Subscribe FR

Release notes · Jun 29, 2026

Scylla 0.3: Pipelines can now run on their own

Yohann Mangenot and Sébastien Lucas · 2 min read

We are thrilled to announce the release of Scylla 0.3 today. This version was developed thanks to our beta testers, whom we would like to take this opportunity to warmly thank today. Check out the new features in this version now!

  • Triggers. Pipelines can now run on their own, without anyone clicking Run. A trigger starts a pipeline run automatically, and that run is identical to a manual one. A pipeline can have several triggers, of two kinds:

    Pipeline list with a new trigger button in the actions of each pipeline

    • Cron triggers. Run a pipeline on a schedule (evaluated in UTC, at most once per minute). Set it once and the pipeline fires on time, every time: nightly builds, hourly syncs, weekly reports.

      New trigger form of type Cron with a daily schedule at 09:00 UTC

    • Webhook triggers. Run a pipeline when an external system (GitHub, a deploy tool, a script) calls a URL that Scylla gives you, so a pipeline can react to a real event like a code push instead of waiting for a clock.

      New trigger form of type Webhook with a signature header field

      • Signed requests (integrity check). Because that URL is reachable by anyone, every incoming request must carry a valid signature or it is refused. When you create the trigger, Scylla shows you a secret once, and you copy it into the calling system. From then on the caller signs each request by combining the secret with the exact content it sends (HMAC-SHA256), and Scylla recomputes the signature to compare. A match proves the request truly came from a system that holds the secret (origin) and that its content wasn’t altered on the way (integrity). Anything unsigned, mis-signed, or aimed at a disabled trigger is rejected, and nothing runs.
  • Run inputs. Pass extra values into the run as environment variables: plain constants, or, for a webhook, values pulled straight from the incoming payload such as the commit that was pushed.

  • Scoped execution. A triggered run uses its own automation identity, never yours and never an internal one. You can only set up a trigger for a pipeline you are already allowed to run, so a trigger can never hand out access you don’t have.

We have also fixed bugs and made a lot of quality of life improvements.

We look forward to your feedback on this new version

You can test this new version right now and share your feedback with us here: feedback form.

If you need any help, don’t hesitate to create a ticket on our Discord server. We will be delighted to help you!

Stay tuned!

Keep reading