Skip to content
sluiceway

sluiceway.yaml

2 stacks are pending: two crates wait upstream of Penny2 stacks are pending: two crates wait upstream of Penny

Configuration of Sluiceway. The file is optional and sits at the repo root.

Generated from the action’s JSON schema. Configuration explains each key with examples.

dashboard

  • Type: mapping
  • Default: {}

dashboard.title

Title of the dashboard issue.

  • Type: string
  • Default: Sluiceway dashboard
  • The value is at least 1 character long.
  • In the guide: dashboard.title

dashboard.label

Label the dashboard issue is found by.

  • Type: string
  • Default: sluiceway
  • The value is at least 1 character long.
  • In the guide: dashboard.label

dashboard.pin

Pin the dashboard issue, best effort.

dashboard.redact

Keep resource types, resource names and property names out of the issue. The summary stays full. Not access control.

dashboard.personality

Show the header image and use the voice. false removes both.

dashboard.readOnly

Draw no boxes: pending rows have none, there is no rescan box, and a line under the Pending heading says so. For a workflow that only scans.

dashboard.showValues

Property paths whose old and new value may appear on the dashboard, as “old → new”. Exact paths, or “*” for part of one name. Never a value the tool marks secret, and none at all with redact on.

  • Type: list of string
  • Default: []
  • Each entry is at least 1 character long.
  • In the guide: dashboard.showValues

tickers

Default tick rule: write, maintain, admin, or a list of usernames. A list narrows and never widens: a person on it still needs write access.

  • Type: string or list of string
  • Allowed values: write, maintain, admin
  • A list holds at least 1 entry.
  • Each entry matches ^[A-Za-z0-9_-]+$.
  • In the guide: tickers

deploys

false stops every deploy: resolve clears every ticked box with a note and starts nothing, and apply ends a deploy that was already started before the tool runs. Scans go on.

  • Type: boolean
  • Default: true
  • In the guide: deploys

ignore

Globs matched against the stack id. An ignored stack has no row. An entry with a reason is listed with it under In sync.

  • Type: list of string or mapping
  • Default: []
  • Each entry is at least 1 character long.
  • Each entry needs glob and reason.
  • In the guide: ignore

ignore[].glob

Glob matched against the stack id.

  • Type: string
  • Required: yes
  • The value is at least 1 character long.

ignore[].reason

Why these stacks are left out. Shown on the dashboard under In sync.

  • Type: string
  • Required: yes
  • The value is at least 1 character long.

scan

  • Type: mapping
  • Default: {}

scan.unrelated

Globs for files that claim nothing and force nothing, such as **/*.md.

  • Type: list of string
  • Default: []
  • Each entry is at least 1 character long.
  • In the guide: scan.unrelated

scan.logDiff

Print the tool’s own diff of every pending stack, values included, in that stack’s group of the job log and nowhere else. Anyone who can read the repo can read its job logs. Costs one more tool run per pending stack.

drift

  • Type: mapping
  • Default: {}

drift.enabled

Check every stack for drift in each scan that a schedule starts, or that a person starts with Run workflow: changes made to real infrastructure outside the code. A stack with drift gets a row with a box, and a tick deploys the code as it is, which puts it back. Costs one more tool run per stack in those scans.

stacks

Settings for stacks that discovery found. An entry never creates a stack.

  • Type: list of mapping
  • Each entry needs path.

stacks[].path

Directory of the stack, relative to the repo root.

  • Type: string
  • Required: yes
  • The value is at least 1 character long.
  • In the guide: stacks[].path

stacks[].name

Name of the stack. Without it the entry covers every stack in path.

  • Type: string
  • The value is at least 1 character long.
  • In the guide: stacks[].name

stacks[].tool

The tool of a stack that discovery cannot find from files alone. The entry then declares the stack at path. opentofu: a root module.

  • Type: string
  • Allowed values: opentofu
  • In the guide: stacks[].tool

stacks[].environment

Label on the deployment record, and the GitHub Environment where one is used. Default: sluiceway.

stacks[].tickers

Tick rule for this stack. Default: the top level tickers.

  • Type: string or list of string
  • Allowed values: write, maintain, admin
  • A list holds at least 1 entry.
  • Each entry matches ^[A-Za-z0-9_-]+$.
  • In the guide: stacks[].tickers

stacks[].inputs

Extra globs this stack claims, relative to the repo root.

  • Type: list of string
  • Each entry is at least 1 character long.
  • In the guide: stacks[].inputs

stacks[].previewTimeout

Time limit for one preview of this stack, in whole minutes. Default: the preview-timeout input.

stacks[].dependsOn

Stack ids of the stacks this stack depends on. A tick on this stack is refused while one of them has a change waiting, and when both are ticked they deploy in order.

  • Type: list of string
  • Each entry is at least 1 character long.
  • In the guide: stacks[].dependsOn

stacks[].options

Named adapter options of the tool. Only an entry with tool takes them.

  • Type: mapping

stacks[].options.workspace

The workspace of the stack, selected with TF_WORKSPACE for every command. Without it, the one the environment selects, which is default.

stacks[].options.varFiles

Var files, relative to the directory of the stack, passed with -var-file in this order to every plan.

mergeAndDeploy

  • Type: mapping
  • Default: {}

mergeAndDeploy.authors

Logins whose open pull requests may be merged and deployed with one tick, such as renovate[bot]. Empty turns it off.