Linters, migrators, and policy engines that read pipeline definitions need real ones to read. This category ships workflow and build definitions across the systems teams actually run: GitHub Actions, GitLab CI, CircleCI, Azure Pipelines, Tekton and Argo manifests, Jenkinsfiles, Makefiles, and Gradle builds. Infrastructure-as-code covers Terraform configuration and variable files, generic HCL, and Kubernetes manifests. Data-orchestration fixtures carry Airflow-style DAGs, CWL workflow descriptions, and DAG graphs in Graphviz and Mermaid so a visualiser can be tested against a documented topology. Valid, deprecated-syntax, and intentionally invalid variants are labelled in title and description, and every fixture is inert configuration, no scripts that do anything if run.
Filter pipelines on Browse · 115 files · 16 subcategories
GitHub Actions, GitLab CI, CircleCI, Azure Pipelines, Tekton and Argo manifests, Jenkinsfiles, Makefiles, and Gradle builds, plus Terraform, HCL, and Kubernetes manifests for infrastructure-as-code.
They are inert configuration fixtures for linters, migrators, and policy engines. Steps reference fictional images and scripts, and nothing here is an executable.
Yes, deprecated-syntax and intentionally invalid workflow fixtures are labelled in both title and description so schema validators can be tested on the failing case.
An Airflow DAG definition in the classic operator style, using only the no-op EmptyOperator so the file describes a topology and performs no work. Carries the six-task ETL graph shared across the Airflow JSON, Argo, Graphviz and Mermaid fixtures.
A decorator-based Airflow TaskFlow DAG where dependencies are implied by function calls rather than >> operators: the shape static DAG extractors most often get wrong. Every task returns a literal, so nothing performs I/O.
The serialized-DAG shape Airflow stores in its metadata database, as standalone JSON: per-task metadata with explicit downstream_task_ids. Carries the same six-task topology as the Python, Argo, Graphviz and Mermaid fixtures.
The shared six-task topology as a plain node/edge JSON document that also publishes the expected answers (roots, leaves, longest path, and topological order), so a graph library or DAG visualiser can be scored without a hand-written oracle.
The shared topology plus one back edge, making it intentionally invalid as a DAG. The document publishes the cycle it contains, so a scheduler or graph validator can be tested on both detecting the cycle and naming it.
An Argo CD Application with automated sync, prune and self-heal, retry backoff, sync options, and an ignoreDifferences rule that exempts replica counts from drift detection. All Git and cluster endpoints are example.invalid.
An Argo CronWorkflow wrapping an inline workflowSpec: a cron schedule with an explicit timezone, Replace concurrency, history limits, and a suspend flag. Nested-spec shape that flat schedule extractors miss.
An Argo Workflows DAG template carrying the same six-task ETL topology as the Airflow, Graphviz and Mermaid fixtures in this category, so a converter or visualiser can be scored against one known answer across four formats.
Argo's steps template, whose double-nested list is a genuine parser trap: the outer list is sequential and the inner list is parallel, so a reader that flattens it reports four sequential steps instead of three groups.
A Tekton Pipeline chaining three tasks with runAfter, a when expression that consumes a prior task's result, and a finally task that runs regardless of outcome. The finally block is a common omission in Tekton graph extractors.
A Tekton PipelineRun as a run request: a pipelineRef, params, timeouts and a workspace binding, with no status block. A completed run's status is a record of what happened and belongs with test-report fixtures, not with pipeline definitions.
A Tekton Task declaring string and array params, a workspace, a result, and two steps that use Tekton's $(params.x) and $(workspaces.x.path) variable syntax, including the $(params.flags[*]) array expansion form.
Azure's named-leg matrix form, where each leg is a mapping of variables rather than an axis product: three Python legs, a maxParallel cap, a job timeout, and a JUnit results publish step that runs on failure too.
A three-stage Azure Pipelines definition with a build-number format expression, a variable group reference, stage conditions built from the expression functions, and a deployment job using the runOnce strategy against a named environment.
The simplest Azure Pipelines shape: no stages or jobs, just a trigger with branch and path filters, a PR trigger, variables, and a flat step list mixing task and script steps. Baseline for the stage-based fixtures.
Compile-time template expressions: an `${{ each }}` loop over an object parameter, an `${{ if }}` conditional insertion, an `extends` template, and a step template with arguments. These resolve before runtime, which template-aware linters must model.
An intentionally invalid Azure Pipelines file: valid YAML that mixes top-level steps with a stages block, depends on an undeclared stage, and gives `pool` a bare string. For testing that a validator rejects it and reports all three faults.
A Gradle Groovy DSL build script with a plugins block, a Java toolchain, five dependency configurations, task configuration via named() and a registered task. Every coordinate and repository is fictional, so nothing resolves.
A Gradle settings script (the file that actually defines a multi-project build) with pluginManagement, a repositories mode, a version catalog declaring libraries, a bundle and a plugin, and one project remapped to a custom directory.
A gradle.properties exercising the .properties grammar rather than Gradle: a \uXXXX escape, a backslash line continuation, all three key/value separator forms, and a key containing escaped separator characters.
The .properties edge cases collected in one file: both comment markers, empty values, a value whose trailing spaces are significant, unescaped = and : inside values, a # that is not a comment, escape sequences, an escaped space in a key, and a duplicate key.
Pattern rules with the automatic variables $@, $<, $^ and $*, ifeq/ifdef conditional directives, a vpath search path, and a define block invoked through $(call). All recipe lines are TAB-indented and echo-only.
A Makefile whose recipe lines are indented with real TAB characters, as make requires. Covers simple, conditional, appended and substitution-reference variables, .PHONY, and .DEFAULT_GOAL. Every recipe is echo-only, so running it does nothing.
An intentionally invalid Makefile whose recipe lines are indented with four spaces instead of the required TAB. This is the most common Makefile defect there is, and it is invisible in most editors, which is exactly why it belongs in a fixture set.
A build-tool configuration in TOML, chosen for the constructs YAML has no direct equivalent for: three [[build.step]] array-of-tables entries carrying an ordered pipeline, a quoted glob key, and all three TOML date-time flavours.
A CircleCI 2.1 config with a two-job workflow, a fallback cache-key list, workspace persistence between jobs, and a test-results store. The baseline the other CircleCI fixtures vary from.
An intentionally invalid CircleCI config: an unquoted `version: 2.10` that YAML loads as the float 2.1, a workflow referencing an undefined job, and a job with no execution environment. For testing that a validator rejects it and explains each fault.
CircleCI orbs and reusable named executors: two orb imports, two executors at different resource classes, an orb-provided step, and a branch filter combining an exact name with a regex.
A reusable CircleCI command with string and boolean parameters, a conditional `when` step, and a job parameterised by an enum expanded through a workflow matrix. Exercises CircleCI's << >> template syntax, which is not YAML and not Jinja.
A CircleCI workflow matrix across three operating systems and two Go versions with one exclusion, plus a tag filter regex. Six combinations minus one is five jobs, documented so an expansion can be scored exactly.
A CWL v1.2 CommandLineTool with typed inputs, positional and prefixed bindings, a JavaScript outputEval expression, resource requirements, a Docker hint, and an IANA $namespaces block. Inert: it describes an invocation and runs nothing.
CWL scatter in both forms: a single-parameter scatter over an array input, and a two-parameter scatter with scatterMethod flat_crossproduct. The scatter dimensionality is what distinguishes correct CWL engines from approximate ones.
A CWL Workflow carrying the same six-step ETL topology as the Airflow and Argo fixtures, with dependencies expressed as step output references and a multi-source input resolved by pickValue. For cross-format DAG conversion tests.
An intentionally invalid CWL document: a nonexistent cwlVersion, an unknown class, a step consuming an output no step produces, and outputs given as a bare string. Four documented faults for a CWL validator to report.
The shared six-task ETL topology as a Graphviz digraph, with node and edge defaults, per-node attribute overrides, a same-rank constraint and C-style comments. Carries the identical graph to the Airflow, Argo, CWL and Mermaid fixtures.
The same topology plus one back edge, so the graph is deliberately not a DAG. A renderer must still draw it and a scheduler must reject it, which is why this is a reference fixture rather than a corrupt file.
A Mermaid stateDiagram-v2 describing environment promotion with canary and rollback transitions, start and end pseudostates, and a note block. A second Mermaid diagram type, so a renderer is not only tested on flowcharts.
The shared six-task ETL topology as a Mermaid flowchart, with mixed node shapes, a subgraph, a classDef and %% comments. The Mermaid twin of the Graphviz fixture, for scoring diagram-format converters against one known answer.
Compose with three x- extension fields carrying YAML anchors that are merged into services. The trap is ordering: a tool that strips x- keys before parsing the YAML destroys the anchors and the file stops resolving.
An intentionally invalid Compose file: services as a list, a service with both image and an empty build, an unquoted 8080:8080 port that YAML 1.1 reads as a base-60 integer, and a depends_on naming an undefined service.
Five Compose services across three profiles, one of which belongs to two profiles at once. Services with no profiles key always start; the rest are opt-in, which is the selection logic this fixture exists to test.
A Compose Specification file with no top-level version key, condition-based depends_on, healthchecks, and a deploy resource limit. Parsers written against the older schema often require the version key, which is exactly what this fixture separates.
A three-stage Dockerfile with a syntax directive, build args interpolated into FROM lines, a heredoc COPY, multi-line LABEL and ENV continuations, a non-root USER, and HEALTHCHECK in exec form. Inert: every base image is a fictional example.invalid reference.
An action.yml-shaped composite action definition with typed inputs, a declared output bound to a step output, and a branding block. Distinct from a workflow file, and a common blind spot in workflow linters that only understand .github/workflows.
A deployment workflow exercising the blocks that governance tools care about: a concurrency group with cancel-in-progress, paths-ignore filters, a named environment with a URL, and a job timeout. All hosts are example.invalid.
A deprecated-syntax workflow: ::set-output, ::set-env and ::add-path markers, a retired runner label, and v2 action pins. Every construct here was removed from the runner, so an upgrade migrator can be scored on whether it rewrites all of them.
An expression-dense workflow: fromJSON-generated matrix axes, hashFiles cache keys, format and join calls, a folded multi-line if condition, and the && / || coalescing idiom that stands in for a ternary. For testing template resolvers before any schema check.
The matrix case that expanders get wrong: a 3x3 base grid, two exclude rules, and one include entry that adds a combination and an extra key. Nine minus two plus one is eight jobs, documented in the specs so an expansion can be scored exactly.
A GitHub Actions CI workflow with a two-axis build matrix (three Node versions across two runners), an npm cache, and a conditional artifact upload. Six matrix combinations, so a workflow linter or matrix expander has a documented answer to check against.
The workflow file that exposes the YAML 1.1 boolean resolver: a bare `on` key becomes True in PyYAML, SnakeYAML and Psych, so a round-trip through those loaders loses the trigger block. The env values repeat the trap with NO, yes and off alongside a quoted control.
A schema-valid workflow that should still be rejected on review: permissions: write-all at the workflow level plus three unused write scopes on the job. Nothing here is an exploit; it is the least-privilege finding a policy engine is supposed to raise.
The called half of a reusable-workflow pair: a workflow_call trigger with typed inputs, a default value, and a declared output wired to a job output. Pair it with the caller fixture to test cross-workflow input and output resolution.
The calling half of a reusable-workflow pair: a workflow_dispatch trigger with a choice input, two jobs that call the same reusable workflow with different arguments, and a third that consumes their outputs through needs.
A scheduled workflow with two cron entries plus a manual workflow_dispatch trigger carrying a boolean and a choice input. For testing cron parsers, trigger extraction, and input-type handling in workflow tooling.
An intentionally invalid GitHub Actions workflow: well-formed YAML that breaks the workflow schema in four documented ways, no jobs mapping, a scalar `on`, a mapping `runs-on`, and a step carrying both uses and run. For testing that a validator rejects, and reports why.
GitLab's `!reference` custom YAML tag used three ways: inside a script list, as a whole after_script value, and as a whole rules value. A stock YAML 1.2 loader has no constructor for it and raises; GitLab's loader resolves each key path.
The two GitLab inheritance mechanisms in one file: YAML anchors with merge keys, which the loader resolves before GitLab sees the document, and `extends`, which GitLab resolves afterwards with a deep merge. Hidden .job keys carry both.
Dynamic child pipelines and a cross-project downstream trigger: one job generates a pipeline file as an artifact and a trigger job includes it, while a second trigger job starts a downstream project's pipeline with strategy: depend.
An intentionally invalid GitLab CI config: valid YAML with a misspelled `stagess` key, a job naming an undeclared stage, a job with no script, and an `only:` given a bare scalar. For testing that a linter rejects it and names each fault.
A deprecated-syntax GitLab CI file using `only`/`except` in both the array and keyed forms, plus the long-retired `type:` keyword. For scoring a migrator that must rewrite all of it to `rules` and `stage`.
Five include entries across the four include kinds: local path, local glob, another project at a pinned ref, a remote URL, and a bundled template. For testing include resolvers and dependency graphing without any file actually being fetched.
Both GitLab parallelisation forms in one file: a plain `parallel: 4` shard split and a `parallel: matrix` block whose two entries expand to seven combinations. Eleven jobs in total, documented so an expander can be checked exactly.
Rule-driven GitLab CI: a workflow block with four ordered conditions ending in `when: never`, plus job rules combining changes patterns, regex tag matching, a null-branch comparison, and a manual allow-failure fallback.
A three-stage GitLab CI pipeline with a default block, global variables, artifact expiry, a needs-based DAG, and a coverage-extraction regex. The baseline the other GitLab fixtures vary from.
An intentionally invalid HCL2 document: an unclosed block, a colon assignment, a half-quoted block label, and a heredoc whose terminator is misspelled so it swallows the remainder of the file. Four documented faults, each a distinct recovery test.
A generic HCL2 image-build definition exercising the grammar rather than any vendor schema: labelled blocks, a list variable, locals, an indent-stripping heredoc with an interpolation inside it, and a for expression producing a list.
A deeply nested HCL2 job definition (job, group, task, service, check) with duration strings, a port mapping, and restart and update policies. Four levels of block nesting, which is where hand-rolled HCL readers usually break.
A generic HCL2 policy document with three severity-graded rules, condition blocks using all_of / none_of / one_of, and a dated exemption. Grants nothing to anything; it exists so policy tooling has a realistic document to read.
A Helm v2 Chart.yaml with two conditional subchart dependencies, semver range constraints, a kubeVersion constraint, maintainers and annotations. Every repository and URL is example.invalid, so nothing resolves anywhere real.
The defaults half of a Helm values pair: nested maps, an empty map and an empty list, a list of env entries, and quoted booleans that must survive as strings. Pairs with the production overrides fixture for deep-merge testing.
The overrides half of a Helm values pair, built to exercise all three merge behaviours at once: maps merge key by key, the env list replaces the defaults wholesale, and an explicit null deletes the inherited podAnnotations map.
The values.schema.json that validates the paired Helm values files: a 2020-12 JSON Schema with $defs, $ref, enums, quantity patterns, and additionalProperties: false on nested objects. Validates the defaults and rejects a values file with an unknown image key.
A declarative Jenkins matrix over two axes with a nested excludes block: six platform/arch combinations minus the windows arm64 pair leaves five cells, documented in the specs so an expansion can be scored exactly.
A Jenkinsfile importing a pinned shared library and calling three custom steps that no static parser can resolve locally. For testing how tooling reports unknown steps and whether it records the library dependency and its version pin.
A declarative Jenkinsfile with a docker agent, options, environment and parameters blocks, a parallel test stage gated by a when expression, and post conditions. The dialect most Jenkins linters target.
An intentionally invalid Jenkinsfile: an unclosed stage block so braces never balance, a steps block outside any stage, and a bare identifier where the agent directive needs any, none, or a block. For testing parser error recovery and reporting.
The scripted Jenkinsfile dialect: an imperative node block with Groovy variables, a for loop that builds a parallel branch map at runtime, and try/catch error collection. Structurally unlike the declarative form, and a common parser gap.
A CronJob with an explicit timeZone, Forbid concurrency, a starting deadline, and history limits on both success and failure. For testing cron parsing and the scheduling fields policy engines most often check.
A CustomResourceDefinition carrying a deep structural OpenAPI v3 schema with a regex pattern, an enum, a default, and array minItems. Useful both as a CRD fixture and as a nested JSON-Schema-in-YAML validation target.
An autoscaling/v2 HPA with both a Resource and a Pods metric, plus scaleUp and scaleDown behaviour policies. The v2 metric shape differs sharply from v1 and v2beta, which is what makes it a useful conversion fixture.
A Kustomize overlay with a name prefix and suffix, common labels, an image tag override, a configMapGenerator merge, and a JSON-6902 patch embedded as a block scalar: YAML inside YAML, which naive rewriters mangle.
An intentionally invalid Kubernetes manifest: a removed apiVersion, a quoted string where replicas needs an integer, a selector that does not match the pod template, and containers as a mapping instead of a list. Four documented faults for a validator to report.
Three Kubernetes objects in one YAML stream, the shape kubectl apply consumes. A loader that calls the single-document API returns only the first object and silently drops the other two, which is exactly the failure this fixture is for.
A three-document governance bundle. Its real edge case is quantity handling: values like "8", 16Gi and 250m are Kubernetes quantity strings, and a parser that coerces the quoted ones to numbers or normalises the suffixed ones changes their meaning.
A NetworkPolicy with both policy types: an ingress rule combining namespace and pod selectors, and two egress rules, one of which uses an ipBlock with an except range. For testing policy engines that reason about allowed traffic.
A StatefulSet with volumeClaimTemplates, an ordered pod-management policy, a partitioned rolling update, and a non-root pod security context. For testing manifest linters and admission policies that reason about storage and identity.
An intentionally invalid Terraform configuration: an unclosed resource block, a colon where HCL needs an equals sign, a reference to an undeclared resource, and a resource block missing its second label. Four documented faults for a parser to report.
A terraform.tfvars assigning the staging defaults, including a nested map-of-objects value. Pairs with the production overrides file, which replaces that map wholesale rather than merging into it.
The expression-heavy half of the stack: for expressions producing both a map and a filtered list, conditional expressions selecting whole objects, and a dynamic block that generates two firewall rules from a local list.
Three module calls covering the shapes a dependency grapher has to handle: a local path with explicit provider passing, a versioned registry source under for_each, and a count-gated conditional module.
Five Terraform outputs exercising a splat expression over a counted resource, a for expression over a for_each module, and a sensitive output that must stay redacted when propagated from a sensitive input.
A Terraform plan JSON document with create, update and delete changes, after_unknown markers, sensitivity annotations, and a configuration section. This is the artifact policy engines read before anything runs, which is why it sits with pipeline definitions rather than with run reports.
The production tfvars overrides. Its point is a semantic that surprises people: a complex-typed variable is replaced whole, not deep-merged, so the staging app-b subnet does not survive the override.
The terraform settings block: a version constraint range, two pinned providers, a local backend, default tags, and a second aliased provider configuration. The fictional examplecloud provider means nothing resolves to a real service.
The resource graph: a network, a for_each subnet set, a counted instance resource, a data source, and a bucket on an aliased provider. Both repetition meta-arguments appear, plus lifecycle and an explicit depends_on edge.
Seven Terraform variables covering string, number, map and a map(object) with an optional attribute and a default, plus two validation blocks with error messages. The sensitive variable's default is explicitly a SAMPLE note, not a credential.
Anchors and aliases across mapping, sequence and scalar nodes, including an anchor nested inside another anchored node. The point most tooling misses: an alias is a reference to the same node, so a shallow-loading parser can share mutable state between jobs.
Every block-scalar variation in one file: literal and folded styles, all three chomping indicators, an explicit indentation indicator, a folded block with a paragraph break, and an embedded shell-shaped script whose own indentation must survive.
Nested anchor reuse kept deliberately small: two anchors, six references, thirty-one expanded nodes. It is here to test alias resolution and expansion accounting on a safe input, and is explicitly not a billion-laughs expansion bomb.
A two-document stream where each document declares its own %YAML directive and the second adds a %TAG handle used by a local tag. Comments appear in every position they are legal, and every one of them is lost by a non-round-tripping loader.
Duplicate keys at three nesting levels, including a duplicated top-level sequence. The spec forbids them; most loaders keep the last silently, a few keep the first, and strict linters reject the document. The file publishes the last-wins answer.
Explicit tags across the standard set (!!str, !!float, !!int, !!bool, !!null, !!binary, !!timestamp, !!omap, !!set) alongside two application-local ! tags. CI dialects use local tags in the wild, so a pipeline parser has to decide whether to reject, ignore, or resolve them.
Flow (JSON-like) and block collections expressing the same structures, nested inside one another in both directions, plus a flow mapping wrapped across lines and a line of strict JSON, which is valid YAML, and a useful check on a parser's JSON-subset claim.
Twenty-two unquoted values whose type depends entirely on the resolver. The worst is the leading zero: 0755 is 493 under YAML 1.1 and 755 under YAML 1.2, so both resolvers return a number and they return different ones. Also covers base-60 times, a version that loses its trailing zero, an integer past IEEE-754 precision, dates, and .inf / .nan.
The indentation styles that all parse identically and that formatters fight over: sequences flush with their key versus indented under it, two-space against four-space maps, and deliberately irregular but legal nesting. For testing formatters and idempotency.
Merge keys with their full precedence rules: local keys beat merged ones, and in a merge sequence the earlier alias wins. The file publishes the expected merged values, and a strict YAML 1.2 loader produces none of them because 1.2 dropped << from the core schema.
A five-document stream with explicit end markers, a comment-only document that loads as null, and a bare sequence as a whole document. The single-document API returns only the first, which is how multi-object manifests silently lose objects.
Non-ASCII keys and values across Latin, Cyrillic, Arabic, CJK and emoji, plus a key containing a zero-width space and a value distinguishing a combining acute from the precomposed character. Written as UTF-8 with no BOM.
The Norway problem in full: eleven bare words that a YAML 1.1 resolver turns into booleans, a matching quoted control group that survives, and a country-code list where position two silently becomes false. The definitive fixture for resolver-version behaviour.
Five spellings of null against the things routinely confused with it: empty strings, empty collections, and a key written with no value at all. Includes a sequence containing a hole, an empty string and two nulls in a row.
All three scalar quoting styles side by side: plain scalars and what they cannot contain, single quotes where backslashes stay literal and '' means one quote, and double quotes as the only style that processes \t, \n and \uXXXX escapes.
An intentionally invalid YAML file whose flow sequence is opened and never closed, so the parser consumes the rest of the document and fails at end of stream. A good error message names the opening bracket, not the last line, which is what this fixture measures.
A YAML file beginning with a UTF-8 byte order mark, which the spec permits at the start of a stream. A parser that does not strip it reads the first key as \ufeffname, so the lookup misses and the document appears to be missing its name field.
A YAML file written with CRLF line endings, which the spec accepts as a line break. A parser that splits on \n alone leaves a stray carriage return at the end of every plain scalar, so "build" becomes "build\r" and equality checks quietly fail.
An intentionally invalid YAML file indented with real TAB characters, which the spec forbids for indentation. The final key shows the legal case (a tab inside a quoted scalar), so a parser can be checked for rejecting one without rejecting the other.
