Integrations

Slipway is a platform of typed providers. SCM, cloud, registry, notification, incident, issue, metric and secret providers are added as plugins that share one manifest, one config schema, one health check and one credential model, not as special cases.

Install integrations from Settings, Integrations in the app, or with IntegrationService.Install. Every integration has a health status and a Test action. Credentials are stored as encrypted secrets and never appear in logs.

Each provider page follows the same template: at a glance, what it does, set up, configuration, notes. Pages marked as stubs list the essentials and will be expanded.

Source control

Slipway never hosts your code. It connects to your SCM to discover pipelines, receive webhooks, post commit statuses and PR comments, and record deployments.

• GitHub: Connect GitHub.com organisations and repositories through a GitHub App.
• GitHub Enterprise: Connect GitHub Enterprise Server with a GitHub App registered on your instance.
• GitLab: Connect GitLab SaaS or self-managed. Merge requests map to the same pull request trigger.
• Bitbucket Cloud: Connect Bitbucket Cloud workspaces.
• Bitbucket Data Center: Connect self-managed Bitbucket Data Center.
• Azure Repos: Connect Azure DevOps Git repositories.
• Gitea and Forgejo: Connect Gitea or Forgejo instances.

Registries & artifact repositories

Registries and artifact repositories are the sources of release artifacts. Slipway lists repositories and tags to build releases and verifies digests at deploy time.

• Docker Hub: Pull and push images on Docker Hub.
• GitHub Container Registry: Use GHCR images as release artifacts.
• Amazon ECR: Use ECR repositories with workload identity, no stored keys.
• Google Artifact Registry and GCR: Use Artifact Registry (and legacy GCR hostnames).
• Azure Container Registry: Use ACR repositories.
• Harbor: Use Harbor projects as release sources.
• Quay: Use Quay.io or self-hosted Quay.
• JFrog Artifactory (containers): Use Artifactory Docker repositories.
• Generic OCI registry: Any registry that speaks the OCI distribution API.
• JFrog Artifactory (artifacts): Generic, Maven, npm and PyPI repositories in Artifactory as release sources.
• Sonatype Nexus: Nexus 3 repositories as release sources.
• S3, GCS and Azure Blob buckets: Treat a bucket prefix as a release source (VM artefacts, static sites, Lambda zips).
• npm, PyPI and Maven feeds: Use package feeds as release sources.

Cloud & Kubernetes

Cloud and cluster integrations give deployers somewhere to deploy to. Credentials are obtained through workload identity federation wherever the platform supports it, not stored keys.

• AWS: Deploy to ECS, Lambda and EKS; read CloudWatch; federate with STS.
• Google Cloud: Deploy to GKE and Cloud Run; read Cloud Monitoring; federate through Workload Identity Federation.
• Microsoft Azure: Deploy to AKS, App Service and Container Apps; read Azure Monitor; use federated credentials.
• DigitalOcean: Deploy to DOKS and App Platform.
• Hetzner: Deploy to Hetzner Cloud servers and Kubernetes clusters you run there.
• Kubernetes: Deploy manifests, Helm releases and Kustomize overlays to any cluster.
• Helm: Install and upgrade Helm 3 releases as a deployment.
• Kustomize: Apply Kustomize overlays per environment.
• Argo CD: Sync an Argo CD application and read its health as part of a deployment.
• Flux: Notify Flux and read reconciliation status.

Infrastructure as code

IaC integrations run plan, approval and apply as part of a deployment so infrastructure changes get the same gates as application changes.

• Terraform and OpenTofu: Plan, approve and apply Terraform or OpenTofu roots as a deployment.
• Terraform Cloud: Trigger Terraform Cloud runs and wait for them.
• Pulumi: Run pulumi preview and pulumi up as a deployment.

Secret managers

External secret references let Slipway resolve a value at job start without ever storing it. The reference is stored encrypted; the value is fetched with the job’s identity and masked in logs.

• HashiCorp Vault: KV, transit and JWT auth. Jobs log in to Vault with their OIDC token.
• AWS Secrets Manager: Resolve aws-sm:// references.
• GCP Secret Manager: Resolve gcp-sm:// references.
• Azure Key Vault: Resolve azure-kv:// references and optionally use Key Vault keys as BYOK.
• 1Password Connect: Resolve op:// references through a Connect server.
• Doppler: Resolve secrets from Doppler configs.
• Infisical: Resolve secrets from Infisical environments.

Notifications

Notification integrations deliver Slipway events (run finished, deployment waiting for approval, canary verdict) to where your team already works.

• Slack: Notifications and interactive approvals in Slack channels.
• Microsoft Teams: Notifications and approvals in Teams channels.
• Discord: Notifications in Discord channels.
• Email (SMTP or Resend): Email notifications and invitations.
• Generic webhooks: Signed outbound webhooks for every Slipway event.

Incident management

Incident integrations record deploy markers and page the right people when a deployment fails or is rolled back.

• PagerDuty: Change events as deploy markers and incidents on failure.
• Opsgenie: Alerts on failed or rolled-back deployments.
• incident.io: Deploy markers and incident creation.

Issues & change management

Issue and change integrations link commits to tickets, generate release notes and gate production deployments on approved change requests.

• Jira: Issue links, release notes and change requests.
• Linear: Issue links and release notes.
• GitHub Issues: Issue links and release notes from GitHub Issues.
• ServiceNow Change Management: Require an approved change request before a production deployment.
• Azure Boards: Link work items and release notes.

Observability

Observability integrations send deploy markers and, for metric providers, feed canary verification with the signals that decide whether to continue or roll back.

• Prometheus: PromQL queries for canary verification and deploy annotations.
• Datadog: Metric queries for canary verification and deploy events.
• New Relic: NRQL queries for verification and deploy markers.
• Grafana, Loki and Tempo: Annotations and queries against Grafana-managed data sources.
• Honeycomb: Markers and SLO reads.
• Sentry: Create Sentry releases and associate commits.
• Amazon CloudWatch: Metric queries for verification.
• Google Cloud Monitoring: MQL and PromQL queries for verification.
• Azure Monitor: Metric queries for verification.
• OpenTelemetry export: Export Slipway’s own traces and metrics to your collector.

Security scanning

Scanners run as pipeline steps; Slipway ingests their reports, shows findings on the run and can gate promotion with a policy.

• Trivy: Image, filesystem and IaC scanning.
• Grype: Vulnerability scanning for images and SBOMs.
• Snyk: Dependency, container and IaC scans.
• Semgrep: Static analysis.
• SonarQube and SonarCloud: Quality gate results.
• Checkov: IaC policy scanning.
• gitleaks: Secret detection in source.
• Syft (SBOM): Generate SBOMs and attach them as attestations.
• Sigstore cosign: Sign images and verify signatures before deploy.

Feature flags

Flag integrations let a deployment flip a flag as a step, so a release can ship dark and be turned on by the same pipeline.

• LaunchDarkly: Flip flags on deploy.
• Unleash: Flip flags on deploy.
• Flagsmith: Flip flags on deploy.

Build your own

The provider framework is the same one the built-in providers use. A provider declares a manifest (id, category, display, config JSON schema, OAuth spec, capabilities) and implements the category interface. Generic outbound webhooks cover most one-off needs without writing a provider.