Skip to main content
SmoothGlue Logo

Pillars variable defaults

ReferencePublicInterface: GitLab CI/CD

This catalog records every variable declared by the documented shared pipeline and its included job configurations. Use it with the configuration reference, framework reference, analysis reference, and delivery reference, which explain each workflow's inputs, credentials, conditions, and outputs. No implementation-repository access is required.

Unset means the declaration has an empty or null value. It does not mean the job can run without that input. Expressions such as ${CI_REGISTRY} are defaults that GitLab resolves; they are not literal values to paste into an external tool. An omitted switch keeps the behavior described on the relevant reference page.

These are declared defaults, not a flattened configuration for every project. Framework configurations are conditional; inherited build/release settings can override one another when multiple frameworks are enabled. A job-level declaration takes precedence over a top-level YAML default, while higher-precedence project/group/pipeline variables can change it. Installation overrides also affect the selected images and service URLs.

Image fields contain the complete pinned references in the documented configuration. Changing a separate language-version variable does not update a fixed image reference unless that image explicitly interpolates it. Ensure your runner can pull its job image before any job script runs.

Some declarations are compatibility settings or output controls rather than functional switches. In particular, CACHE_ENABLED, BRANCH_TAG, and HELM_CHART_TAG do not control the current container/chart scripts. Their supported alternatives and other known mismatches are documented in the linked references. GitLab's own predefined variables are supplied by GitLab and are not an additional Pillars setup requirement.

Shared pipeline​

Global defaults​

VariableDeclared default
PLATFORM_DOMAINbuild.smoothglue.io
PIPELINE_PROJECT_ID271
PIPELINE_PROJECTgetting-started/pillars/pipeline
PIPELINE_REFmain
AIRGAP_MODEfalse
BASE_IMAGE${PLINTH_IMAGE}
SONARQUBE_IMAGEregistry1.dso.mil/ironbank/sonarsource/sonar-scanner-cli:12.0
BUILDAH_IMAGEregistry1.dso.mil/ironbank/opensource/containers/buildah:1.43.3
DOCKER_BUILD_IMAGE${BUILDAH_IMAGE}
MALCONTENT_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/malcontent:1.10.0
DEPENDENCY_CHECK_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/dependency-check:13.0.0
SYFT_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/syft:1.38.0
RAMPART_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/rampart:1.5.5
MEGALINTER_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/megalinter:10.0.0
PLINTH_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/plinth:0.2.4
GRYPE_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/grype:0.111.0
TRUFFLEHOG_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/trufflehog:3.97.9
HADOLINT_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/hadolint:2.12.0
SEMGREP_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/semgrep:1.176.0
ZAP_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/owasp-zap:2.16.0
CYPRESS_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/cypress:16.1.0
TRIVY_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/trivy:0.74.0
HELM_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/helm:4.3.0
PINNACLE_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/pinnacle:1.4.2
KUSTOMIZE_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/kustomize:v5.8.1
KUBECONFORM_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/kubeconform:v0.7.0
SEMANTIC_RELEASE_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/semantic-release:25.0.3
GLAB_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/glab:v1.88.0
JAVASCRIPT_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/node/nvm:v0.40.4
GRADLE_IMAGEregistry1.dso.mil/ironbank/opensource/gradle/gradle-jdk25:9.7.1
POETRY_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/python/poetry/python-${PYTHON_VERSION}/poetry:${POETRY_VERSION}
PIP_IMAGEregistry1.dso.mil/ironbank/opensource/python:v3.12@sha256:e82ae4255633ace89d4d12215ecd094c03d54ddc3d110507f0fca731041a3326
CMAKE_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/cpp/pipeline:0.1.0
DOTNET_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/csharp/pipeline:1.0.0@sha256:bf150a8a4b49ac6d18a6892b7d65828461ed7330b1229d86b956cf3fb29cbfeb
GOLANG_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/golang/pipeline:1.26.6
SYNC_IMAGEregistry1.dso.mil/ironbank/opensource/pipeline-runner:v0.9.6
COMMITLINT_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/commitlint:20.5.0
ZARF_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/zarf:0.85.0
REGISTRY${CI_REGISTRY}
REGISTRY_USER${CI_REGISTRY_USER}
REGISTRY_PASSWORD${CI_REGISTRY_PASSWORD}
IMAGEUnset
IMAGE_TAGUnset
IMAGE_ADDITIONAL_TAGS${CI_COMMIT_REF_SLUG},${CI_PIPELINE_ID},${CI_COMMIT_SHA}
DOCKERFILE_PATHDockerfile
UPSTREAM_REGISTRYUnset
UPSTREAM_REGISTRY_USERUnset
UPSTREAM_REGISTRY_PASSWORDUnset
HELM_REGISTRY${CI_REGISTRY}
HELM_REGISTRY_USER${CI_REGISTRY_USER}
HELM_REGISTRY_PASSWORD${CI_REGISTRY_PASSWORD}
HELM_REGISTRY_PATHUnset
HELM_CHART_DIRchart
HELM_CHART_TAGUnset
ZARF_REGISTRY${CI_REGISTRY}
ZARF_REGISTRY_USER${CI_REGISTRY_USER}
ZARF_REGISTRY_PASSWORD${CI_REGISTRY_PASSWORD}
ZARF_REGISTRY_PATHUnset
ZARF_STAGING_REGISTRY_PATHUnset
ZARF_PACKAGE_DIR.
ZARF_PACKAGE_FILEUnset
ZARF_ARCHITECTUREUnset
ZARF_FLAVORUnset
ZARF_OCI_CONCURRENCYUnset
ZARF_CACHE_DIR.cache/zarf
ZARF_BUILD_ARTIFACT_DIRzarf-package-build
DOCKER_AUTH_CONFIGExpanded below.
ARTIFACT_DIR${CI_JOB_NAME_SLUG}
EVIDENCE_DIR${ARTIFACT_DIR}/evidence
PACKAGE_DIR${ARTIFACT_DIR}/package
SBOM_DIR${ARTIFACT_DIR}/sbom
BUILD_DIRdist
PACKAGE_VERSIONUnset
PACKAGE_HOST${CI_SERVER_HOST}
PACKAGE_USERNAMEUnset
PACKAGE_PASSWORDUnset
PACKAGE_TOKEN${CI_JOB_TOKEN}
STAGING_PACKAGE_HOST${CI_SERVER_HOST}
STAGING_PACKAGE_USERNAMEUnset
STAGING_PACKAGE_PASSWORDUnset
STAGING_PACKAGE_TOKEN${CI_JOB_TOKEN}
UPSTREAM_PACKAGE_HOSTUnset
UPSTREAM_PACKAGE_USERNAMEUnset
UPSTREAM_PACKAGE_PASSWORDUnset
UPSTREAM_PACKAGE_TOKENUnset
NPM_DEFAULT_PATHapi/v4/projects/${CI_PROJECT_ID}/packages/npm/
GRADLE_DEFAULT_PATHapi/v4/projects/${CI_PROJECT_ID}/packages/maven
PIP_DEFAULT_PATH/api/v4/projects/${CI_PROJECT_ID}/packages/pypi
POETRY_DEFAULT_PATH/api/v4/projects/${CI_PROJECT_ID}/packages/pypi
CMAKE_DEFAULT_PATHapi/v4/projects/${CI_PROJECT_ID}/packages/generic
KUSTOMIZE_FILES**/kustomization.yaml
HELM_FILES**/values.yaml
HELM_YQ_EXPRESSION.image.tag = strenv(HELM_IMAGE_TAG)
SEMANTIC_RELEASE_REF_REGEX/^((\d+)(\.(\d+))?(\.x)|main|master|next|next-major|beta|alpha)$/

DOCKER_AUTH_CONFIG

{
    "auths": {
        "${REGISTRY}": {
            "username": "${REGISTRY_USER}",
            "password": "${REGISTRY_PASSWORD}"
        },
        "${UPSTREAM_REGISTRY}": {
            "username": "${UPSTREAM_REGISTRY_USER}",
            "password": "${UPSTREAM_REGISTRY_PASSWORD}"
        },
        "${HELM_REGISTRY}": {
            "username": "${HELM_REGISTRY_USER}",
            "password": "${HELM_REGISTRY_PASSWORD}"
        }
    }
}

Zarf common​

Inherited zarf-cache defaults​

VariableDeclared default
CACHE_COMPRESSION_FORMATtarzstd
CACHE_COMPRESSION_LEVELfast

CMake code build​

cmake-build job defaults​

VariableDeclared default
CMAKE_UPLOAD_HOST${CMAKE_STAGING_PACKAGE_HOST}
CMAKE_UPLOAD_PATH${CMAKE_STAGING_PACKAGE_PATH}
CMAKE_UPLOAD_USERNAME${CMAKE_STAGING_PACKAGE_USERNAME}
CMAKE_UPLOAD_PASSWORD${CMAKE_STAGING_PACKAGE_PASSWORD}
CMAKE_UPLOAD_TOKEN${CMAKE_STAGING_PACKAGE_TOKEN}

CMake config​

Global defaults​

VariableDeclared default
CMAKE_IMAGEregistry.build.smoothglue.io/getting-started/pillars/images/cpp/pipeline:0.1.0
CMAKE_BUILD_TYPERelease
CMAKE_COVERAGE_BUILD_TYPEDebug
CMAKE_GENERATORNinja
CMAKE_BUILD_DIR${BUILD_DIR}/cpp
CMAKE_COVERAGE_BUILD_DIR${BUILD_DIR}/coverage
CMAKE_SOURCE_DIRUnset
CMAKE_ARGSUnset
CMAKE_BUILD_ARGSUnset
CMAKE_TEST_ARGSUnset
CMAKE_COVERAGE_FLAGS--coverage
CMAKE_TEST_JUNIT_REPORT${EVIDENCE_DIR}/cmake-junit.xml
CMAKE_COVERAGE_XML${EVIDENCE_DIR}/reports/cmake-coverage.xml
CMAKE_COVERAGE_HTML${EVIDENCE_DIR}/reports/html
CMAKE_PACKAGE_NAME${CI_PROJECT_NAME}
CMAKE_DEFAULT_PATHapi/v4/projects/${CI_PROJECT_ID}/packages/generic
CMAKE_PACKAGE_HOST${PACKAGE_HOST}
CMAKE_PACKAGE_PATH${CMAKE_DEFAULT_PATH}
CMAKE_PACKAGE_USERNAME${PACKAGE_USERNAME}
CMAKE_PACKAGE_PASSWORD${PACKAGE_PASSWORD}
CMAKE_PACKAGE_TOKEN${PACKAGE_TOKEN}
CMAKE_STAGING_PACKAGE_HOST${STAGING_PACKAGE_HOST}
CMAKE_STAGING_PACKAGE_PATH${CMAKE_DEFAULT_PATH}
CMAKE_STAGING_PACKAGE_USERNAME${STAGING_PACKAGE_USERNAME}
CMAKE_STAGING_PACKAGE_PASSWORD${STAGING_PACKAGE_PASSWORD}
CMAKE_STAGING_PACKAGE_TOKEN${STAGING_PACKAGE_TOKEN}

Inherited build-vars defaults​

VariableDeclared default
BUILD_DIRdist

CMake publish​

cmake-package job defaults​

VariableDeclared default
CMAKE_UPLOAD_HOST${CMAKE_PACKAGE_HOST}
CMAKE_UPLOAD_PATH${CMAKE_PACKAGE_PATH}
CMAKE_UPLOAD_USERNAME${CMAKE_PACKAGE_USERNAME}
CMAKE_UPLOAD_PASSWORD${CMAKE_PACKAGE_PASSWORD}
CMAKE_UPLOAD_TOKEN${CMAKE_PACKAGE_TOKEN}

Shared build and release​

Inherited release-vars defaults​

VariableDeclared default
SEMANTIC_RELEASE_ARGS--extends @smoothglue/pillars-config

Inherited build-vars defaults​

VariableDeclared default
BUILD_DIRbuild

Container build​

Global defaults​

VariableDeclared default
DOCKERFILEDockerfile
BUILD_ARGSUnset
BUILD_SECRETS--secret=id=ci-job-token,env=CI_JOB_TOKEN
CACHE_ENABLEDtrue

container-image job defaults​

VariableDeclared default
BRANCH_TAG${CI_COMMIT_REF_SLUG}

Image and application analysis​

Global defaults​

VariableDeclared default
APP_HTTP_PORT8080

grype job defaults​

VariableDeclared default
GRYPE_LOG_FILE${EVIDENCE_DIR}/grype-log.txt
GRYPE_LOG_LEVELinfo
GRYPE_SEARCH_SCOPEall-layers
GRYPE_FAIL_ON_SEVERITYhigh
GRYPE_CHECK_FOR_APP_UPDATEfalse

neuvector job defaults​

VariableDeclared default
NV_API_HOSTneuvector-svc-controller.neuvector.svc.cluster.local
NV_API_PORT10443
NV_API_SCAN_URLhttps://$NV_API_HOST:$NV_API_PORT/v1/scan/repository
NV_REGISTRY_USER${REGISTRY_USER}
NV_REGISTRY_PASSWORD${REGISTRY_PASSWORD}
NV_REGISTRY_URLhttps://${REGISTRY}
NV_REPOSITORY${IMAGE}
NV_TAG${IMAGE_TAG}
THRESHOLD_HIGH0
THRESHOLD_MEDIUM5
THRESHOLD_LOW99
THRESHOLD_SCORE_V37.0
REPORT_FILE${EVIDENCE_DIR}/scan-repository.json
SUMMARY_FILE${EVIDENCE_DIR}/scan-summary.txt

zap job defaults​

VariableDeclared default
ZAP_TARGEThttp://${CI_PROJECT_NAME}:${APP_HTTP_PORT}
ZAP_BASE_DIR/zap/wrk/
SARIF_REPORT_DIR${ZAP_BASE_DIR}/${EVIDENCE_DIR}

cypress job defaults​

VariableDeclared default
CYPRESS_BASE_URLhttp://${CI_PROJECT_NAME}:${APP_HTTP_PORT}
NO_COLOR1

Helm​

update-helm-image job defaults​

VariableDeclared default
HELM_IMAGE_NAME${REGISTRY}/${IMAGE}
HELM_IMAGE_TAG${IMAGE_TAG}
HELM_BRANCH${CI_COMMIT_REF_NAME}
GIT_PUSH_OPTIONS-o ci.skip
GIT_COMMIT_MESSAGEci: update image tag in helm values

Evidence archive​

software-bill-of-material job defaults​

VariableDeclared default
SBOM_OUTPUT_PREFIXsbom-${CI_PROJECT_NAME}-${CI_COMMIT_SHORT_SHA}

body-of-evidence job defaults​

VariableDeclared default
BOE_OUTPUT_PREFIXboe-${CI_PROJECT_NAME}-${CI_COMMIT_SHORT_SHA}

Release​

semantic-release job defaults​

VariableDeclared default
GITLAB_TOKEN$CI_JOB_TOKEN
SEMANTIC_RELEASE_TAG_FORMAT$${version}

attach-artifacts job defaults​

VariableDeclared default
GLAB_SEND_TELEMETRYfalse
GLAB_NO_PROMPTtrue
GLAB_CHECK_UPDATEfalse
GITLAB_HOST$CI_SERVER_HOST

Source analysis​

Inherited megalinter defaults​

VariableDeclared default
DEFAULT_WORKSPACE${CI_PROJECT_DIR}
PRINT_ALPACAfalse
FLAVOR_SUGGESTIONSfalse
REPORT_OUTPUT_FOLDER${EVIDENCE_DIR}/megalinter-reports
CONFIG_REPORTERfalse
MARKDOWN_SUMMARY_REPORTERtrue
JSON_REPORTERtrue
JSON_REPORTER_OUTPUT_DETAILdetailed
SARIF_REPORTERtrue

semgrep job defaults​

VariableDeclared default
SEMGREP_SEND_METRICSoff
SEMGREP_RULESETci

trufflehog job defaults​

VariableDeclared default
GIT_STRATEGYclone
SINCE_BRANCH${CI_DEFAULT_BRANCH}

dependency-check job defaults​

VariableDeclared default
SUPPRESSIONS_FILEdependency-check-suppressions.xml
DEPENDENCY_CHECK_EXTRA_ARGSUnset

dockerfile-lint job defaults​

VariableDeclared default
DOCKERFILE_PATHDockerfile

malcontent job defaults​

VariableDeclared default
MALCONTENT_OUTPUT_PREFIXmalcontent-${CI_PROJECT_NAME}-${CI_PIPELINE_ID}
MALCONTENT_THRESHOLD3

sonarqube job defaults​

VariableDeclared default
SONAR_PROJECT_PATHsonar-project.properties
SONARQUBE_HOSThttps://sonarqube.${PLATFORM_DOMAIN}

commitlint job defaults​

VariableDeclared default
GIT_FETCH_EXTRA_FLAGS$CI_DEFAULT_BRANCH $CI_COMMIT_REF_NAME $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME $CI_MERGE_REQUEST_TARGET_BRANCH_NAME

.NET config​

Global defaults​

VariableDeclared default
DOTNET_CLI_TELEMETRY_OPTOUT1
DOTNET_NOLOGO1
NUGET_PACKAGES.nuget/packages
DOTNET_CONFIGURATIONRelease
DOTNET_PROJECTUnset
DOTNET_PUBLISH_PROJECTUnset
DOTNET_UPSTREAM_REGISTRY_PATHapi/v4/groups/${CI_PROJECT_NAMESPACE_ID}/-/packages/nuget/index.json
DOTNET_STAGING_REGISTRY_PATHapi/v4/projects/${CI_PROJECT_ID}/packages/nuget/index.json
DOTNET_PUBLISH_REGISTRY_PATHapi/v4/projects/${CI_PROJECT_ID}/packages/nuget/index.json

Inherited release-vars defaults​

VariableDeclared default
SEMANTIC_RELEASE_ARGS--extends @smoothglue/pillars-config-dotnet

.NET static code analysis​

dotnet-tests job defaults​

VariableDeclared default
DOTNET_TEST_RESULTS_DIR${EVIDENCE_DIR}/reports
DOTNET_COVERAGE_DIR${EVIDENCE_DIR}/reports/coverage

Go config​

Global defaults​

VariableDeclared default
GOLANG_VERSION1.26.6
GO_MODULE_DIR.
GOPATH/go
GOFLAGS-buildvcs=false
GOMODCACHE${CI_PROJECT_DIR}/.go-cache/mod
GOBIN${CI_PROJECT_DIR}/.go-cache/bin
GOCACHE${CI_PROJECT_DIR}/.go-cache/build

Go publish​

goreleaser-package job defaults​

VariableDeclared default
GITLAB_TOKEN${CI_JOB_TOKEN}

Gradle config​

Global defaults​

VariableDeclared default
GRADLE_USER_HOME.gradle
GRADLE_UPSTREAM_REPOSITORY_HOST${UPSTREAM_PACKAGE_HOST}
GRADLE_UPSTREAM_REPOSITORY_PATH${GRADLE_DEFAULT_PATH}
GRADLE_UPSTREAM_REPOSITORY_USERNAME${UPSTREAM_PACKAGE_USERNAME}
GRADLE_UPSTREAM_REPOSITORY_PASSWORD${UPSTREAM_PACKAGE_PASSWORD}
GRADLE_UPSTREAM_REPOSITORY_TOKEN${CI_JOB_TOKEN}
GRADLE_UPSTREAM_REPOSITORY_TOKEN_NAMEJob-Token
GRADLE_UPSTREAM_REPOSITORY_AUTH_TYPEheader(HttpHeaderAuthentication)
GRADLE_STAGING_REPOSITORY_HOST${STAGING_PACKAGE_HOST}
GRADLE_STAGING_REPOSITORY_PATH${GRADLE_DEFAULT_PATH}
GRADLE_STAGING_REPOSITORY_USERNAME${STAGING_PACKAGE_USERNAME}
GRADLE_STAGING_REPOSITORY_PASSWORD${STAGING_PACKAGE_PASSWORD}
GRADLE_STAGING_REPOSITORY_TOKEN${CI_JOB_TOKEN}
GRADLE_STAGING_REPOSITORY_TOKEN_NAMEJob-Token
GRADLE_STAGING_REPOSITORY_AUTH_TYPEheader(HttpHeaderAuthentication)
GRADLE_REPOSITORY_HOST${PACKAGE_HOST}
GRADLE_REPOSITORY_PATH${GRADLE_DEFAULT_PATH}
GRADLE_REPOSITORY_USERNAME${PACKAGE_USERNAME}
GRADLE_REPOSITORY_PASSWORD${PACKAGE_PASSWORD}
GRADLE_REPOSITORY_TOKEN${CI_JOB_TOKEN}
GRADLE_REPOSITORY_TOKEN_NAMEJob-Token
GRADLE_REPOSITORY_AUTH_TYPEheader(HttpHeaderAuthentication)
GRADLE_PACKAGE_VERSION${PACKAGE_VERSION}
GRADLE_STAGING_PACKAGE_VERSION${PACKAGE_VERSION}

Inherited release-vars defaults​

VariableDeclared default
SEMANTIC_RELEASE_ARGS--extends @smoothglue/pillars-config-gradle

Inherited build-vars defaults​

VariableDeclared default
BUILD_DIRbuild

Gradle static code analysis​

gradle-tests job defaults​

VariableDeclared default
CItrue
JUNIT_JUPITER_OUTPUT_DIR${EVIDENCE_DIR}

Helm downstream trigger​

trigger-update-helm-image job defaults​

VariableDeclared default
HELM_IMAGE_UPDATE${HELM_IMAGE_UPDATE}
HELM_IMAGE_NAME${REGISTRY}/${IMAGE}
HELM_IMAGE_TAG${IMAGE_TAG}
HELM_BRANCH${HELM_BRANCH}
HELM_FILES${HELM_FILES}
HELM_YQ_EXPRESSION.image.tag = strenv(HELM_IMAGE_TAG)
HELM_PROJECT${HELM_PROJECT}

Kustomize update​

update-kustomize-image job defaults​

VariableDeclared default
KUSTOMIZE_BRANCH${CI_COMMIT_REF_NAME}
GIT_PUSH_OPTIONS-o ci.skip
GIT_COMMIT_MESSAGEci: update image tag in kustomization files

Kustomize downstream trigger​

trigger-update-kustomize-image job defaults​

VariableDeclared default
KUSTOMIZE_IMAGE_UPDATE${KUSTOMIZE_IMAGE_UPDATE}
KUSTOMIZE_IMAGE_NAME${REGISTRY}/${IMAGE}
KUSTOMIZE_IMAGE_TAG${IMAGE_TAG}
KUSTOMIZE_BRANCH${KUSTOMIZE_BRANCH}
KUSTOMIZE_FILES${KUSTOMIZE_FILES}
KUSTOMIZE_PROJECT${KUSTOMIZE_PROJECT}

npm config​

Global defaults​

VariableDeclared default
NPM_CONFIG_CACHE.npm
NPM_CONFIG_PREFER_OFFLINEtrue
NPM_CONFIG_FUNDfalse
NPM_CONFIG_AUDITfalse
NPM_REGISTRY_HOST${PACKAGE_HOST}
NPM_REGISTRY_PATH${NPM_DEFAULT_PATH}
NPM_REGISTRY_USERNAMEUnset
NPM_REGISTRY_PASSWORDUnset
NPM_REGISTRY_TOKEN${PACKAGE_TOKEN}
NPM_STAGING_REGISTRY_HOST${STAGING_PACKAGE_HOST}
NPM_STAGING_REGISTRY_PATH${NPM_DEFAULT_PATH}
NPM_STAGING_REGISTRY_USERNAMEUnset
NPM_STAGING_REGISTRY_PASSWORDUnset
NPM_STAGING_REGISTRY_TOKEN${STAGING_PACKAGE_TOKEN}
NPM_UPSTREAM_REGISTRY_HOST${UPSTREAM_PACKAGE_HOST}
NPM_UPSTREAM_REGISTRY_PATH${NPM_DEFAULT_PATH}
NPM_UPSTREAM_REGISTRY_USERNAME${UPSTREAM_PACKAGE_USERNAME}
NPM_UPSTREAM_REGISTRY_PASSWORD${UPSTREAM_PACKAGE_PASSWORD}
NPM_UPSTREAM_REGISTRY_TOKEN${UPSTREAM_PACKAGE_TOKEN}
NPM_AUDIT_REGISTRY_HOSTUnset
NPM_AUDIT_REGISTRY_PATHUnset
NPM_AUDIT_REGISTRY_USERNAMEUnset
NPM_AUDIT_REGISTRY_PASSWORDUnset
NPM_AUDIT_REGISTRY_TOKENUnset
NPM_NPMRC_CONFIGUnset
DISABLE_PROJECT_NPMRC_CONFIGfalse
NPM_TEST_SCRIPTtest
NPM_TEST_ARGSUnset
NPM_TEST_JUNIT_REPORT${EVIDENCE_DIR}/junit.xml
NPM_TEST_COBERTURA_REPORT${EVIDENCE_DIR}/coverage/cobertura-coverage.xml
NPM_TESTS_SHARDINGfalse
NPM_TESTS_SHARD_COUNT5
NPM_PACKAGE_TAG${CI_COMMIT_REF_SLUG}
NPM_STAGING_PUBLISH_ARGSUnset
NPM_PUBLISH_ARGSUnset
NVM_DIR${CI_PROJECT_DIR}/.nvm

Inherited release-vars defaults​

VariableDeclared default
SEMANTIC_RELEASE_ARGS--extends @smoothglue/pillars-config-npm

Inherited build-vars defaults​

VariableDeclared default
BUILD_DIRdist
BUILD_PATH$BUILD_DIR

npm static code analysis​

Inherited npm-tests-recombine defaults​

VariableDeclared default
NPM_TEST_MERGE_COMMANDnpx vitest run --merge-reports
NPM_TESTS_COVERAGE_MERGE_COMMANDnpx vitest-coverage-merge -o ${EVIDENCE_DIR}/coverage --normalize

npm-audit job defaults​

VariableDeclared default
NPM_CONFIG_AUDIT_LEVELhigh

Poetry config​

Global defaults​

VariableDeclared default
PYTHON_VERSION3.12
POETRY_VERSION2.1.0
PYTHON_PYLINT_PRE_COMMANDSExpanded below.
PYTHON_PYLINT_CLI_EXECUTABLEpoetry,run,pylint
POETRY_HOMEpoetry
POETRY_NO_INTERACTIONtrue
POETRY_VIRTUALENVS_IN_PROJECTtrue
POETRY_VIRTUALENVS_CREATEtrue
POETRY_CONFIG_PREFER_OFFLINEtrue
POETRY_CACHE_DIR.poetry-cache
POETRY_CONFIG_FUNDfalse
POETRY_CONFIG_AUDITfalse
POETRY_CONFIG_KEYRING_ENABLEDfalse
PIP_EXTRA_INDEX_URLExpanded below.
BUILD_ARGSVERSION=${PACKAGE_VERSION}
BUILD_SECRETSExpanded below.
POETRY_PUBLISH_REGISTRY_HOST${PACKAGE_HOST}
POETRY_PUBLISH_REGISTRY_PATH${POETRY_DEFAULT_PATH}
POETRY_PUBLISH_REGISTRY_USERNAMEgitlab-ci-token
POETRY_PUBLISH_REGISTRY_PASSWORD${CI_JOB_TOKEN}
POETRY_STAGING_REGISTRY_HOST${STAGING_PACKAGE_HOST}
POETRY_STAGING_REGISTRY_PATH${POETRY_DEFAULT_PATH}
POETRY_STAGING_REGISTRY_USERNAMEgitlab-ci-token
POETRY_STAGING_REGISTRY_PASSWORD${CI_JOB_TOKEN}
POETRY_UPSTREAM_REGISTRY_HOST${CI_SERVER_HOST}
POETRY_UPSTREAM_REGISTRY_PATH/api/v4/groups/${CI_PROJECT_NAMESPACE_ID}/-/packages/pypi/simple/
POETRY_UPSTREAM_REGISTRY_USERNAMEgitlab-ci-token
POETRY_UPSTREAM_REGISTRY_PASSWORD${CI_JOB_TOKEN}
POETRY_HTTP_BASIC_UPSTREAM_USERNAME${POETRY_UPSTREAM_REGISTRY_USERNAME}
POETRY_HTTP_BASIC_UPSTREAM_PASSWORD${POETRY_UPSTREAM_REGISTRY_PASSWORD}
POETRY_HTTP_BASIC_STAGING_USERNAME${POETRY_STAGING_REGISTRY_USERNAME}
POETRY_HTTP_BASIC_STAGING_PASSWORD${POETRY_STAGING_REGISTRY_PASSWORD}
POETRY_HTTP_BASIC_PUBLISH_USERNAME${POETRY_REGISTRY_USERNAME}
POETRY_HTTP_BASIC_PUBLISH_PASSWORD${POETRY_REGISTRY_PASSWORD}

PYTHON_PYLINT_PRE_COMMANDS

[{ "command": "PIP_EXTRA_INDEX_URL=\" https://${POETRY_UPSTREAM_REGISTRY_USERNAME}:${POETRY_UPSTREAM_REGISTRY_PASSWORD}@${POETRY_UPSTREAM_REGISTRY_HOST}${POETRY_UPSTREAM_REGISTRY_PATH} https://${POETRY_STAGING_REGISTRY_USERNAME}:${POETRY_STAGING_REGISTRY_PASSWORD}@${POETRY_STAGING_REGISTRY_HOST}${POETRY_STAGING_REGISTRY_PATH} https://${POETRY_PUBLISH_REGISTRY_USERNAME}:${POETRY_PUBLISH_REGISTRY_PASSWORD}@${POETRY_PUBLISH_REGISTRY_HOST}${POETRY_PUBLISH_REGISTRY_PATH} \" pip install --no-cache-dir poetry" },{ "command": "POETRY_HTTP_BASIC_UPSTREAM_USERNAME=${POETRY_UPSTREAM_REGISTRY_USERNAME} POETRY_HTTP_BASIC_UPSTREAM_PASSWORD=${POETRY_UPSTREAM_REGISTRY_PASSWORD} POETRY_HTTP_BASIC_STAGING_USERNAME=${POETRY_STAGING_REGISTRY_USERNAME} POETRY_HTTP_BASIC_STAGING_PASSWORD=${POETRY_STAGING_REGISTRY_PASSWORD} POETRY_HTTP_BASIC_PUBLISH_USERNAME=${POETRY_PUBLISH_REGISTRY_USERNAME} POETRY_HTTP_BASIC_PUBLISH_PASSWORD=${POETRY_PUBLISH_REGISTRY_PASSWORD} poetry -C ${CI_PROJECT_DIR} install --all-groups" }]

PIP_EXTRA_INDEX_URL

https://${POETRY_UPSTREAM_REGISTRY_USERNAME}:${POETRY_UPSTREAM_REGISTRY_PASSWORD}@${POETRY_UPSTREAM_REGISTRY_HOST}${POETRY_UPSTREAM_REGISTRY_PATH} https://${POETRY_STAGING_REGISTRY_USERNAME}:${POETRY_STAGING_REGISTRY_PASSWORD}@${POETRY_STAGING_REGISTRY_HOST}${POETRY_STAGING_REGISTRY_PATH}/simple/ https://${POETRY_PUBLISH_REGISTRY_USERNAME}:${POETRY_PUBLISH_REGISTRY_PASSWORD}@${POETRY_PUBLISH_REGISTRY_HOST}${POETRY_PUBLISH_REGISTRY_PATH}

BUILD_SECRETS

--secret=id=ci-job-token,env=CI_JOB_TOKEN
--secret=id=pip-extra-index-url,env=PIP_EXTRA_INDEX_URL
--secret=id=poetry-http-basic-upstream-username,env=POETRY_HTTP_BASIC_UPSTREAM_USERNAME
--secret=id=poetry-http-basic-upstream-password,env=POETRY_HTTP_BASIC_UPSTREAM_PASSWORD
--secret=id=poetry-http-basic-staging-username,env=POETRY_HTTP_BASIC_STAGING_USERNAME
--secret=id=poetry-http-basic-staging-password,env=POETRY_HTTP_BASIC_STAGING_PASSWORD
--secret=id=poetry-http-basic-publish-username,env=POETRY_HTTP_BASIC_PUBLISH_USERNAME
--secret=id=poetry-http-basic-publish-password,env=POETRY_HTTP_BASIC_PUBLISH_PASSWORD

Inherited release-vars defaults​

VariableDeclared default
SEMANTIC_RELEASE_ARGS--extends @smoothglue/pillars-config-python

Inherited build-vars defaults​

VariableDeclared default
BUILD_DIRdist

pip config​

Global defaults​

VariableDeclared default
PIP_BUILD_PACKAGESbuild==1.3.0 twine==6.2.0
PYTHON_PYLINT_PRE_COMMANDS[{ "command": "pip install --no-cache-dir -r requirements.txt" }]
PYTHON_PYRIGHT_PRE_COMMANDS${PYTHON_PYLINT_PRE_COMMANDS}
PIP_UPSTREAM_REGISTRY_PATH/api/v4/groups/${CI_PROJECT_NAMESPACE_ID}/-/packages/pypi/simple/
PIP_EXTRA_INDEX_URLUnset
BUILD_ARGSVERSION=${PACKAGE_VERSION}
BUILD_SECRETSExpanded below.
PIP_CACHE_DIR.pip-cache

BUILD_SECRETS

--secret=id=ci-job-token,env=CI_JOB_TOKEN
--secret=id=pip-extra-index-url,env=PIP_EXTRA_INDEX_URL

Zarf build​

zarf-package-build job defaults​

VariableDeclared default
ARTIFACT_DIR${ZARF_BUILD_ARTIFACT_DIR}/${CI_JOB_ID}

Zarf scan​

zarf-package-scan job defaults​

VariableDeclared default
GRYPE_FAIL_ON_SEVERITYhigh
GRYPE_CHECK_FOR_APP_UPDATEfalse

Inputs without a declared default​

The functional references also describe inputs used by commands or rules that have no variable declaration here. These include enable/disable switches; SONAR_TOKEN, SONARQUBE_TOKEN, NV_X_AUTH_APIKEY, NVD_API_KEY, OSS Index credentials, RELEASE_TOKEN, GPG signing inputs, NODE_VERSION, HELM_CHART_VERSION, CACHE_ARGS, ZAP_FULL_SCAN_DISABLED, standalone manifest-update image coordinates, Zarf configuration inputs, and the optional synchronization credentials.

Do not set a switch merely because it is absent from this catalog. Choose the workflow, read its prerequisites, and configure the inputs it uses. Secrets belong in protected or masked CI/CD variables as appropriate, not in committed examples.