Scripts and Commands

Use the Script group to run allow-listed operating-system commands or scripts through a governed Command Runner resource.

Available activities

Activity	Purpose
Command Runner	Defines the policy that controls executable paths, arguments, working directories, and runtime limits
Run Command	Runs an allow-listed executable with a mapped argument array
Run Bash Script	Runs a Bash script on a supported Linux runtime
Run PowerShell Script	Runs a PowerShell script on a supported Windows runtime

Configure command execution

1. Create a Command Runner resource with the narrowest executable and path allowlist possible.
2. Set timeout, working-directory, output-size, and environment restrictions.
3. Add the required run activity and select the policy resource.
4. Map arguments as separate values instead of composing an unescaped shell command.
5. Map standard output, standard error, and exit status to the workflow's success and failure handling.
6. Test with a non-privileged runtime identity.

Security requirements

• Never pass untrusted text into a shell command string.
• Do not allow arbitrary executable paths, working directories, or environment variables.
• Run with the least-privileged operating-system identity.
• Keep secrets out of command arguments because process listings and logs may expose them.
• Set execution and output limits to prevent runaway processes.
• Review scripts through normal source-control and deployment approval processes.

Command activities may be disabled by platform policy. If the group is unavailable, contact your platform administrator rather than attempting to bypass the policy.