Airlock
Concepts

Workflows

Declarative YAML files that define what runs on each push.

Workflows define what happens when you push to a gate repo. They live in .airlock/workflows/*.yml in your repo.

Workflow File

A workflow is a YAML file with a name, trigger, and one or more jobs:

name: Main Pipeline

on:
  push:
    branches: ['**']

jobs:
  default:
    name: Lint, Test & Deploy
    steps:
      - name: lint
        uses: airlock-hq/airlock/defaults/lint@main

      - name: freeze
        run: airlock exec freeze

      - name: describe
        uses: airlock-hq/airlock/defaults/describe@main

      - name: test
        uses: airlock-hq/airlock/defaults/test@main

      - name: review
        run: 'true'
        require-approval: true

      - name: push
        uses: airlock-hq/airlock/defaults/push@main

      - name: create-pr
        uses: airlock-hq/airlock/defaults/create-pr@main

Top-Level Properties

PropertyDescription
nameHuman-readable name for the workflow
on.push.branchesGlob patterns for branch filtering (e.g., ['main', 'feature/**'])
jobsMap of job keys to job definitions

Jobs

Each job has a name and a list of steps. Steps within a job run sequentially. Multiple jobs can run in parallel using the needs keyword to declare dependencies.

jobs:
  lint:
    name: Lint
    steps:
      - name: lint
        uses: airlock-hq/airlock/defaults/lint@main

  test:
    name: Test
    needs: [lint]
    steps:
      - name: test
        uses: airlock-hq/airlock/defaults/test@main

In this example, test waits for lint to complete before starting.

Steps

Each step either runs a shell command (run) or references a reusable step definition (uses). Steps also support options like shell, continue-on-error, and require-approval. See the Workflow YAML Schema for all step properties.

Note the kebab-case format: continue-on-error and require-approval, not snake_case.

Branch Filtering

The on.push.branches field accepts glob patterns to control which branches trigger the workflow. See the Workflow YAML Schema for supported patterns.

If a push doesn't match any workflow's branch patterns, Airlock forwards it to upstream directly — no workflow runs, no Push Request is created.