Pipelines — the deploy control plane
Snowtrol pipelines deploy both applications and infrastructure: application build/deploy from a connected Git repo, and infrastructure pipelines that drive a Terraform workspace's real plan → approve → apply lifecycle.
The Pipelines screen (/pipelines) is the deploy control plane for both applications and infrastructure. Every pipeline is persisted, org-scoped and audited; runs record per-stage logs you can expand inline. Reads are open to any member; creating, running, approving and deleting need deploy rights (mutate_infra).
Application pipelines
An application pipeline builds a connected application-type Git repository (see Git connections) and deploys it to an optional infrastructure Terraform workspace, through a source → build → deploy stage timeline with realistic logs. The runner is deterministic this round — the model (pipelines, runs, stages, RBAC, audit) is fully real; live build/deploy against running infrastructure is a later phase.
Infrastructure pipelines
An infrastructure pipeline has no app source — its run drives the REAL Terraform lifecycle of its target workspace through the same engine as the Terraform screen: plan (policy/cost gates; a policy failure ends the run at the plan stage, nothing is applied) → approve → apply (honoring the deployment's runner mode, real or recorded). Every Terraform workspace auto-creates its infrastructure pipeline (provision-<workspace>), and every apply attempt on the workspace — success or failure — is reflected 1:1 as a pipeline run, so the Pipelines page is a faithful provisioning history.
A run against a production-criticality workspace pauses awaiting approval after the plan: the plan author cannot approve their own work. A different operator approves it (on the Pipelines page or via POST /api/pipelines/{id}/runs/{runId}/approve) and the apply proceeds — separation of duties is never bypassed. A standard workspace self-approves and runs end-to-end.
API: `GET/POST /api/pipelines`, `POST /api/pipelines/{id}/run`, `POST …/runs/{runId}/approve`. On the roadmap: real application build/deploy, Kargo-style freight/promotion, canary gates over live monitoring, and SCM webhooks.