DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

The complete manifest

Every capability in this chapter assembled into one pipeline, with the reference tables that carry the rest.

ReferenceAutomation authorDeveloperOperator

Key points

  • This manifest is the accumulation of every page in the chapter, and it is checked into examples/gitops-quickstart/team-repo/pipelines/platform/release-service.yaml.
  • Every stage of it validates: the repository test suite runs the example through the same ValidatePipeline the API uses.
  • Nothing here is new. Each directive was introduced on exactly one earlier page, which is what the directive index is built from.
  • For the exhaustive tables — every directive, every allowed value, every constraint — use All YAML directives in Reference.

Examples

Pipeline so faryaml
name: release-service
description: Build, verify, and publish the payments service.
container_image: alpine:3.20
working_directory: /workspace
timeout: 45m
display_option: list
llm_enabled: true
model: reasoning-large
agent_role: senior-release-engineer
governance_level: strict
mcp_profiles:
  - jira-readonly
knowledge_context:
  - kind: guardrail
    ref: security/repo-check
    required: true
llm_content_preload: false
llm_content_include:
  - "src/**/*.go"
llm_content_ignore:
  - "**/testdata/**"
variables:
  - RELEASE_CHANNEL
  - platform/shared:ARTIFACT_BUCKET
steps:
  - name: checkout
    include: step:platform/shared/checkout

  - name: build
    depends_on: [checkout]
    script: |
      make build
      echo "1.0.$(date +%s)" > /nopsai/outputs/BUILD_TAG
    outputs:
      - name: BUILD_TAG

  - name: verify
    image: golang:1.24
    depends_on: [build]
    runtime_pool: ci
    volumes:
      - build-cache:/root/.cache
    script: |
      go vet ./...
      go test ./...

  - name: checks
    depends_on: [verify]
    tasks:
      - name: licenses
        ignore_failure: true
        script: |
          ./scripts/license-check.sh
      - name: sbom
        script: |
          ./scripts/sbom.sh > /workspace/sbom.json
          sha256sum /workspace/sbom.json | cut -d' ' -f1 > /nopsai/outputs/SBOM_DIGEST
        outputs:
          - name: SBOM_DIGEST
      - name: risk-review
        depends_on: [checks.sbom]
        goal: Review the changed files and list the risks this release carries.
        model: reasoning-large
        governance_level: advisory
        mcp_profiles:
          - jira-readonly
        knowledge_context:
          - kind: example
            path: .nopsai/docs/risk-review-example.md
      - name: report
        depends_on: [checks.licenses, checks.sbom]
        variables:
          SBOM_DIGEST: $steps.checks.sbom.outputs.SBOM_DIGEST
        script: |
          echo "checks complete"
          echo "sbom $SBOM_DIGEST"

  - name: package
    depends_on: [checks]
    secrets:
      - REGISTRY_TOKEN
      - platform/shared:SIGNING_KEY
    variables:
      BUILD_TAG: $steps.build.outputs.BUILD_TAG
    script: |
      ./scripts/package.sh "$BUILD_TAG"
      echo "channel $RELEASE_CHANNEL, bucket $ARTIFACT_BUCKET"
      ./scripts/mint-token.sh > /nopsai/outputs/PUBLISH_TOKEN
      ./scripts/sign.sh --key "$SIGNING_KEY" --token "$REGISTRY_TOKEN"
    outputs:
      - name: PUBLISH_TOKEN
        sensitive: true

  - name: announce
    depends_on: [package]
    condition: Only run when the release channel is stable.
    ignore_failure: true
    script: |
      ./scripts/announce.sh

  - name: production-gate
    depends_on: [package]
    approval:
      type: production-release
      teams:
        - platform/sre
      allow_self_approval: false
      timeout: 24h

  - name: publish
    depends_on: [production-gate]
    script: |
      ./scripts/promote.sh

  - name: release-notes
    depends_on: [publish]
    goal: Read the commits since the last tag and write release notes to /workspace/NOTES.md.
    model: reasoning-large
    agent_role: release-writer
    governance_level: advisory
    mcp_profiles:
      - github-readonly
    knowledge_context:
      - kind: policy
        ref: platform/release-notes
        required: true

  - name: deploy
    depends_on: [publish]
    include: pipeline:platform/deploy-service
    sync: true
    outputs:
      - name: DEPLOY_ID

output:
  model: reasoning-large
  items:
    - name: Release summary
      type: markdown
      when: always
      prompt: Summarize the release, its approvals, and anything that failed.
      model: reasoning-large
    - name: Release health
      type: dashboard
      when: success
      prompt: Publish the release health entry for this service.
      dashboard:
        ref: platform/service-health
        section: releases
        entry_key: payments
        mode: series
        preset: metrics
        ttl: 30d
Result

The finished chapter manifest, valid against the pipeline validator.

Verify withcurl -sX POST http://localhost:8080/v1/pipelines/validate -H "Authorization: Bearer $NOPSAI_TOKEN" -H "Content-Type: application/yaml" --data-binary @release-service.yaml

How it works

Read this page as a check on your own model of the product: for each block, you should be able to name which page introduced it and what rule constrains it.

The pipeline is deliberately ordinary. It builds, verifies, runs checks concurrently, packages with a secret, waits for a human, publishes, delegates a deployment to a child pipeline, and explains itself afterwards. That is the shape most real pipelines converge on.

To run it as-is you need the referenced resources to exist: the platform/shared/checkout reusable step, the platform/deploy-service pipeline, a platform/service-health dashboard, the named models and profiles, and the scope holding RELEASE_CHANNEL, ARTIFACT_BUCKET, REGISTRY_TOKEN, and SIGNING_KEY.

Implementation evidence

  • examples/gitops-quickstart/team-repo/pipelines/platform/release-service.yaml

    The assembled manifest as a runnable example.

  • contract/examples_pipeline_validation_test.go

    Test that validates every example pipeline against the pipeline validator.