Contexts

Context	Contents
git	ref, branch, tag, sha, short_sha, message, author, repo, default_branch, before, changed_files (list)
event	Trigger name and payload: event.name, event.pull_request.{number,title,draft,labels,base,head,author}, event.schedule.cron, event.payload (webhook)
inputs	Typed manual and API inputs
env	Merged environment at the current scope
secrets	Project and org secrets. Only in env, with and services.env; never logged
vars	Non-secret project and org variables, templates expanded. In an environment-bound job, narrowed to the job’s service and environment (the same set as environment.vars)
pipeline	name, id, project, org
steps	steps.<id>.outputs.<k>, steps.<id>.outcome
needs	needs.<job>.result (success, failure, skipped, cancelled), needs.<job>.outputs.<k>
matrix	The current matrix combination
environment	In deploy jobs: name, url, vars.<k>, infrastructure
release	In release-triggered runs: version, channel, artifacts
runner	os, arch, labels, temp, workspace

Scope matrix

Where a context exists depends on where the expression is written. The validator knows this table.

Expression location	Available contexts
Pipeline env, concurrency, defaults	git, event, inputs, vars, pipeline, secrets (in env only)
Stage and job if	the above plus needs, matrix, release
Job env, container, services	the above plus environment, runner
Step if, env, with	everything in the job scope plus steps
Job outputs	everything including steps

Details worth knowing

git.changed_files

A list of paths changed by the triggering push or pull request. Use it to skip work:

if: git.changed_files.exists(f, f.startsWith("services/api/"))

event

Fields exist only for the trigger kind that produced the run. event.pull_request is empty for a push. Check event.name first when a pipeline has several triggers:

if: event.name == "pull_request" && !event.pull_request.draft

needs

if: needs.test.result == "success" && needs.scan.outputs.critical == "0"

Outputs are always strings.

steps

steps.<id>.outcome is the step’s result and steps.<id>.outputs.<k> its outputs (always strings).

environment

In a deploy job, environment.vars.REPLICAS reads a variable scoped to the environment, and environment.infrastructure describes the target.

secrets

Available only in env, with and services.env. The value is masked in logs automatically. See Secrets.