DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Script steps

The simplest step mode: a shell script in a container, optionally with its own image and mounted storage.

ReferenceAutomation authorDeveloper

Key points

  • A step needs exactly one mode. script cannot be combined with goal, tasks, include, or approval.
  • steps[].image overrides the pipeline container_image for that step only.
  • steps[].volumes mounts named Docker volumes or Kubernetes PVCs as volume:/mount/path; existing storage is reused and missing storage is created.
  • Mounting the reserved runtime output path /nopsai/outputs is rejected, and a step may declare at most 32 volumes.
  • A script step cannot define mcp_profiles — tools belong to LLM-backed work.
  • With blocking guardrail or policy knowledge context in scope, the exact command is validated by the model before it executes.

Examples

What this page addsyaml
  - name: verify
    image: golang:1.24
    volumes:
      - build-cache:/root/.cache
    script: |
      go vet ./...
      go test ./...
Pipeline so faryaml
name: release-service
description: Build, verify, and publish the payments service.
container_image: alpine:3.20
working_directory: /workspace
timeout: 45m
steps:
  - name: build
    script: |
      make build

  - name: verify
    image: golang:1.24
    volumes:
      - build-cache:/root/.cache
    script: |
      go vet ./...
      go test ./...
Result

Two independent steps. Nothing orders them yet, so both are eligible to start at once.

Rejected: two modes on one stepyaml
  - name: verify
    script: go test ./...
    goal: Check the tests pass.
Result

Validation rejects the step: script cannot be combined with goal.

Field reference

steps[].scriptstep modestringConditionalNone

Direct shell step. With blocking guardrail or policy knowledge context, the exact command is LLM-validated before execution.

Example

script: |
  make build
  make test

Rules
  • Cannot be combined with goal or tasks.
  • Cannot define mcp_profiles.
  • With llm_enabled: false, blocking knowledge context on the script is rejected.
steps[].namestepstringRequiredNone

Unique step name. Dependencies and runtime output references address the step by this name.

Example

name: build

Rules
  • Must be unique within the pipeline.
  • A step without a name fails validation.
Evidence

services/nopsai/pkg/validation/pipeline.go

steps[].imagestepstringConditionalPipeline `container_image`

Executable image for this step. Required when the pipeline has no container_image.

Example

image: golang:1.24

Evidence

services/nopsai/pkg/validation/pipeline.go

steps[].volumesstepstring[]OptionalNone

Named Docker volume or Kubernetes PVC mounts in volume:/mount/path form. Existing storage is reused; missing storage is created.

Example

volumes:
  - build-cache:/root/.cache

Rules
  • Maximum 32 volumes per step.
  • Mounting the reserved runtime output path /nopsai/outputs is rejected.
Evidence

services/nopsai/pkg/validation/pipeline.go

steps[].volumes (max per step)limitcountOptional32 maximum per step

Maximum volume mounts declared on a single step.

Example

step 'build' has 33 volumes; maximum is 32

Evidence

services/nopsai/pkg/validation/pipeline.go

How it works

Step names are how everything else refers to a step: dependencies, output references, and the run graph all use them. Choose names you are willing to see in a failure message.

Volumes are how work survives between steps that do not share a container. The workspace itself is already shared for the whole run; a volume is for caches and artefacts you want to keep across runs.

Implementation evidence

  • services/nopsai/pkg/validation/pipeline.go

    Rules the validator enforces on this directive set.

  • services/agent/internal/app/pipeline.go

    Step execution and the reserved output mount.