DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Git trigger manifests

The repository-side `.nopsai.yaml` that decides which events start which pipelines.

ReferenceAutomation authorDeveloper

Key points

  • The manifest lives in the repository, so trigger rules are reviewed like code.
  • on: all matches any event from the provider.
  • Branch matching applies branches first, then removes anything matching skip_branches.
  • Path matching intentionally fails open: when changed-file metadata is unknown, the rule still matches so CI is not silently skipped.
  • Non-GitHub providers must name a managed webhook_source.
  • pipelines accepts scalar paths only; an empty path is rejected at parse time.

Field reference

providertrigger manifeststringOptionalgithub

Git provider the manifest is written for. Non-GitHub providers route through a managed Git Webhook Source.

Example

provider: gitlab

Allowed values

github, gitlab, bitbucket, gitea, generic

Evidence

pkg/models/model.go

teamtrigger manifeststringOptionalNone

Owning team or application boundary. Runs started by this manifest inherit it for ownership and notification lineage.

Example

team: platform/payments

team_pathtrigger manifeststringOptionalNone

Explicit product team path when the short team name is ambiguous.

Example

team_path: platform/payments

webhook_sourcetrigger manifeststringConditionalNone

Managed Git Webhook Source ID. Required for GitLab, Bitbucket, Gitea, and generic providers.

Example

webhook_source: gitlab-main

Evidence

pkg/models/model.go

managementtrigger manifeststringOptionalNone

Marks the manifest as NopsAI-managed so platform trigger overrides apply.

Example

management: nopsai

triggers[].ontrigger rulestringRequiredNone

Event name to match. all matches any event from the provider.

Example

on: push

Allowed values

all, push, pull_request, tag, provider-specific event names

Evidence

pkg/gittrigger/matcher.go

triggers[].branchestrigger rulestring[]OptionalNone

Branch globs that must match. An empty list matches every branch.

Example

branches:
  - main
  - release/*

Evidence

pkg/gittrigger/matcher.go

triggers[].skip_branchestrigger rulestring[]OptionalNone

Branch globs removed after include matching.

Example

skip_branches:
  - dependabot/*

Evidence

pkg/gittrigger/matcher.go

triggers[].tagstrigger rulestring[]OptionalNone

Tag globs matched on push tag events.

Example

tags:
  - "v*"

triggers[].skip_repostrigger rulestring[]OptionalNone

Repository patterns that skip this rule entirely.

Example

skip_repos:
  - acme/sandbox-*

triggers[].include_pathstrigger rulestring[]OptionalNone

Changed-file globs that must match when changed-file metadata is available.

Example

include_paths:
  - "services/payments/**"

Rules
  • Path matching intentionally fails open: when the provider does not report changed files, the rule still matches so CI is not silently skipped.
Evidence

pkg/gittrigger/matcher.go

triggers[].exclude_pathstrigger rulestring[]OptionalNone

Changed-file globs removed before include matching is evaluated.

Example

exclude_paths:
  - "**/*.md"

Evidence

pkg/gittrigger/matcher.go

triggers[].pipelinestrigger rulestring[]RequiredNone

Pipeline paths started when the rule matches. Declared as plain scalar paths.

Example

pipelines:
  - .nopsai/pipelines/ci.yaml

Rules
  • Only scalar path values are supported; an empty path is rejected at parse time.
Evidence

pkg/models/model.go

triggers[].scopetrigger rulestringOptionalDefault runtime scope

Runtime scope used to resolve variables and secrets for the started run.

Example

scope: platform/production

Examples

Everything except documentation and bot branchesyaml
team: platform/payments
triggers:
  - on: all
    skip_branches:
      - dependabot/*
    exclude_paths:
      - "**/*.md"
      - docs/**
    pipelines:
      - .nopsai/pipelines/ci.yaml
Result

Any event on any branch except dependabot branches starts CI, unless every changed file is documentation.

GitLab source with tag filteringyaml
provider: gitlab
webhook_source: gitlab-main
team: platform/payments
triggers:
  - on: push
    tags:
      - "v*"
    pipelines:
      - .nopsai/pipelines/release.yaml
    scope: platform/production

How it works

When branches is empty and either skip_branches is set or on is all, every branch is treated as included before exclusions are applied. This makes "everything except these" rules straightforward.

exclude_paths is applied before include_paths is evaluated, so a file removed by an exclusion cannot satisfy an include.

Forwarded GitHub App events reach POST /v1/git/events, which is an internal service call requiring a git-bot service token. It is not public webhook ingress and should not be exposed as such.

Implementation evidence

  • pkg/gittrigger/matcher.go

    Exact branch, tag, and path matching behavior including fail-open.

  • pkg/models/model.go

    Manifest and trigger struct definitions.