Feature
CI policy and service accounts
Each workspace says what CI should fail on, and service accounts give pipelines their own wl_ token.
The manifest’s CI policy can fail on drift, on unapproved packages, on yanked or deprecated versions and on providers outside an allowed list; its check command defaults to `wl sync --check`.
A service account is a non-human, org-scoped identity with a wl_ token and a role (default ci:agent), so a pipeline never uses a person’s credentials.
More features
All features →- 01
Validate the manifest and its trust gates
`wl validate` checks workloom.workspace.json against the schema, then runs the trust gates over a render plan and lists what they would block.
- 02
Deterministic render plans
See every file each provider will get, with its projection policy, ownership and write mode, before anything is written.
- 03
Sync with ownership checks
`wl sync` writes only the projections the trust gate allows, atomically, and changes or removes only files Workloom owns.