Loom CLI command reference
This reference lists executable help for core, account, project, setup and secrets commands. Check it against the executable when command usage or flags change.
$ loom --help
Run, validate and compile Loom and GitLab CI workflows locally
Usage:
loom [flags]
loom [command]
Available Commands:
artifacts Inspect declared job artifacts as JSON
auth Manage scoped CLI account authorization
check Validate a Loom or GitLab workflow and emit a receipt
compile Compile a Loom workflow or produce a GitLab plan report
completion Generate the autocompletion script for the specified shell
config Inspect layered runtime config
context Manage GitLab pipeline context files
help Help about any command
logs Read recorded workflow events or state
run Execute a Loom or GitLab workflow locally
runs List recorded workflow runs
secrets Manage Loom secrets providers
version Print the version
web Connect a repository to Loom Web
Flags:
-h, --help help for loom
Use "loom [command] --help" for more information about a command.
$ loom artifacts --help
Inspect declared job artifacts as JSON
Usage:
loom artifacts [command]
Available Commands:
list List validated archive members
read Read an original member prefix as text or base64
Flags:
-h, --help help for artifacts
Use "loom artifacts [command] --help" for more information about a command.
$ loom artifacts list --help
List validated archive members
Usage:
loom artifacts list RUN [flags]
Flags:
-h, --help help for list
--job string Exact canonical job ID (required)
--max-members int Maximum returned members (default 200, maximum 1000)
$ loom artifacts read --help
Read an original member prefix as text or base64
Usage:
loom artifacts read RUN MEMBER [flags]
Flags:
--encoding string Body encoding: text (valid UTF-8) or base64 (default "text")
-h, --help help for read
--job string Exact canonical job ID (required)
--max-bytes int Maximum original body bytes (default 65536, maximum 1048576)
$ loom auth --help
Manage scoped CLI account authorization
Usage:
loom auth [command]
Available Commands:
account Authorize this CLI with a Loom account
project Authorize this repository's Web project for ingestion
Flags:
-h, --help help for auth
Use "loom auth [command] --help" for more information about a command.
$ loom auth account --help
Authorize this CLI with a Loom account
Usage:
loom auth account [flags]
loom auth account [command]
Available Commands:
logout Revoke this device login and remove its local credential
status Show saved account grant metadata
Flags:
--flow string Authorization flow: browser or device (required)
-h, --help help for account
--scope stringArray Requested application scope (repeat for a subset)
--url string Trusted Loom server HTTPS origin
Use "loom auth account [command] --help" for more information about a command.
$ loom auth account status --help
Show saved account grant metadata
Usage:
loom auth account status [flags]
Flags:
--account string Stable account ID
-h, --help help for status
Global Flags:
--url string Trusted Loom server HTTPS origin
$ loom auth account logout --help
Revoke this device login and remove its local credential
Usage:
loom auth account logout [flags]
Flags:
--account string Stable account ID
-h, --help help for logout
Global Flags:
--url string Trusted Loom server HTTPS origin
$ loom auth project --help
Authorize this repository's Web project for ingestion
Usage:
loom auth project [flags]
loom auth project [command]
Available Commands:
logout Remove this repository's selected project authorization locally
status Show selected project credential metadata
Flags:
--flow string Authorization flow: browser or device (required)
-h, --help help for project
Use "loom auth project [command] --help" for more information about a command.
$ loom auth project status --help
Show selected project credential metadata
Usage:
loom auth project status [flags]
Flags:
-h, --help help for status
$ loom auth project logout --help
Remove this repository's selected project authorization locally
Usage:
loom auth project logout [flags]
Flags:
-h, --help help for logout
$ loom web --help
Connect a repository to Loom Web
Usage:
loom web [command]
Available Commands:
setup Configure a Web destination
upload Deliver saved finalized-run evidence
Flags:
-h, --help help for web
Use "loom web [command] --help" for more information about a command.
$ loom web upload --help
Deliver saved finalized-run evidence
Usage:
loom web upload [command]
Available Commands:
retry Retry exactly one immutable saved upload
Flags:
-h, --help help for upload
Use "loom web upload [command] --help" for more information about a command.
$ loom web upload retry --help
Retry exactly one immutable saved upload
Usage:
loom web upload retry [flags]
Flags:
-h, --help help for retry
--run-id string Required producer run ID (loom-run-local-N)
--upload-id string Required saved client upload UUID
--upload-retry-interval string Web delivery retry interval (default 10s; whole-second s/m/h, 1s..1h)
--upload-timeout string Total Web delivery budget (default 120s; whole-second s/m/h, 1s..1h)
$ loom web setup --help
Configure a Web destination
Usage:
loom web setup [command]
Available Commands:
project Select or create a Web project for this repository
Flags:
-h, --help help for setup
Use "loom web setup [command] --help" for more information about a command.
$ loom web setup project --help
Connect a repository to a Web project. --local-connect uses an exact stored project credential and cannot verify server authorization. Interactive upload consent defaults to no; scripts must pass --upload=true or --upload=false.
Usage:
loom web setup project [flags]
Flags:
--account string Explicit account ID
--create-name string Create a project with this name
--create-slug string Create a project with this owner-unique slug
--credential-kind string Select project-only or account-derived stored credential when both exist
-h, --help help for project
--local-connect Use an exact matching stored project credential without a management request
--project-id string Existing project UUID
--upload Enable upload of future finalized evidence (default: false)
--url string Canonical HTTPS Web origin
$ loom check --help
Validate a Loom or GitLab workflow and emit a receipt
Usage:
loom check [flags]
Flags:
--context string Project-relative variable context JSON path for the selected format
--format string Workflow source format: loom or gitlab (inferred from content when omitted)
-h, --help help for check
--inputs string Project-relative configuration inputs JSON object path (explicit only)
--instance stringArray Select an exact final instance and its prerequisites (repeatable)
--job stringArray Select a source job or exact final ID and its prerequisites (repeatable)
--workflow string Project-relative workflow path
$ loom compile --help
Compile a Loom workflow or produce a GitLab plan report
Usage:
loom compile [flags]
Flags:
--context string Project-relative variable context JSON path for the selected format
--format string Workflow source format: loom or gitlab (inferred from content when omitted)
-h, --help help for compile
--inputs string Project-relative configuration inputs JSON object path (explicit only)
--instance stringArray Select an exact final instance and its prerequisites (repeatable)
--job stringArray Select a source job or exact final ID and its prerequisites (repeatable)
--workflow string Project-relative workflow path
$ loom config --help
Inspect layered runtime config
Usage:
loom config [command]
Available Commands:
init Create a starter runtime config file
show Print the effective layered runtime config
Flags:
-h, --help help for config
Use "loom config [command] --help" for more information about a command.
$ loom config init --help
Create a starter runtime config file
Usage:
loom config init [flags]
Flags:
-h, --help help for init
--user Create ~/.config/loom/config.yml instead of the repo-scoped .loom/config.yml
$ loom config show --help
Print the effective layered runtime config
Usage:
loom config show [flags]
Flags:
-h, --help help for show
$ loom context --help
Manage GitLab pipeline context files
Usage:
loom context [command]
Available Commands:
init Write .loom/contexts/<name>.json from the current git branch
Flags:
-h, --help help for context
Use "loom context [command] --help" for more information about a command.
$ loom context init --help
Write .loom/contexts/<name>.json from the current git branch
Usage:
loom context init [flags]
Flags:
--as string Pipeline kind to mimic: push or mr
--force Replace an existing context file
-h, --help help for init
--name string Context name for .loom/contexts/<name>.json (default: the --as value)
$ loom runs --help
List recorded workflow runs
Usage:
loom runs [flags]
Flags:
-h, --help help for runs
--json Print one run summary per JSON line
$ loom logs --help
Read recorded workflow events or state
Usage:
loom logs <run-id> [flags]
Flags:
--command string Select an exact command ID
-h, --help help for logs
--job string Select an exact job ID
--json Print records as JSON
--level string Select an exact event log level
--state Show state records instead of event messages
--step string Select an exact step ID
--stream string Select an exact event stream, such as stderr
--tail int Show only the last N records
$ loom run --help
Execute a Loom or GitLab workflow locally
Usage:
loom run [flags]
Flags:
--cache-diff Run twice with pinned inputs (cache=off, then cache=on) and quarantine cache-hit keys on mechanical divergence
--context string Project-relative variable context JSON path for the selected format
--docker-workspace-mount string Docker workspace mount mode override: bind_mount or ephemeral_volume
--format string Workflow source format: loom or gitlab (inferred from content when omitted)
-h, --help help for run
--inputs string Project-relative configuration inputs JSON object path (explicit only)
--instance stringArray Select an exact final instance and its prerequisites (repeatable)
--job stringArray Select a source job or exact final ID and its prerequisites (repeatable)
--parallel int Maximum number of jobs to run concurrently (must be positive)
--privileged-service stringArray Allow one GitLab privileged service alias (repeatable)
-q, --quiet Print only minimal local execution output
--stream Stream job stdout/stderr while local execution is running
--upload-retry-interval string Web delivery retry interval (default 10s; whole-second s/m/h, 1s..1h)
--upload-timeout string Total Web delivery budget (default 120s; whole-second s/m/h, 1s..1h)
-v, --verbose Print additional metadata for local execution
--workflow string Project-relative workflow path
$ loom version --help
Print the version
Usage:
loom version [flags]
Flags:
-h, --help help for version
$ loom secrets --help
Manage Loom secrets providers
Usage:
loom secrets [command]
Available Commands:
keepass Manage KeePass-backed vaults and items
op Manage 1Password-backed vault metadata and items
Flags:
-h, --help help for secrets
Use "loom secrets [command] --help" for more information about a command.
$ loom secrets keepass --help
Manage KeePass vault and item metadata via create/update/list operations. Secret-value read/show commands are intentionally not available.
Usage:
loom secrets keepass [command]
Available Commands:
item Manage KeePass item metadata
vault Manage KeePass vault definitions
Flags:
-h, --help help for keepass
Use "loom secrets keepass [command] --help" for more information about a command.
$ loom secrets keepass vault --help
Manage KeePass vault definitions
Usage:
loom secrets keepass vault [command]
Available Commands:
create Create a KeePass vault definition
list List KeePass vaults without exposing secret values
update Update KeePass vault credentials for an existing mapped vault
Flags:
-h, --help help for vault
Use "loom secrets keepass vault [command] --help" for more information about a command.
$ loom secrets keepass vault create --help
Create a local KeePass `.kdbx` vault file. Credentials are provided via `--password-from-env` and/or `--keyfile-from-env`. This command never prints credential values.
Usage:
loom secrets keepass vault create [flags]
Flags:
--database-path .kdbx Path to write the KeePass .kdbx file (default: .loom/keepass/<alias>.kdbx)
--force Overwrite existing vault file if it already exists
-h, --help help for create
--keyfile-from-env string Environment variable name containing the KeePass keyfile path
--password-from-env string Environment variable name containing the KeePass master password
--vault-path string Vault path override (defaults to Git origin path in slash format, e.g. group/project/repo)
$ loom secrets keepass vault update --help
Rotate credentials on an existing KeePass vault file using the runtime mapping for `--vault-path`.
Current credentials are loaded from `LOOM_KEEPASS_DB_<ALIAS>_*` env mapping; new credentials come from `--password-from-env` and/or `--keyfile-from-env`.
This command only updates vault credentials and does not print secret values.
Usage:
loom secrets keepass vault update [flags]
Flags:
-h, --help help for update
--keyfile-from-env string Environment variable name containing the new KeePass keyfile path
--password-from-env string Environment variable name containing the new KeePass master password
--vault-path string Vault path override (defaults to Git origin path in slash format, e.g. group/project/repo)
$ loom secrets keepass vault list --help
List KeePass vaults without exposing secret values
Usage:
loom secrets keepass vault list [flags]
Flags:
-h, --help help for list
--vault-path string Vault path override (defaults to Git origin path in slash format, e.g. group/project/repo)
$ loom secrets keepass item --help
Manage KeePass item metadata
Usage:
loom secrets keepass item [command]
Available Commands:
create Create a KeePass item field from an environment variable
list List KeePass items without exposing secret values
update Update a KeePass item field from an environment variable
Flags:
-h, --help help for item
Use "loom secrets keepass item [command] --help" for more information about a command.
$ loom secrets keepass item create --help
Create a KeePass item field from an environment variable
Usage:
loom secrets keepass item create [flags]
Flags:
--field string Item field name to set (for example username or password)
-h, --help help for create
--item-path string Vault item path to create/update
--value-from-env string Name of environment variable that supplies the field value
--vault-path string Vault path override (defaults to Git origin path in slash format, e.g. group/project/repo)
$ loom secrets keepass item update --help
Update a KeePass item field from an environment variable
Usage:
loom secrets keepass item update [flags]
Flags:
--field string Item field name to set (for example username or password)
-h, --help help for update
--item-path string Vault item path to create/update
--value-from-env string Name of environment variable that supplies the field value
--vault-path string Vault path override (defaults to Git origin path in slash format, e.g. group/project/repo)
$ loom secrets keepass item list --help
List KeePass items without exposing secret values
Usage:
loom secrets keepass item list [flags]
Flags:
-h, --help help for list
--item-prefix string Optional item path prefix filter
--vault-path string Vault path override (defaults to Git origin path in slash format, e.g. group/project/repo)
$ loom secrets op --help
Manage 1Password vault and item metadata via list/create/update operations.
These commands require OP_SERVICE_ACCOUNT_TOKEN and intentionally never print secret values.
Usage:
loom secrets op [command]
Available Commands:
item Manage 1Password item metadata
vault List 1Password vaults
Flags:
-h, --help help for op
Use "loom secrets op [command] --help" for more information about a command.
$ loom secrets op vault --help
List 1Password vaults
Usage:
loom secrets op vault [command]
Available Commands:
list List 1Password vaults without exposing secret values
Flags:
-h, --help help for vault
Use "loom secrets op vault [command] --help" for more information about a command.
$ loom secrets op vault list --help
List 1Password vaults without exposing secret values
Usage:
loom secrets op vault list [flags]
Flags:
-h, --help help for list
$ loom secrets op item --help
Manage 1Password item metadata
Usage:
loom secrets op item [command]
Available Commands:
create Create a 1Password item field from an environment variable
list List 1Password items without exposing secret values
update Update a 1Password item field from an environment variable
Flags:
-h, --help help for item
Use "loom secrets op item [command] --help" for more information about a command.
$ loom secrets op item create --help
Create a 1Password item field from an environment variable
Usage:
loom secrets op item create [flags]
Flags:
--field string Item field name to set (for example username or password)
-h, --help help for create
--item-path string Item path/title to create or update
--value-from-env string Name of environment variable that supplies the field value
--vault string 1Password vault name or UUID
$ loom secrets op item update --help
Update a 1Password item field from an environment variable
Usage:
loom secrets op item update [flags]
Flags:
--field string Item field name to set (for example username or password)
-h, --help help for update
--item-path string Item path/title to create or update
--value-from-env string Name of environment variable that supplies the field value
--vault string 1Password vault name or UUID
$ loom secrets op item list --help
List 1Password items without exposing secret values
Usage:
loom secrets op item list [flags]
Flags:
-h, --help help for list
--item-prefix string Optional item path prefix filter
--vault string 1Password vault name or UUID