Flows

Execute long-running operations (sandbox provisioning, privilege elevation)

• sfp flows approve

• sfp flows cancel

• sfp flows disable

• sfp flows enable

• sfp flows list

• sfp flows logs

• sfp flows reject

• sfp flows remove-override

• sfp flows run

• sfp flows set-override

• sfp flows status

• sfp flows types

• sfp flows watch

sfp flows approve

Approve a pending flow that requires authorization.

USAGE
  $ sfp flows approve --id <value> [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url
    <value>] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --id=<value>                 (required) The flow ID to approve (returned when the flow was created)
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Approve a pending flow that requires authorization.

  This command approves a suspended flow (e.g., privilege elevation request) allowing it to proceed with execution. The
  approver's identity is fetched from the authenticated user's profile.

EXAMPLES
  `sfp flows approve --id 019b4af0-3727-7a53-b71a-d53ce71ad537 -e [email protected]`

See code: src/commands/flows/approve.ts

sfp flows cancel

Cancel a running or suspended flow.

USAGE
  $ sfp flows cancel --id <value> [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url
    <value>] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --id=<value>                 (required) The flow ID to cancel (returned when the flow was created)
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Cancel a running or suspended flow.

  This command cancels a flow that is currently running or waiting (e.g., suspended for approval). Cancelled flows
  cannot be resumed.

EXAMPLES
  `sfp flows cancel --id 019b4af0-3727-7a53-b71a-d53ce71ad537 --sfp-server-url http://localhost:3029 -e [email protected]`

See code: src/commands/flows/cancel.ts

sfp flows disable

Disable a flow type for a project

USAGE
  $ sfp flows disable --flow-type <value> [--json] [--repository <value>] [-e <value>] [-t <value>]
    [--sfp-server-url <value>] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --flow-type=<value>          (required) The flow type ID to disable (e.g., build-on-merge, pr-validate)
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Disable a flow type for a project

EXAMPLES
  $ sfp flows disable --flow-type build-on-merge --repository flxbl-io/sf-core

See code: src/commands/flows/disable.ts

sfp flows enable

Enable a flow type for a project

USAGE
  $ sfp flows enable --flow-type <value> [--json] [--repository <value>] [-e <value>] [-t <value>]
    [--sfp-server-url <value>] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --flow-type=<value>          (required) The flow type ID to enable (e.g., build-on-merge, pr-validate)
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Enable a flow type for a project

EXAMPLES
  $ sfp flows enable --flow-type build-on-merge --repository flxbl-io/sf-core

See code: src/commands/flows/enable.ts

sfp flows list

List flows and their statuses.

USAGE
  $ sfp flows list [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url <value>]
    [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL] [-s <value>] [--flow-path <value>]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -s, --since=<value>              [default: 24h] Show flows since this time (e.g., "24h", "7d", "48h"). Defaults to
                                   24h.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --flow-path=<value>          Filter flows by workflow path
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  List flows and their statuses.

  Shows recent flows, their execution status, and any pending approvals that require action.

EXAMPLES
  `sfp flows list`

  `sfp flows list --since 7d`

  `sfp flows list --since 48h`

  `sfp flows list --flow-path f/sfp/privilege-elevation/elevate-and-restore`

See code: src/commands/flows/list.ts

sfp flows logs

Retrieve logs from a flow execution. For orchestrator flows with multiple child jobs (like request-release), use --child to get logs for a specific child job, or use --list to see all available child jobs.

USAGE
  $ sfp flows logs --id <value> [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url
    <value>] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL] [--child <value>] [--list]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --child=<value>              For orchestrator flows, the label of the child job to get logs from (e.g.,
                                   environment name like 'staging', 'uat')
      --id=<value>                 (required) The ID of the flow to get logs from
      --list                       For orchestrator flows, list all available child jobs instead of fetching logs
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Retrieve logs from a flow execution. For orchestrator flows with multiple child jobs (like request-release), use
  --child to get logs for a specific child job, or use --list to see all available child jobs.

EXAMPLES
  Get logs from a flow:
  `sfp flows logs --id 019b5f7e-8917-2535-5fcd-8543d472870b --sfp-server-url http://localhost:3029 -e [email protected]`

  List child jobs from an orchestrator:
  `sfp flows logs --id 019b5f7e-8917-2535-5fcd-8543d472870b --list --sfp-server-url http://localhost:3029 -e [email protected]`

  Get logs from a specific child job:
  `sfp flows logs --id 019b5f7e-8917-2535-5fcd-8543d472870b --child staging --sfp-server-url http://localhost:3029 -e [email protected]`

  Get logs with JSON output:
  `sfp flows logs --id 019b5f7e-8917-2535-5fcd-8543d472870b --json --sfp-server-url http://localhost:3029 -e [email protected]`

See code: src/commands/flows/logs.ts

sfp flows reject

Reject a pending flow that requires authorization.

USAGE
  $ sfp flows reject --id <value> [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url
    <value>] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL] [-r <value>]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -r, --reason=<value>             Reason for rejecting the request
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --id=<value>                 (required) The flow ID to reject (returned when the flow was created)
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Reject a pending flow that requires authorization.

  This command rejects a suspended flow (e.g., privilege elevation request) and cancels its execution. The rejector's
  identity is fetched from the authenticated user's profile.

EXAMPLES
  `sfp flows reject --id 019b4af0-3727-7a53-b71a-d53ce71ad537 -e [email protected]`

  `sfp flows reject --id 019b4af0-3727-7a53-b71a-d53ce71ad537 -e [email protected] --reason "Insufficient justification"`

See code: src/commands/flows/reject.ts

sfp flows remove-override

Remove a flow override for a project, restoring the default flow type

USAGE
  $ sfp flows remove-override --flow-type <value> [--json] [--repository <value>] [-e <value>] [-t <value>]
    [--sfp-server-url <value>] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --flow-type=<value>          (required) The flow type ID to remove the override for (e.g., build-on-merge)
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Remove a flow override for a project, restoring the default flow type

EXAMPLES
  $ sfp flows remove-override --flow-type build-on-merge --repository flxbl-io/sf-core

See code: src/commands/flows/remove-override.ts

sfp flows run

Dispatch a flow to be executed by the SFP server.

USAGE
  $ sfp flows run [--json] [-r <value>] [-e <value>] [-t <value>] [--sfp-server-url <value>] [--loglevel
    trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL] [-p <value> | -f <value>] [-c <value>] [-w]

FLAGS
  -c, --callback=<value>           JSON callback configuration for status updates (e.g., GitHub issue comments)
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -f, --payload-file=<value>       Path to a JSON or YAML file containing the flow payload
  -p, --payload=<value>            Inline JSON payload describing the flow
  -r, --repository=<value>         Repository identifier (owner/repo) to associate with this flow execution. This is
                                   injected as `repositoryIdentifier` in the payload for tracking purposes.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
  -w, --watch                      Stream logs live from the flow execution. The command will wait for the flow to
                                   complete and display logs in real-time (similar to `wmill run`).
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Dispatch a flow to be executed by the SFP server.

  This command accepts a payload that describes the flow to execute, reads any referenced configuration files and
  inlines them, then dispatches to the server for asynchronous execution.

  The payload must include an `id` field that identifies the flow type to execute.

EXAMPLES
  Request elevated privileges with repository:
  `sfp flows run --payload '{"id":"request-elevated-privileges","username":"[email protected]","targetOrg":"[email protected]","accessLevel":"admin","durationMinutes":60,"devConfigFile":"./config/devconfig.yml"}' --repository owner/repo --sfp-server-url http://localhost:3029 -e [email protected]`

  Using a payload file with repository flag:
  `sfp flows run --payload-file ./elevate-request.json --repository owner/repo --sfp-server-url http://localhost:3029 -e [email protected]`

  With callback configuration:
  `sfp flows run --payload-file ./task.json --repository owner/repo --callback '{"type":"github","issueNumber":123,"repositoryIdentifier":"owner/repo"}'`

  Watch flow execution with live logs:
  `sfp flows run --payload-file ./flow.json --repository owner/repo --watch --sfp-server-url http://localhost:3029 -e [email protected]`

See code: src/commands/flows/run.ts

sfp flows set-override

Set a flow override for a project, routing one flow type to another

USAGE
  $ sfp flows set-override --flow-type <value> --override-flow-type <value> [--json] [--repository <value>] [-e <value>]
    [-t <value>] [--sfp-server-url <value>] [--loglevel
    trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>               Email address for authenticated user. Ignored if --application-token is provided.
                                    Can be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>   Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                    (CLI flags take precedence over env vars).
      --flow-type=<value>           (required) The original flow type ID to override (e.g., build-on-merge)
      --loglevel=<option>           [default: info] logging level for this command invocation
                                    <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --override-flow-type=<value>  (required) The flow type ID to route to instead (e.g., build-on-merge-custom)
      --repository=<value>          The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                    for Azure DevOps
      --sfp-server-url=<value>      URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                    config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Set a flow override for a project, routing one flow type to another

EXAMPLES
  $ sfp flows set-override --flow-type build-on-merge --override-flow-type build-on-merge-custom --repository flxbl-io/sf-core

See code: src/commands/flows/set-override.ts

sfp flows status

Show flow types with enabled/disabled status for a project

USAGE
  $ sfp flows status [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url <value>]
    [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Show flow types with enabled/disabled status for a project

EXAMPLES
  $ sfp flows status --repository flxbl-io/sf-core

See code: src/commands/flows/status.ts

sfp flows types

List available flow types.

USAGE
  $ sfp flows types [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url <value>]
    [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL] [--type-id <value>] [-p]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -p, --payload                    Include full payload schema with parameters for each flow type
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url
      --type-id=<value>            Show details for a specific flow type by ID

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  List available flow types.

  Shows all available flow types that can be executed via 'sfp flows run', including their descriptions and parameters.

EXAMPLES
  `sfp flows types`

  `sfp flows types --payload`

  `sfp flows types --type-id request-elevated-privileges`

  `sfp flows types --json`

See code: src/commands/flows/types.ts

sfp flows watch

Attach to and watch a running flow with live log streaming. For orchestrator flows with multiple child jobs (like request-release), use --child to watch a specific child job by label.

USAGE
  $ sfp flows watch --id <value> [--json] [--repository <value>] [-e <value>] [-t <value>] [--sfp-server-url
    <value>] [--loglevel trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL] [--child <value>]

FLAGS
  -e, --email=<value>              Email address for authenticated user. Ignored if --application-token is provided. Can
                                   be set via SFP_SERVER_USER env var.
  -t, --application-token=<value>  Application token for CI/CD authentication. Can be set via SFP_SERVER_TOKEN env var
                                   (CLI flags take precedence over env vars).
      --child=<value>              For orchestrator flows, the label of the child job to watch (e.g., environment name
                                   like 'staging', 'uat')
      --id=<value>                 (required) The ID of the flow to watch
      --loglevel=<option>          [default: info] logging level for this command invocation
                                   <options: trace|debug|info|warn|error|fatal|TRACE|DEBUG|INFO|WARN|ERROR|FATAL>
      --repository=<value>         The repository identifier. E.g `owner/repo` for GitHub/GitLab or `org/project/repo`
                                   for Azure DevOps
      --sfp-server-url=<value>     URL of the SFP server. Can be set via SFP_SERVER_URL env var or config: sfp
                                   config:set server-url

GLOBAL FLAGS
  --json  Format output as json.

DESCRIPTION
  Attach to and watch a running flow with live log streaming. For orchestrator flows with multiple child jobs (like
  request-release), use --child to watch a specific child job by label.

EXAMPLES
  Watch a running flow:
  `sfp flows watch --id 019b5f7e-8917-2535-5fcd-8543d472870b --sfp-server-url http://localhost:3029 -e [email protected]`

  Watch a specific child job from an orchestrator:
  `sfp flows watch --id 019b5f7e-8917-2535-5fcd-8543d472870b --child staging --sfp-server-url http://localhost:3029 -e [email protected]`

  Watch with JSON output:
  `sfp flows watch --id 019b5f7e-8917-2535-5fcd-8543d472870b --json --sfp-server-url http://localhost:3029 -e [email protected]`

See code: src/commands/flows/watch.ts