Melange

Melange pipeline config

Type Configuration
File match melange.json *.melange.json melange.yaml *.melange.yaml melange.yml *.melange.yml
Schema URL https://catalog.lintel.tools/schemas/schemastore/melange/latest.json
Source https://raw.githubusercontent.com/chainguard-dev/melange/main/pkg/config/schema.json

Validate with Lintel

npx @lintel/lintel check
Type: Configuration

Definitions

AdditionalCertificateEntry object
name string
content string
BaseImageDescriptor object
image string
apkindex string
BuildOption object

BuildOption describes an optional deviation to a package build.

Vars Record<string, string> required
Environment object required

EnvironmentOption describes an optional deviation to an apko environment.

1 nested properties
Contents object required

ContentsOption describes an optional deviation to an apko environment's contents block.

1 nested properties
Packages object required

ListOption describes an optional deviation to a list, for example, a list of packages.

CPE object

CPE stores values used to produce a CPE to describe the package, suitable for matching against NVD records.

part string
vendor string
product string
edition string
language string
sw_edition string
target_sw string
target_hw string
other string
Capabilities object

Capabilities is the configuration for Linux capabilities for the runner.

add string[]

Linux process capabilities to add to the pipeline container.

drop string[]

Linux process capabilities to drop from the pipeline container.

Capability object

Capability stores paths and an associated map of capabilities and justification to include in a package.

path string
add Record<string, string>
reason string
Checks object
disabled string[]

Optional: disable these linters that are not enabled by default.

Configuration object

Configuration is the root melange configuration.

package object required
18 nested properties
name string required

The name of the package

version string required

The version of the package

epoch integer required

The monotone increasing epoch of the package

dependencies object required
5 nested properties
runtime string[]

Optional: List of runtime dependencies

provides string[]

Optional: List of packages provided

replaces string[]

Optional: List of replace objectives

provider-priority string

Optional: An integer string compared against other equal package provides used to determine priority of provides

replaces-priority string

Optional: An integer string compared against other equal package provides used to determine priority of file replacements

checks object required
1 nested properties
disabled string[]

Optional: disable these linters that are not enabled by default.

cpe object required

CPE stores values used to produce a CPE to describe the package, suitable for matching against NVD records.

9 nested properties
part string
vendor string
product string
edition string
language string
sw_edition string
target_sw string
target_hw string
other string
description string

A human-readable description of the package

annotations Record<string, string>

Annotations for this package

url string

The URL to the package's homepage

commit string

Optional: The git commit of the package build configuration

target-architecture string[]

List of target architectures for which this package should be build for

copyright Copyright[]

The list of copyrights for this package

options object
4 nested properties
no-provides boolean

Optional: Signify this package as a virtual package which does not provide any files, executables, libraries, etc... and is otherwise empty

no-depends boolean

Optional: Mark this package as a self contained package that does not depend on any other package

no-commands boolean

Optional: Mark this package as not providing any executables

no-versioned-shlib-deps boolean

Optional: Don't generate versioned depends for shared libraries

scriptlets object
7 nested properties
trigger object required
pre-install string

Optional: The script to run pre install. The script should contain the shebang interpreter.

post-install string

Optional: The script to run post install. The script should contain the shebang interpreter.

pre-deinstall string

Optional: The script to run before uninstalling. The script should contain the shebang interpreter.

post-deinstall string

Optional: The script to run after uninstalling. The script should contain the shebang interpreter.

pre-upgrade string

Optional: The script to run before upgrading. The script should contain the shebang interpreter.

post-upgrade string

Optional: The script to run after upgrading. The script should contain the shebang interpreter.

setcap Capability[]

Capabilities to set after the pipeline completes.

timeout integer

Optional: The amount of time to allow this build to take before timing out.

resources object
4 nested properties
cpu string
cpumodel string
memory string
disk string
test-resources object
4 nested properties
cpu string
cpumodel string
memory string
disk string
environment object required
15 nested properties
contents object
6 nested properties
build_repositories string[]
runtime_repositories string[]
repositories string[]
keyring string[]
packages string[]
baseimage object
entrypoint object
4 nested properties
type string
command string
shell-fragment string
services Record<string, string>
cmd string
stop-signal string
work-dir string
accounts object
3 nested properties
run-as string
users User[]
groups Group[]
archs string[]
environment Record<string, string>
paths PathMutation[]
vcs-url string
annotations Record<string, string>
include string
volumes string[]
layering object
2 nested properties
strategy string
budget integer
certificates object
2 nested properties
additional AdditionalCertificateEntry[]
providers string[]
capabilities object required

Capabilities is the configuration for Linux capabilities for the runner.

2 nested properties
add string[]

Linux process capabilities to add to the pipeline container.

drop string[]

Linux process capabilities to drop from the pipeline container.

update object required

Update provides information used to describe how to keep the package up to date

15 nested properties
enabled boolean required

Toggle if updates should occur

manual boolean

Indicates that this package should be manually updated, usually taking care over special version numbers

require-sequential boolean

Indicates that automated pull requests should be merged in order rather than superseding and closing previous unmerged PRs

shared boolean

Indicate that an update to this package requires an epoch bump of downstream dependencies, e.g. golang, java

version-separator string

Override the version separator if it is nonstandard

ignore-regex-patterns string[]

A slice of regex patterns to match an upstream version and ignore

release-monitor object

ReleaseMonitor indicates using the API for https://release-monitoring.org/

5 nested properties
identifier integer required

Required: ID number for release monitor

strip-prefix string

If the version in release monitor contains a prefix which should be ignored

strip-suffix string

If the version in release monitor contains a suffix which should be ignored

version-filter-contains string

Filter to apply when searching version on a Release Monitoring

version-filter-prefix string

Filter to apply when searching version Release Monitoring

github object

GitHubMonitor indicates using the GitHub API

7 nested properties
identifier string required

Org/repo for GitHub

strip-prefix string

If the version in GitHub contains a prefix which should be ignored

strip-suffix string

If the version in GitHub contains a suffix which should be ignored

tag-filter string

Filter to apply when searching tags on a GitHub repository

Deprecated: Use TagFilterPrefix instead

tag-filter-prefix string

Prefix filter to apply when searching tags on a GitHub repository

tag-filter-contains string

Filter to apply when searching tags on a GitHub repository

use-tag boolean

Override the default of using a GitHub release to identify related tag to fetch. Not all projects use GitHub releases but just use tags

git object

GitMonitor indicates using Git

4 nested properties
strip-prefix string

StripPrefix is the prefix to strip from the version

strip-suffix string

If the version in GitHub contains a suffix which should be ignored

tag-filter-prefix string

Prefix filter to apply when searching tags on a GitHub repository

tag-filter-contains string

Filter to apply when searching tags on a GitHub repository

oci object

OCIMonitor indicates using OCI image tags

5 nested properties
identifier string required

Required: OCI image reference (e.g. cgr.dev/chainguard/node)

strip-prefix string

If the version in the tag contains a prefix which should be ignored

strip-suffix string

If the version in the tag contains a suffix which should be ignored

tag-filter-prefix string

Prefix filter to apply when searching tags

tag-filter-contains string

Substring filter to apply when searching tags

version_data object

VersionDataMonitor indicates using chainguard version data

2 nested properties
version_format string required

Format string for composing the version, using ${{source_name.field}} placeholders

sources VersionDataSource[] required

The list of upstream sources to fetch version data from

version-transform VersionTransform[]

The configuration block for transforming the package.version into an APK version

exclude-reason string

ExcludeReason is required if enabled=false, to explain why updates are disabled.

schedule object

Schedule defines the schedule for the update check to run

2 nested properties
reason string

The reason scheduling is being used

period string
enable-prerelease-tags boolean

Optional: Disables filtering of common pre-release tags

pipeline Pipeline[]

Required: The list of pipelines that produce the package.

subpackages Subpackage[]

Optional: The list of subpackages that this package also produces.

data RangeData[]

Optional: An arbitrary list of data that can be used via templating in the pipeline

vars Record<string, string>

Optional: A map of arbitrary variables that can be used via templating in the pipeline

var-transforms VarTransforms[]

Optional: A list of transformations to create for the builtin template variables

options Record<string, object>

Optional: Deviations to the build

test object
2 nested properties
environment object required
15 nested properties
contents object
entrypoint object
cmd string
stop-signal string
work-dir string
accounts object
archs string[]
environment Record<string, string>
paths PathMutation[]
vcs-url string
annotations Record<string, string>
include string
volumes string[]
layering object
certificates object
pipeline Pipeline[] required

Required: The list of pipelines that test the produced package.

ContentsOption object

ContentsOption describes an optional deviation to an apko environment's contents block.

Packages object required

ListOption describes an optional deviation to a list, for example, a list of packages.

2 nested properties
Add string[] required
Remove string[] required
DataItems Record<string, string>
Dependencies object
runtime string[]

Optional: List of runtime dependencies

provides string[]

Optional: List of packages provided

replaces string[]

Optional: List of replace objectives

provider-priority string

Optional: An integer string compared against other equal package provides used to determine priority of provides

replaces-priority string

Optional: An integer string compared against other equal package provides used to determine priority of file replacements

EnvironmentOption object

EnvironmentOption describes an optional deviation to an apko environment.

Contents object required

ContentsOption describes an optional deviation to an apko environment's contents block.

1 nested properties
Packages object required

ListOption describes an optional deviation to a list, for example, a list of packages.

2 nested properties
Add string[] required
Remove string[] required
GitHubMonitor object

GitHubMonitor indicates using the GitHub API

identifier string required

Org/repo for GitHub

strip-prefix string

If the version in GitHub contains a prefix which should be ignored

strip-suffix string

If the version in GitHub contains a suffix which should be ignored

tag-filter string

Filter to apply when searching tags on a GitHub repository

Deprecated: Use TagFilterPrefix instead

tag-filter-prefix string

Prefix filter to apply when searching tags on a GitHub repository

tag-filter-contains string

Filter to apply when searching tags on a GitHub repository

use-tag boolean

Override the default of using a GitHub release to identify related tag to fetch. Not all projects use GitHub releases but just use tags

GitMonitor object

GitMonitor indicates using Git

strip-prefix string

StripPrefix is the prefix to strip from the version

strip-suffix string

If the version in GitHub contains a suffix which should be ignored

tag-filter-prefix string

Prefix filter to apply when searching tags on a GitHub repository

tag-filter-contains string

Filter to apply when searching tags on a GitHub repository

Group object
groupname string
gid integer
members string[]
ImageAccounts object
run-as string
users User[]
groups Group[]
ImageCertificates object
additional AdditionalCertificateEntry[]
providers string[]
ImageConfiguration object
contents object
6 nested properties
build_repositories string[]
runtime_repositories string[]
repositories string[]
keyring string[]
packages string[]
baseimage object
2 nested properties
image string
apkindex string
entrypoint object
4 nested properties
type string
command string
shell-fragment string
services Record<string, string>
cmd string
stop-signal string
work-dir string
accounts object
3 nested properties
run-as string
users User[]
groups Group[]
archs string[]
environment Record<string, string>
paths PathMutation[]
vcs-url string
annotations Record<string, string>
include string
volumes string[]
layering object
2 nested properties
strategy string
budget integer
certificates object
2 nested properties
additional AdditionalCertificateEntry[]
providers string[]
ImageContents object
build_repositories string[]
runtime_repositories string[]
repositories string[]
keyring string[]
packages string[]
baseimage object
2 nested properties
image string
apkindex string
ImageEntrypoint object
type string
command string
shell-fragment string
services Record<string, string>
Input object
description string

Optional: The human-readable description of the input

default string

Optional: The default value of the input. Required when the input is.

required boolean

Optional: A toggle denoting whether the input is required or not

Layering object
strategy string
budget integer
ListOption object

ListOption describes an optional deviation to a list, for example, a list of packages.

Add string[] required
Remove string[] required
Needs object
Packages string[] required

A list of packages needed by this pipeline

OCIMonitor object

OCIMonitor indicates using OCI image tags

identifier string required

Required: OCI image reference (e.g. cgr.dev/chainguard/node)

strip-prefix string

If the version in the tag contains a prefix which should be ignored

strip-suffix string

If the version in the tag contains a suffix which should be ignored

tag-filter-prefix string

Prefix filter to apply when searching tags

tag-filter-contains string

Substring filter to apply when searching tags

Package object
name string required

The name of the package

version string required

The version of the package

epoch integer required

The monotone increasing epoch of the package

dependencies object required
5 nested properties
runtime string[]

Optional: List of runtime dependencies

provides string[]

Optional: List of packages provided

replaces string[]

Optional: List of replace objectives

provider-priority string

Optional: An integer string compared against other equal package provides used to determine priority of provides

replaces-priority string

Optional: An integer string compared against other equal package provides used to determine priority of file replacements

checks object required
1 nested properties
disabled string[]

Optional: disable these linters that are not enabled by default.

cpe object required

CPE stores values used to produce a CPE to describe the package, suitable for matching against NVD records.

9 nested properties
part string
vendor string
product string
edition string
language string
sw_edition string
target_sw string
target_hw string
other string
description string

A human-readable description of the package

annotations Record<string, string>

Annotations for this package

url string

The URL to the package's homepage

commit string

Optional: The git commit of the package build configuration

target-architecture string[]

List of target architectures for which this package should be build for

copyright Copyright[]

The list of copyrights for this package

options object
4 nested properties
no-provides boolean

Optional: Signify this package as a virtual package which does not provide any files, executables, libraries, etc... and is otherwise empty

no-depends boolean

Optional: Mark this package as a self contained package that does not depend on any other package

no-commands boolean

Optional: Mark this package as not providing any executables

no-versioned-shlib-deps boolean

Optional: Don't generate versioned depends for shared libraries

scriptlets object
7 nested properties
trigger object required
2 nested properties
script string

Optional: The script to run

paths string[]

Optional: The list of paths to monitor to trigger the script

pre-install string

Optional: The script to run pre install. The script should contain the shebang interpreter.

post-install string

Optional: The script to run post install. The script should contain the shebang interpreter.

pre-deinstall string

Optional: The script to run before uninstalling. The script should contain the shebang interpreter.

post-deinstall string

Optional: The script to run after uninstalling. The script should contain the shebang interpreter.

pre-upgrade string

Optional: The script to run before upgrading. The script should contain the shebang interpreter.

post-upgrade string

Optional: The script to run after upgrading. The script should contain the shebang interpreter.

setcap Capability[]

Capabilities to set after the pipeline completes.

timeout integer

Optional: The amount of time to allow this build to take before timing out.

resources object
4 nested properties
cpu string
cpumodel string
memory string
disk string
test-resources object
4 nested properties
cpu string
cpumodel string
memory string
disk string
PackageOption object
no-provides boolean

Optional: Signify this package as a virtual package which does not provide any files, executables, libraries, etc... and is otherwise empty

no-depends boolean

Optional: Mark this package as a self contained package that does not depend on any other package

no-commands boolean

Optional: Mark this package as not providing any executables

no-versioned-shlib-deps boolean

Optional: Don't generate versioned depends for shared libraries

PathMutation object
path string
type string
uid integer
gid integer
permissions integer
source string
recursive boolean
Pipeline object
if string

Optional: A condition to evaluate before running the pipeline

name string

Optional: A user defined name for the pipeline

uses string

Optional: A named reusable pipeline to run

This can be either a pipeline builtin to melange, or a user defined named pipeline. For example, to use a builtin melange pipeline: uses: autoconf/make

with Record<string, string>

Optional: Arguments passed to the reusable pipelines defined in uses

runs string

Optional: The command to run using the builder's shell (/bin/sh)

pipeline Pipeline[]

Optional: The list of pipelines to run.

Each pipeline runs in its own context that is not shared between other pipelines. To share context between pipelines, nest a pipeline within an existing pipeline. This can be useful when you wish to share common configuration, such as an alternative working-directory.

inputs Record<string, object>

Optional: A map of inputs to the pipeline

needs object
1 nested properties
Packages string[] required

A list of packages needed by this pipeline

label string

Optional: Labels to apply to the pipeline

assertions object
1 nested properties
required-steps integer

The number (an int) of required steps that must complete successfully within the asserted pipeline.

working-directory string

Optional: The working directory of the pipeline

This defaults to the guests' build workspace (/home/build)

environment Record<string, string>

Optional: environment variables to override apko

PipelineAssertions object
required-steps integer

The number (an int) of required steps that must complete successfully within the asserted pipeline.

RangeData object
name string required
items Record<string, string> required
ReleaseMonitor object

ReleaseMonitor indicates using the API for https://release-monitoring.org/

identifier integer required

Required: ID number for release monitor

strip-prefix string

If the version in release monitor contains a prefix which should be ignored

strip-suffix string

If the version in release monitor contains a suffix which should be ignored

version-filter-contains string

Filter to apply when searching version on a Release Monitoring

version-filter-prefix string

Filter to apply when searching version Release Monitoring

Resources object
cpu string
cpumodel string
memory string
disk string
Schedule object

Schedule defines the schedule for the update check to run

reason string

The reason scheduling is being used

period string
Scriptlets object
trigger object required
2 nested properties
script string

Optional: The script to run

paths string[]

Optional: The list of paths to monitor to trigger the script

pre-install string

Optional: The script to run pre install. The script should contain the shebang interpreter.

post-install string

Optional: The script to run post install. The script should contain the shebang interpreter.

pre-deinstall string

Optional: The script to run before uninstalling. The script should contain the shebang interpreter.

post-deinstall string

Optional: The script to run after uninstalling. The script should contain the shebang interpreter.

pre-upgrade string

Optional: The script to run before upgrading. The script should contain the shebang interpreter.

post-upgrade string

Optional: The script to run after upgrading. The script should contain the shebang interpreter.

Subpackage object
name string required

Required: Name of the subpackage

dependencies object required
5 nested properties
runtime string[]

Optional: List of runtime dependencies

provides string[]

Optional: List of packages provided

replaces string[]

Optional: List of replace objectives

provider-priority string

Optional: An integer string compared against other equal package provides used to determine priority of provides

replaces-priority string

Optional: An integer string compared against other equal package provides used to determine priority of file replacements

checks object required
1 nested properties
disabled string[]

Optional: disable these linters that are not enabled by default.

if string

Optional: A conditional statement to evaluate for the subpackage

range string

Optional: The iterable used to generate multiple subpackages

pipeline Pipeline[]

Optional: The list of pipelines that produce subpackage.

options object
4 nested properties
no-provides boolean

Optional: Signify this package as a virtual package which does not provide any files, executables, libraries, etc... and is otherwise empty

no-depends boolean

Optional: Mark this package as a self contained package that does not depend on any other package

no-commands boolean

Optional: Mark this package as not providing any executables

no-versioned-shlib-deps boolean

Optional: Don't generate versioned depends for shared libraries

scriptlets object
7 nested properties
trigger object required
2 nested properties
script string

Optional: The script to run

paths string[]

Optional: The list of paths to monitor to trigger the script

pre-install string

Optional: The script to run pre install. The script should contain the shebang interpreter.

post-install string

Optional: The script to run post install. The script should contain the shebang interpreter.

pre-deinstall string

Optional: The script to run before uninstalling. The script should contain the shebang interpreter.

post-deinstall string

Optional: The script to run after uninstalling. The script should contain the shebang interpreter.

pre-upgrade string

Optional: The script to run before upgrading. The script should contain the shebang interpreter.

post-upgrade string

Optional: The script to run after upgrading. The script should contain the shebang interpreter.

description string

Optional: The human readable description of the subpackage

url string

Optional: The URL to the package's homepage

commit string

Optional: The git commit of the subpackage build configuration

test object
2 nested properties
environment object required
15 nested properties
contents object
entrypoint object
cmd string
stop-signal string
work-dir string
accounts object
archs string[]
environment Record<string, string>
paths PathMutation[]
vcs-url string
annotations Record<string, string>
include string
volumes string[]
layering object
certificates object
pipeline Pipeline[] required

Required: The list of pipelines that test the produced package.

setcap Capability[]

Capabilities to set after the pipeline completes.

Test object
environment object required
15 nested properties
contents object
6 nested properties
build_repositories string[]
runtime_repositories string[]
repositories string[]
keyring string[]
packages string[]
baseimage object
entrypoint object
4 nested properties
type string
command string
shell-fragment string
services Record<string, string>
cmd string
stop-signal string
work-dir string
accounts object
3 nested properties
run-as string
users User[]
groups Group[]
archs string[]
environment Record<string, string>
paths PathMutation[]
vcs-url string
annotations Record<string, string>
include string
volumes string[]
layering object
2 nested properties
strategy string
budget integer
certificates object
2 nested properties
additional AdditionalCertificateEntry[]
providers string[]
pipeline Pipeline[] required

Required: The list of pipelines that test the produced package.

Trigger object
script string

Optional: The script to run

paths string[]

Optional: The list of paths to monitor to trigger the script

Update object

Update provides information used to describe how to keep the package up to date

enabled boolean required

Toggle if updates should occur

manual boolean

Indicates that this package should be manually updated, usually taking care over special version numbers

require-sequential boolean

Indicates that automated pull requests should be merged in order rather than superseding and closing previous unmerged PRs

shared boolean

Indicate that an update to this package requires an epoch bump of downstream dependencies, e.g. golang, java

version-separator string

Override the version separator if it is nonstandard

ignore-regex-patterns string[]

A slice of regex patterns to match an upstream version and ignore

release-monitor object

ReleaseMonitor indicates using the API for https://release-monitoring.org/

5 nested properties
identifier integer required

Required: ID number for release monitor

strip-prefix string

If the version in release monitor contains a prefix which should be ignored

strip-suffix string

If the version in release monitor contains a suffix which should be ignored

version-filter-contains string

Filter to apply when searching version on a Release Monitoring

version-filter-prefix string

Filter to apply when searching version Release Monitoring

github object

GitHubMonitor indicates using the GitHub API

7 nested properties
identifier string required

Org/repo for GitHub

strip-prefix string

If the version in GitHub contains a prefix which should be ignored

strip-suffix string

If the version in GitHub contains a suffix which should be ignored

tag-filter string

Filter to apply when searching tags on a GitHub repository

Deprecated: Use TagFilterPrefix instead

tag-filter-prefix string

Prefix filter to apply when searching tags on a GitHub repository

tag-filter-contains string

Filter to apply when searching tags on a GitHub repository

use-tag boolean

Override the default of using a GitHub release to identify related tag to fetch. Not all projects use GitHub releases but just use tags

git object

GitMonitor indicates using Git

4 nested properties
strip-prefix string

StripPrefix is the prefix to strip from the version

strip-suffix string

If the version in GitHub contains a suffix which should be ignored

tag-filter-prefix string

Prefix filter to apply when searching tags on a GitHub repository

tag-filter-contains string

Filter to apply when searching tags on a GitHub repository

oci object

OCIMonitor indicates using OCI image tags

5 nested properties
identifier string required

Required: OCI image reference (e.g. cgr.dev/chainguard/node)

strip-prefix string

If the version in the tag contains a prefix which should be ignored

strip-suffix string

If the version in the tag contains a suffix which should be ignored

tag-filter-prefix string

Prefix filter to apply when searching tags

tag-filter-contains string

Substring filter to apply when searching tags

version_data object

VersionDataMonitor indicates using chainguard version data

2 nested properties
version_format string required

Format string for composing the version, using ${{source_name.field}} placeholders

sources VersionDataSource[] required

The list of upstream sources to fetch version data from

version-transform VersionTransform[]

The configuration block for transforming the package.version into an APK version

exclude-reason string

ExcludeReason is required if enabled=false, to explain why updates are disabled.

schedule object

Schedule defines the schedule for the update check to run

2 nested properties
reason string

The reason scheduling is being used

period string
enable-prerelease-tags boolean

Optional: Disables filtering of common pre-release tags

User object
username string
uid integer
gid integer
shell string
homedir string
VarTransforms object
from string required

Required: The original template variable.

Example: ${{package.version}}

match string required

Required: The regular expression to match against the from variable

replace string required

Required: The repl to replace on all match matches

to string required

Required: The name of the new variable to create

Example: mangeled-package-version

VersionDataMonitor object

VersionDataMonitor indicates using chainguard version data

version_format string required

Format string for composing the version, using ${{source_name.field}} placeholders

sources VersionDataSource[] required

The list of upstream sources to fetch version data from

VersionDataSource object

VersionDataSource defines an individual upstream source for version data

name string required

The name of the source, used to reference it in the format string

stream string required

The stream to track for updates (e.g. "12.6", "9")

ignore string[]

A list of regex patterns to ignore when matching upstream versions

commit_source string

The source whose commits to use when multiple sources are configured

use_release boolean

Whether to use GitHub releases as the tag source instead of git tags

VersionTransform object

VersionTransform allows mapping the package version to an APK version

match string required

Required: The regular expression to match against the package.version variable

replace string required

Required: The repl to replace on all match matches