Skip to main content

orun baseline

orun baseline is the command-line face of the baseline registry: the catalogue of baselines, each a whole product's structure and standards packaged so the platform can rebuild it under your name and you can upgrade it later. Every subcommand runs against one workspace, resolved the same way as every other cloud command (see orun workspace).

orun baseline list [--public] [--json]
orun baseline show <id[@tag]> [--json]
orun baseline check <id[@tag]>
orun baseline new <id[@tag]> --local --out <dir> [build flags]
orun baseline new <id[@tag]> --via-platform [--repo owner/name | --repo-link repl_…]
orun baseline register <id> --name … --source-repo owner/name --tag … --expected-minutes N [flags]
orun baseline publish <id> <tag>

Every subcommand accepts --workspace <ws_…|slug> and --backend-url <url>.

list​

Lists the baselines this workspace's account may build: the public catalogue plus anything the account registered itself. --public reads the catalogue a signed-out reader sees; --json emits the rows as JSON.

$ orun baseline list
ID                 TAG           TIER  MINS  STACK                            SUMMARY
cirrus             baseline-v10  free  60    saas,cloudflare,d1,nextjs        Worker fleet behind one edge API, a Next.js console, D1 + KV data pla…
lumen              baseline-v29  free  75    saas,cloudflare,supabase,nextjs  Cloudflare + Supabase multi-tenant SaaS: worker fleet, edge API, cons…
multi-tenant-saas  baseline-v3   paid  75    saas,cloudflare,supabase,nextjs  Lumen's architecture on its own release line: the same Cloudflare + S…

show​

Shows one baseline and whether this workspace can build it: the source repository and tag, the time budget, and one row per required provider.

$ orun baseline show cirrus
cirrus —

source   sourceplane/cirrus@baseline-v10
budget   about 60 minutes

providers
  ✓ cloudflare

this workspace can build it

--json prints the registry row with its readiness block:

{
  "blueprint": {
    "id": "cirrus",
    "sourceRepo": "sourceplane/cirrus",
    "tag": "baseline-v10",
    "manifestPath": "blueprint.yaml",
    "expectedMinutes": 60,
    "readiness": {
      "integrationsReady": true,
      "integrations": [{ "provider": "cloudflare", "connected": true }]
    }
  }
}

Addressing id@tag for a tag the registry has moved past resolves to the published tag and says so on standard error.

check​

Readiness as an exit code, for a script or a CI gate. Exit 0 when every provider the baseline needs is connected; non-zero otherwise, naming the missing ones. Nothing is written and no build is started.

orun baseline check cirrus && orun baseline new cirrus --via-platform --repo acme/storefront

new​

Builds a registered baseline, named by id or by a bootstrap's --from bst_…. Exactly one of --local or --via-platform must be given; both or neither exits 2. Both paths refuse to start unless check would pass — except a --local build that --until stops, which skips the gate (see below).

--local​

Fetches sourceRepo at the registry's tag into a temporary checkout, reads the row's manifestPath to find the card, reads spec.bootstrap.blueprint out of it, and places that document's phases into --out through the same engine as orun new. Joining those facts by hand is work nobody should repeat.

FlagMeaning
--out <dir>Output directory for the product. Required.
--set key=valueA blueprint input. Repeatable; overrides --values per key.
--values <file>A YAML file of inputs.
--run-hooksRun each phase's declared hooks after its files are placed. Without it the command places files and stops; with it, it bootstraps a product: repositories, installs, secrets, Terraform, pull requests, deploys.
--resumePlace every phase not already derived as done. With --phase or --until, only within that window.
--phase <name>Place only this phase.
--until <name>Place every phase through this one. Skips the readiness gate (below).
--progress auto|plain|verbose|jsonProgress rendering. json emits one event per line.
--keep-checkoutKeep the temporary checkout and print its path, for debugging.
orun baseline new cirrus --local --out ./acme-cloud \
  --set productname="Acme Cloud" --set productdomain=acme.dev \
  --set githuborg=acme --set subdomain=acme

A hook-running local build needs git, gh, Node.js 20+, pnpm, and python3, an admin session or ORUN_TOKEN for the workspace, and the providers the baseline requires connected to it.

A build that stops: --until​

From v2.90.0, a --local build with --until <phase> does not apply the readiness gate. This is how Orunbase builds a code-only app for an account with no Cloudflare connection: the scaffold stage (place, brand, create the repository, land) needs GitHub only, and GitHub is proven by the repository, not by a connection. The registry reports the readiness of a full build and carries no stages, so it cannot say which providers the phases up to <phase> use. On the platform, the bootstrap door has already checked readiness for the phases that will run. Run by hand, --until is your choice of where to stop, and each phase still checks the providers it needs when it starts (requires.probe). The command prints which providers are missing:

note: cloudflare is not connected; building through 01-scaffold without the readiness gate — a phase that needs it says so when it starts

Without --until, including with --phase, the gate is unchanged. A build that stops ends like any other: the run-level done event, exit 0. Inputs the build document declares lateBound keep their placeholder only in a run that stops before the last phase (see late-bound inputs).

--from bst_…​

Continues a bootstrap the console's Review step resolved. The record carries the baseline at its tag, the repository, the inputs and the connections, so nothing is typed twice: the id fills what the flags would, an explicit flag still wins, and --set adds. Works with either shape; the command the Review page prints is the local one:

orun baseline new --from bst_7K2M9QAZ --workspace ws_537EHJPC \
  --local --out ./test-123 --run-hooks
continuing bootstrap bst_7K2M9QAZ: cirrus@baseline-v9 for acme/test-123
fetching sourceplane/cirrus@baseline-v9
building repo-blueprint.yaml

The workspace is named because the bootstrap is read under it and an empty directory has nothing else to name it from. Before anything is fetched the platform is told which door took the bootstrap — --by cli (the default), or --by agent when a coding agent runs the command from the Review page's prompt — so the workspace's Overview reads continued from the orun CLI or continued in a coding agent; a bootstrap another door already took keeps that door's word, and the command says so. One build per repository holds from any door: when a cloud session or another runner already holds the repository, the command stops before anything is fetched and names who holds it and since when. The run reports its phase landings to the platform under the bootstrap id, so the record carries the build whichever door ran it, and the run's end gives the repository back. The platform refuses an id that never reached Review (409 not_resolved, naming the step or the missing provider) and answers 404 for one that is not this workspace's — the id alone is not a credential. No token is in the record; the hooks resolve the chosen connections through the workspace, as a platform build does.

--via-platform​

Asks the platform to build into a repository this workspace has linked, in a sandbox it provisions, and prints a session id to watch. The repository defaults to the current checkout's origin; --repo owner/name names another; --repo-link repl_… chooses when one repository has more than one link. An ambiguous repository is refused, not guessed.

FlagMeaning
--repo owner/nameRepository to build into. Defaults to this checkout's origin.
--repo-link repl_…The link to build into, when the repository has several.
--profile <id>Agent profile to run the build as. The platform prepares one otherwise.
--set, --valuesInputs, as for --local. Inputs the card derives from the repository are filled by the platform.
$ orun baseline new cirrus --via-platform --repo acme/storefront --set productname="Acme Cloud" \
    --set productdomain=acme.dev --set subdomain=acme
building cirrus@baseline-v10 into acme/storefront (repl_01J8…)
as_8f3c2d1e9b7a4c6d

The target is resolved and printed on standard error before anything starts. The session id is the only thing on standard output. Watch the build in the console: the Build pill and the build panel on the workspace's Overview page show it phase by phase, and the session transcript is under Agents. The repository link itself is created in the console, by the baseline flow's Repository step or from the repository's Git tab; the CLI can list links but not create them.

Everything about a platform build is decided on the server and reported verbatim: the admin-role requirement, the paid-tier gate, readiness, the repository grounding, required inputs, the admission fee, and the one-build-per-repository lease.

--out, --run-hooks, --resume, --phase, --until, --progress, and --keep-checkout are accepted with --via-platform and ignored; the platform always runs with hooks and resume on.

register​

Registers a baseline this account owns. The source repository must be one the account has connected through the GitHub integration. Registration is a Business plan feature.

FlagMeaning
--name <s>Display name. Required.
--source-repo owner/nameWhere the baseline lives. Required. Not a hostname.
--tag <tag>The published tag. Required. Push it first.
--expected-minutes NHow long a build takes, measured. Required.
--manifest <path>The card's path inside the source repository, normally blueprint.yaml.
--summary <s>One paragraph a reader sees.
--stack a,bDisplay chips.
--requires a,bProviders that must be connected first.
--visibility private|unlistedDefault private. public is granted by Orunbase and cannot be set here.
--brief <path>, --umbrella <path>For a baseline with a shell layer. Pass both or neither.
orun baseline register acme-saas --name "Acme SaaS baseline" \
  --source-repo acme/acme-baseline --tag baseline-v1 --manifest blueprint.yaml \
  --expected-minutes 45 --requires cloudflare --stack saas,cloudflare --visibility unlisted

A duplicate id is refused with the existing row.

publish​

Moves one of this account's registered baselines to a tag.

git push origin baseline-v2            # in the baseline's own repository, FIRST
orun baseline publish acme-saas baseline-v2

The platform proves the tag before the registry moves: that it is a tag and not a branch or a commit, that the files a build reads first are in it, and that the card parses. A tag that fails any check leaves the registry untouched and the reason is printed. id@tag as the first argument is refused; the tag is the second argument because it is the thing that changes.

An Orunbase-maintained baseline is not published this way. Its catalogue is infra/baselines-registry/baselines.yaml in the orun-cloud repository and moves by pull request; the refusal says so.

Exit codes​

CodeMeaning
0Success, or (check) ready
1A refused build, a failed readiness check, or a platform error, printed verbatim
2Usage: neither or both of --local and --via-platform, or --local without --out