
IaC tool implementation used to execute this stepAllowed values: opentofu | terraform(templateable)
​
string
required
Terraform/OpenTofu version to execute(minLen:1; templateable)
​
string | null
Stack ID used for terraform resource/execution tracking Automatically set when triggered from a stack(templateable)
​
string[] | null
Integrations whose credentials are injected into the Terraform/OpenTofu process. Each entry is an integration ID or givenId; at most one per provider.(templateable)
​
TerraformVariablesValue
Terraform input variables written to a .auto.tfvars.json file during plan creation — supports all HCL types and AWS secret referencesSee: TerraformVariablesValue(templateable)
​
string[] | null
Terraform tfvars file paths passed to terraform plan as -var-file flags, in the configured order. Paths are relative to this step’s Terraform source base path.(templateable)
​
string | null
S3 directory URI to upload the plan file to — overrides the default convention-based path (e.g. s3://bucket/terraform-plans/run-123)(templateable)
​
enum
default:"apply"
Type of plan to generate — “apply” (default) creates/updates resources, “destroy” tears them downAllowed values: apply | destroy(templateable)
​
StepInfrastructure
required
Execution environment configuration — required because Terraform plan runs on provisioned computeSee: StepInfrastructure(templateable)

​
TriggerPipelineStep

Trigger pipeline action step
​
string
required
Unique step identifier, used for referencing in logs and dependencies(minLen:1)
​
string
Human-readable step name shown in the pipeline UI
​
string
Why this step exists and what it does, in plain language, shown in the pipeline UI Not used when running the step
​
integer | null
Maximum execution time in seconds before the step is killed(format:int32,min:1; templateable)
​
boolean | null
Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean(templateable)
​
ConcurrencyConfig
Concurrency configuration for controlling step execution across variantsSee: ConcurrencyConfig
​
enum
required
Allowed values: trigger:pipeline
​
string
required
ID of the pipeline to trigger(minLen:1; templateable)
​
string | null
Specific pipeline version to trigger — defaults to the latest version if omitted(templateable)
​
string
required
Description to use for the triggered pipeline run(minLen:1; templateable)
​
map<string,any | null>
Input values to pass to the triggered pipeline as key-value pairs(templateable)
​
map<string,TriggerRunVariantConfig> | null
Per-variant run overrides — keys are variant IDs, values include description and optional input overridesSee: TriggerRunVariantConfig(templateable)

​
ParallelChild

Parallel child - can be action or group (no nested parallel allowed)One of: ActionStep, GroupStep.

​
ParallelFailStrategy

Strategy for handling failures within a parallel blockAllowed values:
  • cancel-all
  • finish-running
  • finish-all

​
EcrDestination

ECR destination for image builds
​
string
required
Unique destination identifier within the build step(templateable)
​
enum
required
ECR destination typeAllowed values: ecr(templateable)
​
string
required
ECR repository ARN(templateable)
​
string[] | null
Docker image tags to apply in ECR after the build finishes(templateable)

​
EnvironmentVariablesValue

Environment variable map value.Supports either:
  • a literal map of environment variables, or
  • a full template block like << pipeline.input.env_variables >> that resolves to such a map.
One of: map<string,EnvironmentVariable>, string.

​
GitSource

Git source configuration for fetching code
​
enum
required
Source type identifierAllowed values: git(templateable)
​
string
required
Full repository URL including host(templateable)
​
string
required
Branch to check out(minLen:1; templateable)
​
string | null
Git ref to check out — branch, commit SHA, tag, or other ref. Overrides branch HEAD if set.(templateable)
​
string | null
default:"."
Base path within the repository to use as the working root(templateable)

​
ImageBuildConfig

Image build configuration — discriminated by build methodDiscriminated union. The type field selects which schema applies.

​
StepInfrastructure

Step infrastructure configuration, discriminated by typeNote: Additional validation via CEL:
  • every infrastructure type needs exactly one target mode: execution_environment_id, or aws_account_id plus region
  • an instance_size list must not mix x86_64 and ARM64 (Graviton) types
  • a sandbox with disk_cache: auto needs a git source to name its disk by (a github:runner step names it by its job)
Discriminated union. The type field selects which schema applies.

​
S3Destination

S3 destination for build artifacts
​
string
required
Unique destination identifier within the build step(minLen:1; templateable)
​
enum
required
S3 destination typeAllowed values: s3(templateable)
​
string
required
S3 bucket name where built assets will be uploaded(templateable)
​
string | null
S3 directory override for the uploaded build output. When omitted, the build step generates a flat directory from the step ID, commit short SHA, and pipeline run ID.(templateable)
​
string
required
AWS region for the destination S3 bucket(templateable)

​
StaticBuildConfig

Static build configuration — discriminated by build methodDiscriminated union. The type field selects which schema applies.

​
SetupAction

A setup action that installs a tool before the step’s commands run. Resolved against the Flightcontrol actions registry (ravionhq/actions).
​
string
required
Action reference to install a tool before running commands. Shorthand (“go”, “make”) resolves to ravionhq/actions/<name>@main, or a full ref like ravionhq/actions/go@v1.(minLen:1; templateable)
​
map<string,string> | null
Inputs passed to the action, keyed by the action’s declared input names.(templateable)

​
StepOutputName

Name of an output a step publishes. Must be usable both as a shell variable name and as a << steps.<id>.output.<name> >> field.Type: string

​
ExecutionEnvironmentOverrides

Overrides applied on top of the resolved execution environment.An execution environment is a saved network placement. These fields replace individual attributes of whichever environment the step resolved — the one named by execution_environment_id, the AWS account’s default when none was named, or the network selected from aws_account_id plus region. Every attribute that is not overridden keeps the resolved value.Replace semantics, not append: an overridden attribute is the only value used. Overriding does not require naming an environment.Both the block as a whole and each field inside it are templateable, so a security group produced by an earlier step can be wired straight in.
​
string | null
Security group ID the runner is launched with, replacing the resolved execution environment’s security group.(minLen:1; templateable)
​
string | null
Subnet ID the runner is launched into, replacing the resolved execution environment’s subnet. It must be in the environment’s VPC, or in the VPC vpc names.(minLen:1; templateable)
​
string | null
VPC ID the runner runs in, replacing the resolved execution environment’s VPC. A subnet and a security group belong to one VPC, so a VPC other than the environment’s is taken only with subnet and security_group naming a subnet and a security group in it.(minLen:1; templateable)

​
IntegrationReference

Integration ID or givenIdType: string

​
TerraformTool

Supported IaC tool for terraform:* CI stepsAllowed values:
  • opentofu
  • terraform

​
TerraformPlanType

Type of Terraform plan to generateAllowed values:
  • apply
  • destroy

​
TerraformVariableFilePath

Terraform/OpenTofu tfvars file path relative to the step source base pathType: string

​
TerraformVariablesValue

Terraform variable map value.Supports either:
  • a literal map of terraform variables, or
  • a full template block like << pipeline.input.terraform_variables >> that resolves to such a map.
One of: map<string,TerraformVariable>, string.

​
EnvironmentVariable

Environment variable — can be a plain string, Parameter Store reference, or Secrets Manager referenceOne of: string | null, ParameterStoreEnvVar, SecretsManagerEnvVar.

​
GitRepoUrl

Full git repository URL including host.Type: string

​
DisabledBuildConfig

Disabled build configuration. Valid only for module-driven builds.
​
enum
required
Build method — disables module build executionAllowed values: disabled(templateable)

​
ImageDockerfileBuildConfig

Dockerfile configuration for image builds
​
enum
required
Build method — use a custom DockerfileAllowed values: dockerfile(templateable)
​
string | null
default:"Dockerfile"
Path to Dockerfile relative to source.base_path(minLen:1; templateable)
​
string | null
default:"."
Docker build context path relative to source.base_path(templateable)
​
map<string,string> | null
Explicit Docker build args passed to buildx without adding declarations to the Dockerfile. Values can be literal strings or pipeline templates.(templateable)
​
boolean | null
Whether to inject environment variables as ARG and ENV declarations after every FROM in the Dockerfile. Changing injected values invalidates every following layer, and the ENV declarations persist those values in the image. Prefer build_args when you need explicit control over ARG placement, and use BuildKit secrets for credentials. Accepts either a boolean literal or a full template token(templateable)
​
CacheFromConfig
Docker layer cache configurationSee: CacheFromConfig(templateable)

​
ImageNixpacksBuildConfig

Nixpacks configuration for image builds
​
enum
required
Build method — use Nixpacks auto-detectionAllowed values: nixpacks(templateable)
​
string | null
Nixpacks version to use(templateable)
​
string | null
Directory to run the Nixpacks build from, relative to the repository root(templateable)
​
string | null
Path to the Nixpacks configuration file relative to the repository root(templateable)
​
string[] | null
Additional Nix packages to install(templateable)
​
string[] | null
Additional apt packages to install(templateable)
​
string[] | null
Additional Nix libraries to install(templateable)
​
string | null
Custom install command(templateable)
​
string | null
Custom build command(templateable)
​
string | null
Application start command(templateable)
​
CacheFromConfig
Docker layer cache configurationSee: CacheFromConfig(templateable)

​
ImageRailpackBuildConfig

Railpack configuration for image builds
​
enum
required
Build method — use Railpack auto-detectionAllowed values: railpack(templateable)
​
string | null
Railpack version to use(templateable)
​
string | null
Custom install command(templateable)
​
string | null
Custom build command(templateable)
​
string | null
Application start command(templateable)
​
CacheFromConfig
Docker layer cache configurationSee: CacheFromConfig(templateable)

​
Ec2SpotStepInfrastructure

Spot EC2 instance infrastructure
​
enum
required
Infrastructure type — a spot EC2 instanceAllowed values: ec2-spot(templateable)
​
AwsPermissions
IAM permissions for the runner role — “attach” to add managed policies to the step defaults, or “replace” to use the listed managed policies instead of the step defaults. Accepts AWS managed and customer managed policy ARNs. EC2 runners always keep AmazonSSMManagedInstanceCore, CloudWatchAgentServerPolicy, and any inline policies Ravion adds (such as access to referenced secrets).See: AwsPermissions(templateable)
​
string | null
ID or given ID of a pre-configured execution environment(templateable)
​
string | null
AWS account reference for automatic network selection.Accepts either the Ravion AWS account database ID (e.g. awsact_123) or the user-provided givenId configured on the AWS account. The resolver normalizes the value to the DB id before any downstream use; the givenId form is an input alias only and is never persisted as the canonical reference.(templateable)
​
string | null
AWS region for automatic network selection(templateable)
​
ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution environment. Valid with or without execution_environment_id — without one, they apply on top of the default environment or the auto-selected network. The whole block and each field inside it accept template tokens.See: ExecutionEnvironmentOverrides(templateable)
​
string | null
AMI ID for the runner instance(templateable)
​
StorageConfig
Root volume storage configurationSee: StorageConfig(templateable)
​
string | string[]
required
One EC2 instance type, or a list tried in order when spot capacity is short(templateable)

​
Ec2StepInfrastructure

On-demand EC2 instance infrastructure
​
enum
required
Infrastructure type — an on-demand EC2 instanceAllowed values: ec2(templateable)
​
AwsPermissions
IAM permissions for the runner role — “attach” to add managed policies to the step defaults, or “replace” to use the listed managed policies instead of the step defaults. Accepts AWS managed and customer managed policy ARNs. EC2 runners always keep AmazonSSMManagedInstanceCore, CloudWatchAgentServerPolicy, and any inline policies Ravion adds (such as access to referenced secrets).See: AwsPermissions(templateable)
​
string | null
ID or given ID of a pre-configured execution environment(templateable)
​
string | null
AWS account reference for automatic network selection.Accepts either the Ravion AWS account database ID (e.g. awsact_123) or the user-provided givenId configured on the AWS account. The resolver normalizes the value to the DB id before any downstream use; the givenId form is an input alias only and is never persisted as the canonical reference.(templateable)
​
string | null
AWS region for automatic network selection(templateable)
​
ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution environment. Valid with or without execution_environment_id — without one, they apply on top of the default environment or the auto-selected network. The whole block and each field inside it accept template tokens.See: ExecutionEnvironmentOverrides(templateable)
​
string | null
AMI ID for the runner instance(templateable)
​
StorageConfig
Root volume storage configurationSee: StorageConfig(templateable)
​
string | string[]
required
EC2 instance type — a single type like “t3.large” or an array like [“t3.large”, “t3.xlarge”]; when an array is given the first entry is used(templateable)

​
SandboxStepInfrastructure

Firecracker microVM infrastructure on the sandbox host pool of the resolved execution environment. With an AWS account and region target, the matching environment is created on first use if needed. A newly created environment has no sandbox pool, so the step fails until a pool is enabled on it.
​
enum
required
Infrastructure type — a Firecracker microVM on the resolved execution environment’s sandbox host poolAllowed values: sandbox(templateable)
​
AwsPermissions
IAM permissions for the runner role — “attach” to add managed policies to the step defaults, or “replace” to use the listed managed policies instead of the step defaults. Accepts AWS managed and customer managed policy ARNs. EC2 runners always keep AmazonSSMManagedInstanceCore, CloudWatchAgentServerPolicy, and any inline policies Ravion adds (such as access to referenced secrets).See: AwsPermissions(templateable)
​
string | null
ID or given ID of a pre-configured execution environment(templateable)
​
string | null
AWS account reference for automatic network selection.Accepts either the Ravion AWS account database ID (e.g. awsact_123) or the user-provided givenId configured on the AWS account. The resolver normalizes the value to the DB id before any downstream use; the givenId form is an input alias only and is never persisted as the canonical reference.(templateable)
​
string | null
AWS region for automatic network selection(templateable)
​
integer
required
vCPUs given to the sandbox microVM(format:int32,min:1; templateable)
​
integer
required
Memory in GiB given to the sandbox microVM(format:int32,min:1; templateable)
​
integer | null
GiB of host disk the sandbox microVM may write — the restored lineage overlay plus everything the step builds before it is frozen. A host takes the sandbox only when it has this much free, and stops it if it writes more, failing the step with SandboxDiskExceeded, so a step that writes more than the default must say so.(format:int32,min:1; templateable)
​
string | null
Whether the sandbox keeps its disk between runs, and which disk. off boots the pool’s base image every run and keeps nothing. auto keeps the step’s own disk, named by its git source and step (a GitHub runner job’s by its repository, workflow and job), so it needs a git source. Any other value is a key: every step in the same execution environment that names the same key shares one disk, across repositories, pipelines and branches. The last green run to finish publishes it. Include repository or branch in the key when you want that separation. Explicit keys use the fixed main head with no branch fallback. Only auto restores from the run’s branch, falling back to its base and default branches, and publishes to the run’s branch. Keys are up to 200 lowercase letters, digits, ”.”, ”_” or ”-”.(minLen:1; templateable)
​
boolean | null
Whether the step can be stopped partway and started over. Only an interruptible step can be placed on a spot host, and it is run again on another host if its host is lost or reclaimed. Leave it off for steps that change things outside the sandbox and can’t safely be cut off and repeated, such as database migrations.(templateable)
​
ExecutionEnvironmentOverrides
Overrides for individual attributes of the resolved execution environment. A sandbox runs on a host of the environment’s pool, so the host’s network is the step’s: a step whose overrides name another security group or subnet runs on a pool host launched into them, which is ended at its idle timer rather than kept. The whole block and each field inside it accept template tokens.See: ExecutionEnvironmentOverrides(templateable)

​
StaticDockerfileBuildConfig

Dockerfile configuration for static builds
​
enum
required
Build method — use a custom DockerfileAllowed values: dockerfile(templateable)
​
string | null
default:"Dockerfile"
Path to Dockerfile relative to source.base_path(minLen:1; templateable)
​
string | null
default:"."
Docker build context path relative to source.base_path(templateable)
​
map<string,string> | null
Explicit Docker build args passed to buildx without adding declarations to the Dockerfile. Values can be literal strings or pipeline templates.(templateable)
​
boolean | null
Whether to inject environment variables as ARG and ENV declarations after every FROM in the Dockerfile. Changing injected values invalidates every following layer, and the ENV declarations persist those values in the image. Prefer build_args when you need explicit control over ARG placement, and use BuildKit secrets for credentials. Accepts either a boolean literal or a full template token(templateable)
​
string
required
Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path(minLen:1; templateable)

​
StaticNixpacksBuildConfig

Nixpacks configuration for static builds
​
enum
required
Build method — use Nixpacks auto-detectionAllowed values: nixpacks(templateable)
​
string | null
Nixpacks version to use(templateable)
​
string | null
Directory to run the Nixpacks build from, relative to the repository root(templateable)
​
string | null
Path to the Nixpacks configuration file relative to the repository root(templateable)
​
string[] | null
Additional Nix packages to install(templateable)
​
string[] | null
Additional apt packages to install(templateable)
​
string[] | null
Additional Nix libraries to install(templateable)
​
string | null
Custom install command(templateable)
​
string | null
Custom build command(templateable)
​
string
required
Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path(minLen:1; templateable)

​
StaticRailpackBuildConfig

Railpack configuration for static builds
​
enum
required
Build method — use Railpack auto-detectionAllowed values: railpack(templateable)
​
string | null
Railpack version to use(templateable)
​
string | null
Custom install command(templateable)
​
string | null
Custom build command(templateable)
​
string
required
Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path(minLen:1; templateable)

​
TerraformVariable

Terraform variable — can be any JSON value (string, number, boolean, null, array, object), a Parameter Store reference, or a Secrets Manager referenceOne of: ParameterStoreEnvVar, SecretsManagerEnvVar, any | null.

​
ParameterStoreEnvVar

Environment variable from AWS Parameter Store
​
ParameterStoreReferenceValue
required
Parameter Store referenceSee: ParameterStoreReferenceValue(templateable)

​
SecretsManagerEnvVar

Environment variable from AWS Secrets Manager
​
SecretsManagerReferenceValue
required
Secrets Manager referenceSee: SecretsManagerReferenceValue(templateable)

​
CacheFromConfig

Configuration for Docker layer cache source from ECR
​
string | null
Specific image digest to use for cache(templateable)
​
string | null
Specific image tag to use for cache(templateable)

​
AwsPermissions

IAM policies configuration for runner roles Used by EC2-backed steps to specify additional permissionsOne of: AwsPermissionsAttach, AwsPermissionsReplace.

​
InstanceSize

Instance size can be a single string or array of stringsOne of: string, string[].

​
StorageConfig

Root volume storage configuration
​
enum
Volume typeAllowed values: gp3 | gp2 | io2 | io1(templateable)
​
integer | null
Volume size in GiB(format:int32; templateable)
​
integer | null
Provisioned IOPS(format:int32; templateable)
​
integer | null
Provisioned throughput in MiB/s(format:int32; templateable)

​
ParameterStoreReferenceValue

Parameter Store reference — shorthand string or object with optional version metadataOne of: string, ParameterStoreReference.

​
SecretsManagerReferenceValue

Secrets Manager reference — shorthand string or object with optional JSON key/version metadataOne of: string, SecretsManagerReference.

​
AwsPermissionsAttach

IAM policies to attach alongside step default policies
​
string[]
required
IAM managed policy ARNs to attach alongside step default policies — AWS managed policies or customer managed policies in the runner’s AWS account(templateable)

​
AwsPermissionsReplace

IAM policies to replace step default policies entirely
​
string[]
required
IAM managed policy ARNs to use instead of step default policies — AWS managed policies or customer managed policies in the runner’s AWS account. Removes every step default policy, including AdministratorAccess on terraform:apply; EC2 runner baseline policies still apply.(templateable)

​
EbsVolumeType

EBS volume type for the runner root volumeAllowed values:
  • gp3
  • gp2
  • io2
  • io1

​
ParameterStoreReference

Parameter Store reference with optional version metadata
​
string
required
Parameter Store parameter name or path(templateable)
​
string | null
Parameter version number — defaults to latest if omitted(templateable)

​
SecretsManagerReference

Secrets Manager reference with optional JSON key and version metadata
​
string
required
Secret name or ARN in Secrets Manager(templateable)
​
string | null
JSON key to extract from a JSON-structured secret(templateable)
​
string | null
Secret version ID or stage — defaults to latest if omitted(templateable)

​
Other types

​
PipelineConfigTarget

The pipeline a pipeline config file is for. It identifies the target and is never stored on a pipeline version.
​
string
Pipeline ID, such as pipe_3HpMAgQNqx2TTUDEakfaELp3hi3
​
string
Pipeline given ID, used when the file has no id. A given ID is unique within its project, so project names the project too.
​
string
The pipeline’s project, by ID or given ID; required with givenId
​
string
Pipeline name, for readers of the file

​
Template expressions

Fields marked templateable accept << expression >> template tokens.
  • Block mode preserves the resolved type:
  • Interpolation mode always produces a string:
Supported operators: +, -, *, /, %, >, <, >=, <=, ==, !=, &&, ||, !.Ternary: << condition ? trueVal : falseVal >>. Default fallback: << input.x || "fallback" >>.Access: array[0], map["key"], map.key. Functions: len(), upper(), lower().Escaping: write \<< to emit a literal <<; an escaped block is kept as text and never evaluated. A backslash that itself needs to be literal doubles (\\<< is a live template preceded by a backslash).Available namespaces: pipeline.input.*, pipeline.run.{id,description}, pipeline.variant.{id,name}, steps.{id}.{output,input}.*, step.input.*, environments.{env}.modules.{module}.output.* and projects.{project}.environments.{env}.modules.{module}.output.* (last-applied stack outputs of a module; steps and variants only — bare modules.* is not allowed in pipeline configs), trigger.payload.{branch,commit,ref,repository,event,tag}.