<pipeline-schema>

legend: ! required, ? optional, = default, T[] array, map<str,T> string-keyed map, oneof(k) union by k, ~template templateable

schema PipelineConfig:
  # Pipeline configuration - the top-level schema
  variants: VariantDefinition[]! # Deployment variants such as production, staging, or dev — each variant can lock specific input values
  triggers: PipelineTrigger[]? # Webhook triggers that automatically start pipeline runs on events like git push
  inputs: PipelineInputDefinition[]? # User-configurable inputs that can vary per run — environment name, image tag, feature flags, etc
  steps: Step[]! {minItems:1} # Ordered list of steps to execute — steps run sequentially unless wrapped in a parallel block
  rollback: Step[]? # Steps to execute if the pipeline fails — runs in order after a failure is detected

schema PipelineInputDefinition:
  # Union of all pipeline input definitions, discriminated by `type`.
  oneof(type):
    boolean: PipelineBooleanInputDefinition
    number: PipelineNumberInputDefinition
    object: PipelineObjectInputDefinition
    string: PipelineStringInputDefinition
    string_array: PipelineStringArrayInputDefinition
    text: PipelineTextInputDefinition

schema PipelineTrigger:
  # Pipeline trigger definition.
  oneof(type):
    webhook: GenericPipelineTrigger
    "webhook:github": GithubPipelineTrigger
    "webhook:gitlab": GitlabPipelineTrigger

schema Step:
  # Step - can be action, parallel, or group.
  oneof: ActionStep | ParallelStep | GroupStep

schema VariantDefinition:
  # Variant definition
  id: str! {minLen:1} # Unique identifier for this variant, referenced by triggers
  name: str! {minLen:1} # Display name shown in the UI
  input: map<str,any | null>? # Hard-coded input values for this variant — keys must match declared inputs, cannot be overridden by triggers

schema PipelineBooleanInputDefinition:
  # Boolean pipeline input definition
  id: str! {minLen:1} # Unique identifier for this input — used in << pipeline.input.key >> templates
  type: boolean! # Input type — determines the field widget and validation rules
  required: bool? = true # Whether this input must be provided when running the pipeline
  description: str? # Human-readable description shown in the UI when running the pipeline
  default: bool? # Default value used when no value is provided at runtime

schema PipelineNumberInputDefinition:
  # Number pipeline input definition
  id: str! {minLen:1} # Unique identifier for this input — used in << pipeline.input.key >> templates
  type: number! # Input type — determines the field widget and validation rules
  required: bool? = true # Whether this input must be provided when running the pipeline
  description: str? # Human-readable description shown in the UI when running the pipeline
  default: int? {format:int32} # Default value used when no value is provided at runtime
  values: Module.NumberValueItem[]? # Dropdown options restricting allowed values
  min: int? {format:int32} # Minimum allowed value (inclusive)
  max: int? {format:int32} # Maximum allowed value (inclusive)

schema PipelineObjectInputDefinition:
  # Object pipeline input definition
  id: str! {minLen:1} # Unique identifier for this input — used in << pipeline.input.key >> templates
  type: object! # Input type — determines the field widget and validation rules
  required: bool? = true # Whether this input must be provided when running the pipeline
  description: str? # Human-readable description shown in the UI when running the pipeline
  default: any? # Default value used when no value is provided at runtime

schema PipelineStringArrayInputDefinition:
  # String array pipeline input definition
  id: str! {minLen:1} # Unique identifier for this input — used in << pipeline.input.key >> templates
  type: string_array! # Input type — determines the field widget and validation rules
  required: bool? = true # Whether this input must be provided when running the pipeline
  description: str? # Human-readable description shown in the UI when running the pipeline
  default: str[]? # Default value used when no value is provided at runtime
  patterns: Module.ValidationPattern[]? # Regex patterns each array element must match

schema PipelineStringInputDefinition:
  # String pipeline input definition
  id: str! {minLen:1} # Unique identifier for this input — used in << pipeline.input.key >> templates
  type: string! # Input type — determines the field widget and validation rules
  required: bool? = true # Whether this input must be provided when running the pipeline
  description: str? # Human-readable description shown in the UI when running the pipeline
  default: str? # Default value used when no value is provided at runtime
  values: Module.StringValueItem[]? # Dropdown options restricting allowed values
  patterns: Module.ValidationPattern[]? # Regex patterns the value must match

schema PipelineTextInputDefinition:
  # Text pipeline input definition
  id: str! {minLen:1} # Unique identifier for this input — used in << pipeline.input.key >> templates
  type: text! # Input type — determines the field widget and validation rules
  required: bool? = true # Whether this input must be provided when running the pipeline
  description: str? # Human-readable description shown in the UI when running the pipeline
  default: str? # Default value used when no value is provided at runtime
  patterns: Module.ValidationPattern[]? # Regex patterns the value must match

schema GenericPipelineTrigger:
  # Pipeline trigger for generic webhooks.
  id: str! # Unique identifier for this trigger
  repo: str! ~template # Git repository in owner/repo or host/owner/repo format
  filter: TriggerFilter? # Filters to narrow which events trigger the pipeline
  run: map<str,TriggerRunVariantConfig>! # Maps variant IDs to run configuration — keys must match declared variant IDs.
  type: webhook! # Webhook type for generic webhook triggers.

schema GithubPipelineTrigger:
  # Pipeline trigger for GitHub webhooks.
  id: str! # Unique identifier for this trigger
  repo: str! ~template # Git repository in owner/repo or host/owner/repo format
  filter: TriggerFilter? # Filters to narrow which events trigger the pipeline
  run: map<str,TriggerRunVariantConfig>! # Maps variant IDs to run configuration — keys must match declared variant IDs.
  type: "webhook:github"! # Webhook type — determines which events are supported.
  event: enum[push,pull_request,pull_request_review,pull_request_review_comment,pull_request_review_thread,release,deployment]! # Webhook event type to listen for.

schema GitlabPipelineTrigger:
  # Pipeline trigger for GitLab webhooks.
  id: str! # Unique identifier for this trigger
  repo: str! ~template # Git repository in owner/repo or host/owner/repo format
  filter: TriggerFilter? # Filters to narrow which events trigger the pipeline
  run: map<str,TriggerRunVariantConfig>! # Maps variant IDs to run configuration — keys must match declared variant IDs.
  type: "webhook:gitlab"! # Webhook type — determines which events are supported.
  event: enum[push,merge_request,tag_push]! # Webhook event type to listen for.

schema ActionStep:
  # Union of all action step types.
  oneof(type):
    approval: ApprovalStep
    build: BuildStep
    "build:image": BuildImageCiStep
    "build:static": BuildStaticCiStep
    custom: CustomCommandCiStep
    deploy: DeployStep
    rollback: RollbackStep
    sleep: SleepStep
    "terraform:apply": TerraformApplyCiStep
    "terraform:plan": TerraformPlanCiStep
    "trigger:pipeline": TriggerPipelineStep

schema GroupStep:
  # Group step - contains nested steps
  group: str! # Human-readable group label shown in pipeline UI
  steps: Step[]! {minItems:1}
  concurrency: ConcurrencyConfig? # Concurrency configuration for executions within this group

schema ParallelStep:
  # Parallel step - executes children concurrently
  parallel: ParallelChild[]! {minItems:1}
  concurrency: ConcurrencyConfig? # Concurrency configuration for executions within this parallel block
  fail_strategy: enum[cancel-all,finish-running,finish-all]? = cancel-all # How to handle failures while branches in this parallel block are running

schema Module.NumberValueItem:
  # A selectable option with a numeric value.
  label: str? # Text shown in the dropdown
  description: str? # Extra detail shown alongside the option
  group_label: str? # Groups options under a shared heading in the dropdown
  value: int! {format:int32} # Actual number sent to Terraform when this option is selected
  show_when: Module.ShowWhen? # Only show this option when another field has a specific value

schema Module.ValidationPattern:
  # A regex pattern with an error message for validation
  pattern: str! # JavaScript regex the input must match
  message: str! # Error shown to the user when validation fails

schema Module.StringValueItem:
  # A selectable option with a string value.
  label: str? # Text shown in the dropdown
  description: str? # Extra detail shown alongside the option
  group_label: str? # Groups options under a shared heading in the dropdown
  value: str! # Actual value sent to Terraform when this option is selected
  show_when: Module.ShowWhen? # Only show this option when another field has a specific value

schema TriggerFilter:
  # Trigger filter configuration
  branch: str | null? ~template # Only trigger when this branch is pushed
  tag: str | null? ~template # Only trigger when a tag matching this pattern is pushed
  action: str | str[]? ~template # Only trigger for specific webhook actions.
  paths: str[] | null? ~template # Only trigger when files in these paths are changed
  payload: PayloadCondition[]? # Filter by webhook payload fields using dot-notation paths.

schema TriggerRepo:
  # Git repository identifier used by webhook triggers.
  type: str

schema TriggerRunVariantConfig:
  # Per-variant run configuration for a trigger.
  description: str | null? ~template # Description for the pipeline run created by this trigger variant
  input: map<str,any | null>? ~template # Input overrides for this variant run

schema GithubWebhookEvent:
  # GitHub webhook events that can trigger a pipeline
  type: enum[push,pull_request,pull_request_review,pull_request_review_comment,pull_request_review_thread,release,deployment]

schema GitlabWebhookEvent:
  # GitLab webhook events that can trigger a pipeline
  type: enum[push,merge_request,tag_push]

schema ApprovalStep:
  # Approval action step — pauses pipeline execution until a user explicitly approves. If timeout is omitted, the step waits indefinitely.
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  concurrency: ConcurrencyConfig? # Concurrency configuration for controlling step execution across variants
  type: approval!

schema BuildImageCiStep:
  # Build image CI action step
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  concurrency: ConcurrencyConfig? # Concurrency configuration for controlling step execution across variants
  type: "build:image"!
  source: GitSource! ~template # Git source configuration
  builder: ImageBuildConfig! ~template # Builder configuration — dockerfile, nixpacks, or railpack settings for image builds
  environment_variables: EnvironmentVariablesValue? ~template # Environment variables available during the build — plain strings or AWS secret references
  debug: bool | null? ~template # Enable verbose build output for debugging build issues Accepts either a boolean literal or a full template token
  destinations: EcrDestination[]! {minItems:1} ~template # ECR destinations where the built Docker image will be pushed
  infrastructure: StepInfrastructure! ~template # Execution environment configuration — required because image builds run on provisioned compute

schema BuildStaticCiStep:
  # Build static CI action step
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  concurrency: ConcurrencyConfig? # Concurrency configuration for controlling step execution across variants
  type: "build:static"!
  source: GitSource! ~template # Git source configuration
  builder: StaticBuildConfig! ~template # Builder configuration — dockerfile, nixpacks, or railpack settings
  environment_variables: EnvironmentVariablesValue? ~template # Environment variables available during the build — plain strings or AWS secret references
  debug: bool | null? ~template # Enable verbose build output for debugging build issues Accepts either a boolean literal or a full template token
  destinations: S3Destination[]! {minItems:1} ~template # S3 destinations where the built static assets will be uploaded
  infrastructure: StepInfrastructure! ~template # Execution environment configuration — required because static builds run on provisioned compute

schema BuildStep:
  # General-purpose build action step — triggers a build based on the module's build config.
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  module_instance: str! {minLen:1} ~template # Module instance reference — accepts the module instance row ID (e.g. `mi_…`), `environmentGivenId.moduleGivenId`, or `projectGivenId.environmentGivenId.modul...
  description: str | null? ~template # Human-readable description of this deployment.
  type: build!
  input: map<str,any | null>? ~template # User-defined build parameters passed through to the module build manager.

schema CustomCommandCiStep:
  # Custom command CI action step
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  setup: SetupAction[] | null? ~template # Setup actions to install tools before the commands run, in order, before any command.
  concurrency: ConcurrencyConfig? # Concurrency configuration for controlling step execution across variants
  type: custom!
  source: GitSource? ~template # Git source configuration
  commands: str[]! {minItems:1} ~template # Shell commands to execute in order
  environment_variables: EnvironmentVariablesValue? ~template # Environment variables available during command execution
  infrastructure: StepInfrastructure! ~template # Execution environment configuration — required because custom commands run on provisioned compute

schema DeployStep:
  # General-purpose deploy action step — triggers a deployment based on the module's deployment config.
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  module_instance: str! {minLen:1} ~template # Module instance reference — accepts the module instance row ID (e.g. `mi_…`), `environmentGivenId.moduleGivenId`, or `projectGivenId.environmentGivenId.modul...
  description: str | null? ~template # Human-readable description of this deployment.
  type: deploy!
  input: map<str,any | null>? ~template # User-defined deploy parameters passed through to the deploy manager.

schema RollbackStep:
  # Rollback action step — reverts a module to a specific previous deployment.
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  type: rollback!
  deployment_id: str! {minLen:1} ~template # Deployment ID to rollback to

schema SleepStep:
  # Sleep action step — pauses pipeline execution for testing and debugging
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  concurrency: ConcurrencyConfig? # Concurrency configuration for controlling step execution across variants
  type: sleep!
  duration_ms: int! {format:int64} ~template # Sleep duration in milliseconds

schema TerraformApplyCiStep:
  # Terraform apply CI action step
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  concurrency: ConcurrencyConfig? # Concurrency configuration for controlling step execution across variants
  type: "terraform:apply"!
  source: GitSource? ~template # Git source configuration — if omitted, uses the trigger's repository
  environment_variables: EnvironmentVariablesValue? ~template # Environment variables available during execution — plain strings or AWS secret references
  tool: enum[opentofu,terraform]! ~template # IaC tool implementation used to execute this step
  version: str! {minLen:1} ~template # Terraform/OpenTofu version to execute
  stack_id: str | null? ~template # Stack ID used for terraform resource/execution tracking Automatically set when triggered from a stack
  plan_file_uri: str! ~template # S3 URI of the plan file to apply — typically from a preceding plan step output (e.g. s3://bucket/path/to/plan.tfplan)
  infrastructure: StepInfrastructure! ~template # Execution environment configuration — required because Terraform apply runs on provisioned compute

schema TerraformPlanCiStep:
  # Terraform plan CI action step
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  concurrency: ConcurrencyConfig? # Concurrency configuration for controlling step execution across variants
  type: "terraform:plan"!
  source: GitSource? ~template # Git source configuration — if omitted, uses the trigger's repository
  environment_variables: EnvironmentVariablesValue? ~template # Environment variables available during execution — plain strings or AWS secret references
  tool: enum[opentofu,terraform]! ~template # IaC tool implementation used to execute this step
  version: str! {minLen:1} ~template # Terraform/OpenTofu version to execute
  stack_id: str | null? ~template # Stack ID used for terraform resource/execution tracking Automatically set when triggered from a stack
  terraform_variables: TerraformVariablesValue? ~template # Terraform input variables written to a .auto.tfvars.json file during plan creation — supports all HCL types and AWS secret references
  terraform_variable_files: str[] | null? ~template # Terraform tfvars file paths passed to terraform plan as -var-file flags, in the configured order.
  plan_file_directory_uri: str | null? ~template # S3 directory URI to upload the plan file to — overrides the default convention-based path (e.g. s3://bucket/terraform-plans/run-123)
  plan_type: enum[apply,destroy]? = apply ~template # Type of plan to generate — "apply" (default) creates/updates resources, "destroy" tears them down
  infrastructure: StepInfrastructure! ~template # Execution environment configuration — required because Terraform plan runs on provisioned compute

schema TriggerPipelineStep:
  # Trigger pipeline action step
  id: str! {minLen:1} # Unique step identifier, used for referencing in logs and dependencies
  name: str? # Human-readable step name shown in the pipeline UI
  timeout: int | null? {format:int32,min:1} ~template # Maximum execution time in seconds before the step is killed
  if: bool | null? ~template # Condition that must evaluate to true for this step to run Accepts either a boolean literal or a full template token that resolves to a boolean
  concurrency: ConcurrencyConfig? # Concurrency configuration for controlling step execution across variants
  type: "trigger:pipeline"!
  pipeline_id: str! {minLen:1} ~template # ID of the pipeline to trigger
  pipeline_version_id: str | null? ~template # Specific pipeline version to trigger
  description: str! {minLen:1} ~template # Description to use for the triggered pipeline run
  inputs: map<str,any | null>? ~template # Input values to pass to the triggered pipeline as key-value pairs
  run: map<str,TriggerRunVariantConfig> | null? ~template # Per-variant run overrides — keys are variant IDs, values include description and optional input overrides

schema ConcurrencyConfig:
  # Concurrency configuration for controlling parallel execution
  key: str? # Unique identifier for the concurrency scope within this pipeline Steps/blocks with the same key share a concurrency limit Keys are scoped to org + pipeline —...
  value: int? = 0 {format:int32,min:0} # Maximum concurrent executions allowed (0 means unlimited, 1 means sequential)
  behavior: enum[queue,cancel-in-progress]? = queue # Behavior when the concurrency limit is reached
  queue_size: int? {format:int32,min:0} # Maximum queue size when behavior is "queue" Only applies when behavior is "queue" Unset means unlimited queue depth 0 disables queueing when behavior is "queue"
  queue_overflow_discard: enum[oldest,newest]? = oldest # Which items to discard when queue overflows Only applies when behavior is "queue" and queue_size > 0

schema ParallelChild:
  # Parallel child - can be action or group (no nested parallel allowed)
  oneof: ActionStep | GroupStep

schema ParallelFailStrategy:
  # Strategy for handling failures within a parallel block
  type: enum[cancel-all,finish-running,finish-all]

schema Module.ShowWhen:
  # Conditional visibility mapping; array source values support contains and contains-all matching.
  type: map<str,Module.ShowWhenCondition>

schema PayloadCondition:
  # Condition to check against a webhook payload field.
  path: str! # Dot-notation path to the payload field
  equals: str | null? ~template # Exact string match
  contains: str | null? ~template # Substring match
  matches: str | null? ~template # Glob pattern match
  one_of: str[] | null? ~template # Value must be one of these strings
  not: PayloadConditionMatcher? # Negated payload field matcher. The condition fails when this matcher is true.

schema EcrDestination:
  # ECR destination for image builds
  id: str! ~template # Unique destination identifier within the build step
  type: ecr! ~template # ECR destination type
  repository_arn: str! ~template # ECR repository ARN
  tags: str[] | null? ~template # Docker image tags to apply in ECR after the build finishes

schema EnvironmentVariablesValue:
  # Environment variable map value.
  oneof: map<str,EnvironmentVariable> | str

schema GitSource:
  # Git source configuration for fetching code
  type: git! ~template # Source type identifier
  repo: str! ~template # Full repository URL including host
  branch: str! {minLen:1} ~template # Branch to check out
  ref: str | null? ~template # Git ref to check out — branch, commit SHA, tag, or other ref. Overrides branch HEAD if set.
  base_path: str | null? = . ~template # Base path within the repository to use as the working root

schema ImageBuildConfig:
  # Image build configuration — discriminated by build method
  oneof(type):
    disabled: DisabledBuildConfig
    dockerfile: ImageDockerfileBuildConfig
    nixpacks: ImageNixpacksBuildConfig
    railpack: ImageRailpackBuildConfig

schema StepInfrastructure:
  # Step infrastructure configuration
  execution_environment_id: str | null? ~template # ID or given ID of a pre-configured execution environment
  aws_account_id: str | null? ~template # AWS account reference for automatic network selection.
  region: str | null? ~template # AWS region for automatic network selection
  type: enum[ec2,ec2-spot]! ~template # Instance type — "ec2" for on-demand or "ec2-spot" for cheaper spot instances
  instance_size: str | str[]! ~template # Instance size — a single size like "large" or an array like ["large", "xlarge"] for spot fallback
  ami: str | null? ~template # AMI ID for the runner instance
  permissions: AwsPermissions? ~template # IAM permissions for the runner role — "attach" to add policies or "replace" to override step defaults
  storage: StorageConfig? ~template # Root volume storage configuration

schema S3Destination:
  # S3 destination for build artifacts
  id: str! {minLen:1} ~template # Unique destination identifier within the build step
  type: s3! ~template # S3 destination type
  bucket: str! ~template # S3 bucket name where built assets will be uploaded
  directory: str | null? ~template # S3 directory override for the uploaded build output.
  region: str! ~template # AWS region for the destination S3 bucket

schema StaticBuildConfig:
  # Static build configuration — discriminated by build method
  oneof(type):
    dockerfile: StaticDockerfileBuildConfig
    nixpacks: StaticNixpacksBuildConfig
    railpack: StaticRailpackBuildConfig

schema SetupAction:
  # A setup action that installs a tool before the step's commands run.
  uses: str! {minLen:1} ~template # Action reference to install a tool before running commands.
  with: map<str,str> | null? ~template # Inputs passed to the action, keyed by the action's declared input names.

schema TerraformTool:
  # Supported IaC tool for terraform:* CI steps
  type: enum[opentofu,terraform]

schema TerraformPlanType:
  # Type of Terraform plan to generate
  type: enum[apply,destroy]

schema TerraformVariableFilePath:
  # Terraform/OpenTofu tfvars file path relative to the step source base path
  type: str

schema TerraformVariablesValue:
  # Terraform variable map value.
  oneof: map<str,TerraformVariable> | str

schema ConcurrencyBehavior:
  # Behavior when the concurrency limit is reached
  type: enum[queue,cancel-in-progress]

schema QueueOverflowDiscard:
  # Queue overflow discard strategy
  type: enum[oldest,newest]

schema Module.ShowWhenCondition:
  # A show_when condition.
  oneof: str | int | bool | str | int | bool[] | Module.ShowWhenNotCondition

schema PayloadConditionMatcher:
  # Payload field matcher used by positive conditions and negated conditions.
  equals: str | null? ~template # Exact string match
  contains: str | null? ~template # Substring match
  matches: str | null? ~template # Glob pattern match
  one_of: str[] | null? ~template # Value must be one of these strings

schema EnvironmentVariable:
  # Environment variable — can be a plain string, Parameter Store reference, or Secrets Manager reference
  oneof: str | null | ParameterStoreEnvVar | SecretsManagerEnvVar

schema GitRepoUrl:
  # Full git repository URL including host.
  type: str

schema DisabledBuildConfig:
  # Disabled build configuration. Valid only for module-driven builds.
  type: disabled! ~template # Build method — disables module build execution

schema ImageDockerfileBuildConfig:
  # Dockerfile configuration for image builds
  type: dockerfile! ~template # Build method — use a custom Dockerfile
  dockerfile: str | null? = Dockerfile {minLen:1} ~template # Path to Dockerfile relative to source.base_path
  context: str | null? = . ~template # Docker build context path relative to source.base_path
  inject_env_variables_in_dockerfile: bool | null? ~template # Whether to inject environment variables as Docker build args Accepts either a boolean literal or a full template token
  cache_from: CacheFromConfig? ~template # Docker layer cache configuration

schema ImageNixpacksBuildConfig:
  # Nixpacks configuration for image builds
  type: nixpacks! ~template # Build method — use Nixpacks auto-detection
  nixpacks_version: str | null? ~template # Nixpacks version to use
  build_path: str | null? ~template # Directory to run the Nixpacks build from, relative to the repository root
  config_file_path: str | null? ~template # Path to the Nixpacks configuration file relative to the repository root
  nix_pkgs: str[] | null? ~template # Additional Nix packages to install
  apt_pkgs: str[] | null? ~template # Additional apt packages to install
  nix_libs: str[] | null? ~template # Additional Nix libraries to install
  install_cmd: str | null? ~template # Custom install command
  build_cmd: str | null? ~template # Custom build command
  start_cmd: str | null? ~template # Application start command
  cache_from: CacheFromConfig? ~template # Docker layer cache configuration

schema ImageRailpackBuildConfig:
  # Railpack configuration for image builds
  type: railpack! ~template # Build method — use Railpack auto-detection
  railpack_version: str | null? ~template # Railpack version to use
  install_cmd: str | null? ~template # Custom install command
  build_cmd: str | null? ~template # Custom build command
  start_cmd: str | null? ~template # Application start command
  cache_from: CacheFromConfig? ~template # Docker layer cache configuration

schema AwsPermissions:
  # IAM policies configuration for runner roles Used by EC2-backed steps to specify additional permissions
  oneof: AwsPermissionsAttach | AwsPermissionsReplace

schema InfrastructureType:
  # Execution environment type
  type: enum[ec2,ec2-spot]

schema InstanceSize:
  # Instance size can be a single string or array of strings
  oneof: str | str[]

schema StorageConfig:
  # Root volume storage configuration
  type: enum[gp3,gp2,io2,io1]? ~template # Volume type
  size: int | null? {format:int32} ~template # Volume size in GiB
  iops: int | null? {format:int32} ~template # Provisioned IOPS
  throughput: int | null? {format:int32} ~template # Provisioned throughput in MiB/s

schema StaticDockerfileBuildConfig:
  # Dockerfile configuration for static builds
  type: dockerfile! ~template # Build method — use a custom Dockerfile
  dockerfile: str | null? = Dockerfile {minLen:1} ~template # Path to Dockerfile relative to source.base_path
  context: str | null? = . ~template # Docker build context path relative to source.base_path
  inject_env_variables_in_dockerfile: bool | null? ~template # Whether to inject environment variables as Docker build args Accepts either a boolean literal or a full template token
  output_directory: str! {minLen:1} ~template # Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path

schema StaticNixpacksBuildConfig:
  # Nixpacks configuration for static builds
  type: nixpacks! ~template # Build method — use Nixpacks auto-detection
  nixpacks_version: str | null? ~template # Nixpacks version to use
  build_path: str | null? ~template # Directory to run the Nixpacks build from, relative to the repository root
  config_file_path: str | null? ~template # Path to the Nixpacks configuration file relative to the repository root
  nix_pkgs: str[] | null? ~template # Additional Nix packages to install
  apt_pkgs: str[] | null? ~template # Additional apt packages to install
  nix_libs: str[] | null? ~template # Additional Nix libraries to install
  install_cmd: str | null? ~template # Custom install command
  build_cmd: str | null? ~template # Custom build command
  output_directory: str! {minLen:1} ~template # Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path

schema StaticRailpackBuildConfig:
  # Railpack configuration for static builds
  type: railpack! ~template # Build method — use Railpack auto-detection
  railpack_version: str | null? ~template # Railpack version to use
  install_cmd: str | null? ~template # Custom install command
  build_cmd: str | null? ~template # Custom build command
  output_directory: str! {minLen:1} ~template # Directory inside the built image containing the static assets to upload This path is resolved relative to source.base_path

schema TerraformVariable:
  # Terraform variable — can be any JSON value (string, number, boolean, null, array, object), a Parameter Store reference, or a Secrets Manager reference
  oneof: ParameterStoreEnvVar | SecretsManagerEnvVar | any | null

schema Module.ShowWhenComparableValue:
  # Value or values to compare against in a show_when condition; arrays mean membership for scalar sources and contains-all for array sources.
  oneof: str | int | bool | str | int | bool[]

schema Module.ShowWhenNotCondition:
  # Negated show_when condition.
  not: str | int | bool | str | int | bool[]! # Show the property only when the source value does not match this condition.

schema ParameterStoreEnvVar:
  # Environment variable from AWS Parameter Store
  from_parameter_store: ParameterStoreReferenceValue! ~template # Parameter Store reference

schema SecretsManagerEnvVar:
  # Environment variable from AWS Secrets Manager
  from_secrets_manager: SecretsManagerReferenceValue! ~template # Secrets Manager reference

schema CacheFromConfig:
  # Configuration for Docker layer cache source from ECR
  digest: str | null? ~template # Specific image digest to use for cache
  tag: str | null? ~template # Specific image tag to use for cache

schema AwsPermissionsAttach:
  # IAM policies to attach alongside step default policies
  attach: str[]! ~template # AWS managed policy ARNs to attach alongside step default policies

schema AwsPermissionsReplace:
  # IAM policies to replace step default policies entirely
  replace: str[]! ~template # AWS managed policy ARNs to use instead of step default policies

schema EbsVolumeType:
  # EBS volume type for the runner root volume
  type: enum[gp3,gp2,io2,io1]

schema Module.ShowWhenValue:
  # Value that can be used in a show_when condition.
  oneof: str | int | bool

schema ParameterStoreReferenceValue:
  # Parameter Store reference — shorthand string or object with optional version metadata
  oneof: str | ParameterStoreReference

schema SecretsManagerReferenceValue:
  # Secrets Manager reference — shorthand string or object with optional JSON key/version metadata
  oneof: str | SecretsManagerReference

schema ParameterStoreReference:
  # Parameter Store reference with optional version metadata
  key: str! ~template # Parameter Store parameter name or path
  version: str | null? ~template # Parameter version number

schema SecretsManagerReference:
  # Secrets Manager reference with optional JSON key and version metadata
  key: str! ~template # Secret name or ARN in Secrets Manager
  json_key: str | null? ~template # JSON key to extract from a JSON-structured secret
  version: str | null? ~template # Secret version ID or stage

<template-expressions>
Syntax: `<< expression >>` for dynamic values

Modes:
- Block: `<< pipeline.input.timeout >>` — preserves type (number, boolean, etc.)
- Interpolation: `"prefix-<< pipeline.input.env >>"` — always string (only for string fields)

Operators: +, -, *, /, %, >, <, >=, <=, ==, !=, &&, ||, !
Ternary: `<< condition ? trueVal : falseVal >>`
Default/fallback: `<< pipeline.input.x || "fallback" >>` skips nil and empty string
Access: `array[0]`, `map["key"]`, `map.key`, hyphenated selectors like `pipeline.input.image-tag`
Helpers: len(), upper(), lower(), string(), int(), float(), get(), map()
- `get(object, "a.b", default?)`: safe nested lookup; returns nil or optional default when missing
- `map(arrayOrObject, expr)`: transforms array items or object values; use `#` for the current item. Object values are processed in sorted key order.
Collections: array concatenation with `+`, object literals, array literals
Truthy: nil, false, empty string, and zero are falsey; arrays/objects are truthy even when empty
Nil: use `nil` or `null`

YAML quoting: Quote ternary expressions to avoid YAML parsing `:` as mapping separator:
```yaml
field: "<< pipeline.input.flag ? value1 : value2 >>"
```

Namespaces: pipeline.input.*, pipeline.run.{id,description}, pipeline.variant.{id,name}, steps.{id}.{output,input}.*, step.input.*, trigger.payload.{branch,commit,ref,repository,event,tag}

</template-expressions>

</pipeline-schema>