Inputs, context, and secrets
Choose the right source
| Source | Use it for | Example binding |
|---|---|---|
| Run inputs | Values supplied for one execution | ${{ inputs.service }} |
| Environment context | Public settings shared by workflows | ${{ context.service_api }} |
| Environment secrets | Credentials and other protected values | ${{ secrets.service_api_token }} |
| Earlier outputs | Data returned by a completed step | ${{ steps.inspect.outputs.service_id }} |
Declare caller inputs with their types and, where appropriate, required, default, or enum. Start a Run using --inputs with a JSON or YAML object:
{"service": "checkout-api"}
pyplines run start development/service-health --inputs ./inputs.json
Input files contain ordinary parameters. Supply credentials through Environment secrets instead.
Public configuration
An administrator sets context on the Environment, for example service_api: https://services.example.com. The same Definition can then be deployed to multiple Environments without embedding different endpoints in its source. See Environment configuration.
Context is resolved at step preparation time. Updating context does not edit a Definition or a Run's pinned Action image, but it can change prepared inputs and invalidate approval evidence.
Manage secrets
Administrators can set a secret interactively without putting its value in shell history:
pyplines secret set development service_api_token
pyplines secret list development
The secret name in a Definition must exactly match its stored name. For automation, secret set ENVIRONMENT NAME --stdin reads from standard input. Supply the value from your existing secret delivery system. Each update uses the current secret version; concurrent updates can conflict.
Secret bindings and private steps
A secret reference must occupy an entire Action input value. Do not interpolate a secret into a larger string, put it in when, or store it as an ordinary Run parameter or YAML literal.
Sensitive input/output schemas and secret-tainted output bindings make a receiving step private. Private results are withheld from ordinary read APIs and private logs are suppressed entirely. An absent private log is therefore not evidence that the Action never executed. Inspect its attempt and status instead.
Secret rotation can invalidate prepared approvals. A newly prepared step uses the current secret version; it does not rewrite the evidence retained for prior attempts.