Catalog templates
The catalog ships reusable WorkflowTemplates you install and reference from your own workflows. Each one is an ordinary Argo Workflows WorkflowTemplate with typed inputs, so you wire it into a graph like any other step. Search the full set below, or filter by category. Six of them are open to build with; the rest need a plan that includes the catalog. See the template catalog for which six, and for how installing and publishing works.
51 templates
- Conditional (when) gate
A reusable guarded step that runs (echoing a value) only when a condition input is truthy, and is skipped otherwise. A reusable building block other workflows reference.
conditional-whenChangelog
- v1.0.02026-07-16Initial release.
- Request approval in Slack
Post an approval-request message to a Slack channel, then pause the workflow at an Argo suspend node until a human resumes it. A reusable building block other workflows reference.
slack-approvalChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-16Initial release.
- Wait for a fixed duration
Pause the workflow at an Argo suspend node for a fixed duration, then resume automatically. A reusable building block other workflows reference.
timed-waitChangelog
- v1.0.02026-07-16Initial release.
- Wait for an external HTTP callback
Pause the workflow at an Argo suspend node until an external system resumes it over the Argo Server resume API. A reusable building block other workflows reference.
http-callback-gateChangelog
- v1.0.02026-07-16Initial release.
- Wait for manual approval
Pause the workflow at an Argo suspend node until a human approves it (via the Argo UI, `argo resume`, or the resume API). A reusable building block other workflows reference.
manual-approvalChangelog
- v1.0.02026-07-16Initial release.
- Build and push a container image
Build a container image from a Dockerfile with Kaniko and push it to a registry, using a Docker config.json read from a Kubernetes Secret. A reusable building block other workflows reference.
docker-build-pushChangelog
- v1.0.12026-08-02Move kaniko from v1.23.2 to v1.24.0, the newest release. Fixable CRITICAL/HIGH only drops from 116 to 112: kaniko has shipped nothing since May 2025, so clearing the rest needs a different build tool rather than another bump.
- v1.0.02026-07-17Initial release.
- Bump a semantic version
Compute the next semantic version from a base version and a bump type (major/minor/patch), exposing the result as an Argo output parameter for downstream steps. A reusable building block other workflows reference.
semver-bumpChangelog
- v1.0.02026-07-17Initial release.
- Publish a build artifact
Upload a build artifact to an artifact registry with an HTTP PUT via curl, using credentials read from a Kubernetes Secret. A reusable building block other workflows reference.
publish-artifactChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-17Initial release.
- Run a test command
Run a test command in a working directory on a generic Node 24 image. A language-agnostic reusable building block other workflows reference; swap the image for a different toolchain if needed.
run-shell-testsChangelog
- v1.0.12026-08-02Move node from 20-alpine to 24-alpine. Fixable CRITICAL/HIGH drops from 18 to 5. This crosses majors: Node 20 left maintenance and no 20.x rebuild carries the fixes, so a test command that relies on Node 20 behaviour needs rechecking.
- v1.0.02026-07-17Initial release.
- Scan for vulnerabilities with Trivy
Scan a container image or a filesystem path for known vulnerabilities with Trivy, optionally failing the step on findings. A reusable building block other workflows reference.
trivy-scanChangelog
- v1.0.12026-08-02Move trivy from 0.58.1 to 0.72.0. Fixable CRITICAL/HIGH drops from 91 to 11. Worth doing on its own terms too: the scanner this item sells was fourteen minor releases behind.
- v1.0.02026-07-17Initial release.
- Gzip a file
Compress a local file or artifact with gzip, writing the result to a destination path. A reusable building block other workflows reference.
gzip-compressChangelog
- v1.0.02026-07-16Initial release.
- Run a SQL query and write results to S3 as CSV
Run a SQL query against a Postgres database and write the result set to Amazon S3 as a CSV object. Connection string and AWS credentials are read from Kubernetes Secrets. A reusable building block other workflows reference.
sql-to-s3Changelog
- v1.0.02026-07-16Initial release.
- Run data-quality assertions on a dataset
Run basic data-quality assertions on a CSV dataset — per-column null fraction and minimum row count — and fail the step when a rule is violated. A reusable building block other workflows reference.
data-quality-checkChangelog
- v1.0.02026-07-16Initial release.
- Transform JSON with a jq filter
Transform a JSON document by applying a jq program, printing the result to stdout. A reusable building block other workflows reference.
json-transformChangelog
- v1.0.02026-07-16Initial release.
- Validate a CSV's headers and row count
Validate that a CSV document has a header row containing a required set of columns and at least a minimum number of data rows; fails the step otherwise. A reusable building block other workflows reference.
csv-validateChangelog
- v1.0.02026-07-16Initial release.
- Run a BigQuery query
Run a Standard SQL query against BigQuery with the bq CLI, using a GCP service-account key read from a Kubernetes Secret. A reusable building block other workflows reference.
bigquery-queryChangelog
- v1.0.12026-08-02Repin google/cloud-sdk:slim on the current digest. Same tag, newer build. Fixable CRITICAL/HIGH drops from 37 to 18.
- v1.0.02026-07-17Initial release.
- Run a MongoDB find
Run a find() query against a MongoDB collection with mongosh, using a connection URI (with credentials) read from a Kubernetes Secret. A reusable building block other workflows reference.
mongodb-queryChangelog
- v1.0.12026-08-02Repin mongo:7 on the current digest. Same tag, newer build, and the fixable CVE count does not move: still 192, because upstream has not shipped the fixes. Worth doing anyway so the pin is not a year behind the tag.
- v1.0.02026-07-17Initial release.
- Run a MySQL query
Run a SQL query against a MySQL database with the mysql client, using a password read from a Kubernetes Secret. A reusable building block other workflows reference.
mysql-queryChangelog
- v1.0.12026-08-02Repin mysql:8 on the current digest. Same tag, newer build. Fixable CRITICAL/HIGH drops from 22 to 19.
- v1.0.02026-07-17Initial release.
- Run a PostgreSQL query
Run a SQL query against a PostgreSQL database with psql, using a password read from a Kubernetes Secret. A reusable building block other workflows reference.
postgres-queryChangelog
- v1.0.02026-07-17Initial release.
- Run a Redis command
Run a command against a Redis server with redis-cli, using an AUTH password read from a Kubernetes Secret. A reusable building block other workflows reference.
redis-commandChangelog
- v1.0.02026-07-17Initial release.
- Git Checkout
Clone a git repository and check out a branch, tag, or commit into a path. Credentials (username/password, e.g. a personal access token) are read from a Kubernetes Secret; leave them blank for a public repo. Converted from the built-in dagweave "Git Checkout" blueprint.
git-checkoutChangelog
- v1.0.12026-08-02Move alpine/git from 2.45.2 to 2.54.0. Clears all 55 fixable CRITICAL/HIGH; the image now scans clean.
- v1.0.02026-07-17Initial release. Converted from the built-in git-checkout blueprint.
- Git Clone (shallow)
Shallow-clone a single branch or tag of a git repository to a configurable depth and destination path. Credentials are read from a Kubernetes Secret; leave them blank for a public repo.
git-cloneChangelog
- v1.0.12026-08-02Move alpine/git from 2.45.2 to 2.54.0. Clears all 55 fixable CRITICAL/HIGH; the image now scans clean.
- v1.0.02026-07-17Initial release.
- Git Commit & Push
Commit the changes in a checked-out working directory and push HEAD to a branch on its remote. Author identity and target branch are configurable; credentials come from a Kubernetes Secret. Converted from the built-in dagweave "Git Commit & Push" blueprint.
git-commit-pushChangelog
- v1.0.12026-08-02Move alpine/git from 2.45.2 to 2.54.0. Clears all 55 fixable CRITICAL/HIGH; the image now scans clean.
- v1.0.02026-07-17Initial release. Converted from the built-in git-commit-push blueprint.
- Git Tag
Create an annotated git tag at a ref and push it to the remote. Clones the repository, tags it, and pushes the tag using credentials from a Kubernetes Secret.
git-tagChangelog
- v1.0.12026-08-02Move alpine/git from 2.45.2 to 2.54.0. Clears all 55 fixable CRITICAL/HIGH; the image now scans clean.
- v1.0.02026-07-17Initial release.
- Open a GitHub pull request
Open a pull request on GitHub via the REST API (POST /repos/{owner}/{repo}/pulls), using a token read from a Kubernetes Secret. Inputs are the repo, head and base branches, and the PR title/body.
open-github-prChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-17Initial release.
- Download a file
Download a file from a URL to a filesystem path (following redirects), with an optional bearer token read from a Kubernetes Secret. A reusable building block other workflows reference.
download-fileChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-17Initial release.
- HTTP request (curl)
Make a generic HTTP request (any method) to a URL with an optional body, configurable Content-Type, and an optional bearer token read from a Kubernetes Secret. A reusable building block other workflows reference.
http-request-curlChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-17Initial release.
- POST JSON to a webhook
POST a JSON payload to an arbitrary webhook URL, with an optional Authorization header read from a Kubernetes Secret. A reusable building block other workflows reference.
webhook-postChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-17Initial release.
- Poll a URL until a condition holds
Repeatedly GET a URL and evaluate a jq boolean filter over the JSON response, succeeding when the condition becomes truthy or failing after a maximum number of attempts. Useful for waiting on an async job or a resource to reach a desired state. A reusable building block other workflows reference.
rest-poll-untilChangelog
- v1.0.12026-08-02Swap the abandoned dwdraju/alpine-curl-jq, last built 2025-02-21, for badouralix/curl-jq, which is still being rebuilt. Fixable CRITICAL/HIGH drops from 19 to 1. Same Alpine base, same root user, same /bin/sh default command; curl goes 8.12.1 to 8.21.0 and jq 1.7.1 to 1.8.1.
- v1.0.02026-07-17Initial release.
- Run a GraphQL query
POST a GraphQL query (or mutation) with JSON variables to a GraphQL endpoint, authenticated with a bearer token read from a Kubernetes Secret. The request body is assembled with jq so quotes and newlines in the query are escaped safely. A reusable building block other workflows reference.
graphql-queryChangelog
- v1.0.12026-08-02Swap the abandoned dwdraju/alpine-curl-jq, last built 2025-02-21, for badouralix/curl-jq, which is still being rebuilt. Fixable CRITICAL/HIGH drops from 19 to 1. Same Alpine base, same root user, same /bin/sh default command; curl goes 8.12.1 to 8.21.0 and jq 1.7.1 to 1.8.1.
- v1.0.02026-07-17Initial release.
- Helm upgrade --install
Install or upgrade a Helm release with `helm upgrade --install`, using the workflow pod's in-cluster serviceAccount. Supports an optional chart repo URL and inline values.yaml.
helm-upgradeChangelog
- v1.0.12026-08-02Move alpine/helm from 3.16.3 to 3.21.3, the newest 3.x. Fixable CRITICAL/HIGH drops from 76 to 1. Helm 4 exists but is a major with its own migration, so this stays on 3.x.
- v1.0.02026-07-17Initial release.
- Scale deployment
Scale a Deployment to a target replica count with `kubectl scale`, using the workflow pod's in-cluster serviceAccount.
scale-deploymentChangelog
- v1.0.12026-08-02Repin bitnami/kubectl:latest on the current digest. Same tag, newer build. Clears the four CRITICAL CVEs the old digest carried; twelve fixable HIGH are still there.
- v1.0.02026-07-17Initial release.
- Wait for rollout
Block until a Deployment (or StatefulSet/DaemonSet) rollout completes, using `kubectl rollout status` with a timeout and the pod's in-cluster serviceAccount.
wait-for-rolloutChangelog
- v1.0.12026-08-02Repin bitnami/kubectl:latest on the current digest. Same tag, newer build. Clears the four CRITICAL CVEs the old digest carried; twelve fixable HIGH are still there.
- v1.0.02026-07-17Initial release.
- kubectl apply
Apply a manifest to the cluster with kubectl, using the workflow pod's in-cluster serviceAccount. Accepts an inline manifest or a path to a manifest file, in a target namespace.
kubectl-applyChangelog
- v1.0.12026-08-02Repin bitnami/kubectl:latest on the current digest. Same tag, newer build. Clears the four CRITICAL CVEs the old digest carried; twelve fixable HIGH are still there.
- v1.0.02026-07-17Initial release.
- kubectl delete
Delete a named Kubernetes resource with kubectl, using the workflow pod's in-cluster serviceAccount. Idempotent via --ignore-not-found.
kubectl-deleteChangelog
- v1.0.12026-08-02Repin bitnami/kubectl:latest on the current digest. Same tag, newer build. Clears the four CRITICAL CVEs the old digest carried; twelve fixable HIGH are still there.
- v1.0.02026-07-17Initial release.
- Download and unpack a dataset
Download a dataset archive from a URL and unpack it (.tar.gz, .tgz, .tar or .zip) into a destination directory, with an optional bearer token read from a Kubernetes Secret. Unlike download-file, this item also extracts the archive so a downstream step sees the unpacked dataset tree. A reusable building block other workflows reference.
dataset-downloadChangelog
- v1.0.02026-07-17Initial release.
- Embed text (OpenAI-compatible)
Get an embedding vector for a piece of text from an OpenAI-compatible embeddings endpoint and echo the raw JSON response. Provider-neutral: configure the base URL and model to target OpenAI or any OpenAI-compatible gateway. The API key is read from a Kubernetes Secret. A reusable building block other workflows reference.
embed-textChangelog
- v1.0.12026-08-02Swap the abandoned dwdraju/alpine-curl-jq, last built 2025-02-21, for badouralix/curl-jq, which is still being rebuilt. Fixable CRITICAL/HIGH drops from 19 to 1. Same Alpine base, same root user, same /bin/sh default command; curl goes 8.12.1 to 8.21.0 and jq 1.7.1 to 1.8.1.
- v1.0.02026-07-17Initial release.
- HuggingFace Inference API
Run inference on a HuggingFace-hosted model via the HuggingFace Inference API, posting an input text and echoing the raw JSON response. The access token is read from a Kubernetes Secret. A reusable building block other workflows reference.
huggingface-inferenceChangelog
- v1.0.22026-08-02Swap the abandoned dwdraju/alpine-curl-jq, last built 2025-02-21, for badouralix/curl-jq, which is still being rebuilt. Fixable CRITICAL/HIGH drops from 19 to 1. Same Alpine base, same root user, same /bin/sh default command; curl goes 8.12.1 to 8.21.0 and jq 1.7.1 to 1.8.1.
- v1.0.12026-07-17Fix inference endpoint: the legacy api-inference.huggingface.co host was retired (no longer resolves). Point at the current router.huggingface.co/hf-inference/models/<model> endpoint.
- v1.0.02026-07-17Initial release.
- Prompt an LLM (OpenAI-compatible)
Send a prompt to an OpenAI-compatible chat completions endpoint and echo the raw JSON response. Provider-neutral: configure the base URL and model to target OpenAI, Azure OpenAI, or any OpenAI-compatible gateway (vLLM, LiteLLM, OpenRouter, ...). The API key is read from a Kubernetes Secret. A reusable building block other workflows reference.
llm-promptChangelog
- v1.0.12026-08-02Swap the abandoned dwdraju/alpine-curl-jq, last built 2025-02-21, for badouralix/curl-jq, which is still being rebuilt. Fixable CRITICAL/HIGH drops from 19 to 1. Same Alpine base, same root user, same /bin/sh default command; curl goes 8.12.1 to 8.21.0 and jq 1.7.1 to 1.8.1.
- v1.0.02026-07-17Initial release.
- Upsert a vector to a vector DB
Upsert a single vector (with an id and JSON metadata payload) into a vector database via its REST API. Targets the Qdrant points-upsert API (PUT /collections/<collection>/points, `api-key` header); the request body is assembled with jq. The API key is read from a Kubernetes Secret. A reusable building block other workflows reference.
vector-upsertChangelog
- v1.0.12026-08-02Swap the abandoned dwdraju/alpine-curl-jq, last built 2025-02-21, for badouralix/curl-jq, which is still being rebuilt. Fixable CRITICAL/HIGH drops from 19 to 1. Same Alpine base, same root user, same /bin/sh default command; curl goes 8.12.1 to 8.21.0 and jq 1.7.1 to 1.8.1.
- v1.0.02026-07-17Initial release.
- Post a message to Discord
Post a message to a Discord channel via an incoming-webhook URL read from a Kubernetes Secret. A reusable building block other workflows reference.
discord-postChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-16Initial release.
- Post a message to Microsoft Teams
Post a message to a Microsoft Teams channel via an incoming-webhook URL read from a Kubernetes Secret. A reusable building block other workflows reference.
microsoft-teams-postChangelog
- v1.0.02026-07-16Initial release.
- Post a message to Slack
Post a message to a Slack channel via the chat.postMessage Web API, using a bot token read from a Kubernetes Secret. A reusable building block other workflows reference.
slack-post-messageChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-16Initial release.
- Send a Telegram message
Send a message from a Telegram bot to a chat via the Bot API sendMessage method, with the bot token read from a Kubernetes Secret. A reusable building block other workflows reference.
telegram-sendChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-16Initial release.
- Send an email via SMTP
Send a plain-text email through an authenticated SMTP submission server (STARTTLS), with the password read from a Kubernetes Secret. A reusable building block other workflows reference.
email-sendChangelog
- v1.0.12026-08-02Move curlimages/curl from 8.11.1 to 8.21.0. Fixable CRITICAL/HIGH drops from 26 to 1.
- v1.0.02026-07-16Initial release.
- Trigger a PagerDuty alert
Trigger a PagerDuty incident via the Events API v2, with the integration routing key read from a Kubernetes Secret. A reusable building block other workflows reference.
pagerduty-triggerChangelog
- v1.0.02026-07-16Initial release.
- Download an object from S3
Download an object from an Amazon S3 bucket to a local path with the AWS CLI, using credentials read from a Kubernetes Secret. A reusable building block other workflows reference.
s3-downloadChangelog
- v1.0.12026-08-02Move amazon/aws-cli from 2.17.19 to 2.36.14. Clears all 90 fixable CRITICAL/HIGH; the image now scans clean.
- v1.0.02026-07-16Initial release.
- List objects under an S3 prefix
List the objects under a prefix in an Amazon S3 bucket with the AWS CLI, using credentials read from a Kubernetes Secret. A reusable building block other workflows reference.
s3-listChangelog
- v1.0.12026-08-02Move amazon/aws-cli from 2.17.19 to 2.36.14. Clears all 90 fixable CRITICAL/HIGH; the image now scans clean.
- v1.0.02026-07-16Initial release.
- Upload a file to Azure Blob Storage
Upload a local file or artifact to an Azure Blob Storage container with the az CLI, authenticating with a storage account key read from a Kubernetes Secret. A reusable building block other workflows reference.
azure-blob-uploadChangelog
- v1.0.12026-08-02Move azure-cli from 2.63.0 to 2.88.0. Fixable CRITICAL/HIGH drops from 103 to 30.
- v1.0.02026-07-16Initial release.
- Upload a file to Google Cloud Storage
Upload a local file or artifact to a Google Cloud Storage bucket with gsutil, authenticating with a service-account key read from a Kubernetes Secret. A reusable building block other workflows reference.
gcs-uploadChangelog
- v1.0.12026-08-02Move google/cloud-sdk off the pinned 495.0.0-slim tag onto the rolling slim tag that bigquery-query already uses. Fixable CRITICAL/HIGH drops from 980 to 18. gcloud goes 495.0.0 to 578.0.0 and gsutil 5.30 to 5.37.
- v1.0.02026-07-16Initial release.
- Upload a file to S3
Upload a local file or artifact to an Amazon S3 bucket with the AWS CLI, using credentials read from a Kubernetes Secret. A reusable building block other workflows reference.
s3-uploadChangelog
- v1.0.12026-08-02Move amazon/aws-cli from 2.17.19 to 2.36.14. Clears all 90 fixable CRITICAL/HIGH; the image now scans clean.
- v1.0.02026-07-16Initial release.
No templates match your search.