Workflow commands

Steps communicate with the runner through files and special lines on standard output. The conventions match GitHub Actions where possible so existing scripts port cleanly.

Files

Variable	Purpose
$SLIPWAY_OUTPUT	Append key=value lines to set step outputs (steps.<id>.outputs.<key>)
$SLIPWAY_ENV	Append KEY=value lines to set environment variables for later steps
$SLIPWAY_PATH	Append directories (one per line) to prepend to PATH for later steps

echo "version=1.4.0" >> "$SLIPWAY_OUTPUT"
echo "API_URL=https://staging.example.com" >> "$SLIPWAY_ENV"
echo "$HOME/.local/bin" >> "$SLIPWAY_PATH"

Multi-line values use a heredoc delimiter:

{
  echo "notes<<EOF"
  git log --oneline -5
  echo "EOF"
} >> "$SLIPWAY_OUTPUT"

Commands on stdout

Command	Effect
::mask::value	Mask value in all subsequent log output
::group::name / ::endgroup::	Collapsible log section
::error file=x,line=1::msg	Error annotation (also warning and notice)

echo "::group::Install"
npm ci
echo "::endgroup::"
echo "::warning file=package.json,line=12::deprecated dependency"

Annotations appear on the run page and, where the SCM supports it, on the pull request.

Masking

Secrets referenced through ${{ secrets.NAME }} are masked automatically. Values you generate at run time (a token returned by an API) can be masked with ::mask::, and must be masked before they are printed.

Masking is a safety net, not a boundary. Do not print secrets on purpose. See Security model.

Identity token

When permissions.id_token is write, the runner sets $SLIPWAY_ID_TOKEN to a 15-minute OIDC JWT. See OIDC job tokens.