
TOML Configuration
A TOML configuration file with tables, inline values, and an array of tables — for testing TOML parsers.
- File
- TOML · Config · UTF-8
- Use case
- Config parsing
TOML and INI configuration files with nested sections and typed values — for testing config parsers and loaders.

A TOML configuration file with tables, inline values, and an array of tables — for testing TOML parsers.

A classic INI configuration file with sections and key/value pairs — for testing INI parsers.

Tiny SAMPLE TOML config fixture (app-feature-flags) for parser and twin tests.

Tiny SAMPLE YAML config fixture (app-feature-flags) for parser and twin tests.

Tiny SAMPLE JSON config fixture (app-feature-flags) for parser and twin tests.

Tiny SAMPLE INI config fixture (database-pool) for parser and twin tests.

Tiny SAMPLE ENV config fixture (database-pool) for parser and twin tests.

Tiny SAMPLE TOML config fixture (redis-cache) for parser and twin tests.

Tiny SAMPLE YAML config fixture (redis-cache) for parser and twin tests.

Tiny SAMPLE INI config fixture (logging-levels) for parser and twin tests.

Tiny SAMPLE JSON config fixture (cors-origins) for parser and twin tests.

Tiny SAMPLE YAML config fixture (rate-limit) for parser and twin tests.

Tiny SAMPLE ENV config fixture (smtp-relay) for parser and twin tests.

Tiny SAMPLE YAML config fixture (k8s-resource-snippet) for parser and twin tests.

Tiny SAMPLE tooling config snippet (docker-compose-snippet) for editor/linter harnesses.

Tiny SAMPLE tooling config snippet (github-actions-snippet) for editor/linter harnesses.

Tiny SAMPLE tooling config snippet (eslint-flat-snippet) for editor/linter harnesses.

Tiny SAMPLE tooling config snippet (prettier-config) for editor/linter harnesses.

Tiny SAMPLE tooling config snippet (editorconfig-snippet) for editor/linter harnesses.

Tiny SAMPLE tooling config snippet (tsconfig-strict-snippet) for editor/linter harnesses.

Sample App .env — small deterministic fixture for parsers and the in-browser editor.

Sample Dockerfile — small deterministic fixture for parsers and the in-browser editor.

An SMTP MTA-STS policy in enforce mode listing three MX patterns, one of them a wildcard, with a seven-day max_age. RFC 8461 specifies CRLF line endings, so this fixture is written with them deliberately - for testing policy parsers that split on bare LF.

The one-member server-delegation document that lets example.com host its Matrix homeserver at matrix.example.com:8448 without changing user IDs. For testing federation discovery and explicit-port handling.

The client-side twin of the Matrix delegation pair: homeserver and identity server base URLs plus an unregistered vendor key, which clients must carry through rather than reject. For testing discovery and unknown-member tolerance.

A English Java ResourceBundle with MessageFormat patterns, a ChoiceFormat plural, positional arguments, escaped braces and apostrophes, a backslash line continuation, and non-ASCII carried as \uXXXX escapes because .properties is defined as ISO-8859-1. The bytes on disk are pure ASCII.

A German Java ResourceBundle with MessageFormat patterns, a ChoiceFormat plural, positional arguments, escaped braces and apostrophes, a backslash line continuation, and non-ASCII carried as \uXXXX escapes because .properties is defined as ISO-8859-1. The bytes on disk are pure ASCII.

A English (United States) resource file built around composite format strings — {0:N2}, {2:P1}, {0:C}, {0:d} and {0:t} — whose rendered output depends entirely on CultureInfo. Includes a whitespace-significant resource guarded by xml:space, and documents the suffixed-key convention .NET falls back on because String.Format has no plural selector.

A German (Germany) resource file built around composite format strings — {0:N2}, {2:P1}, {0:C}, {0:d} and {0:t} — whose rendered output depends entirely on CultureInfo. Includes a whitespace-significant resource guarded by xml:space, and documents the suffixed-key convention .NET falls back on because String.Format has no plural selector.

A Arabic (Egypt) resource file built around composite format strings — {0:N2}, {2:P1}, {0:C}, {0:d} and {0:t} — whose rendered output depends entirely on CultureInfo. Includes a whitespace-significant resource guarded by xml:space, and documents the suffixed-key convention .NET falls back on because String.Format has no plural selector.

A Polish (Poland) resource file built around composite format strings — {0:N2}, {2:P1}, {0:C}, {0:d} and {0:t} — whose rendered output depends entirely on CultureInfo. Includes a whitespace-significant resource guarded by xml:space, and documents the suffixed-key convention .NET falls back on because String.Format has no plural selector.

A <properties> block holding an empty value, an escaped ampersand in a branch name and a JVM options string with spaces. Use it to check that build metadata survives extraction with its entities unescaped exactly once.

The threshold configuration the three boundary tracefiles in this group are meant to be judged against: global minimums, one per-path override and an explicit >= comparison. Publishing the comparison operator is the point — leaving it implicit is what makes an at-the-gate report ambiguous.

A budget file pairing per-path resource-size and timing limits with API latency budgets, including a glob path that must be matched rather than compared for equality. It is the configuration side of the load-test results in this group: the limits a run is judged against.

The message template git writes into .git/MERGE_MSG when a merge stops on conflicts: one real subject line followed by a commented list of the conflicted paths and the standard advice block. Everything after the first blank line is stripped by `git commit`, so a hook that lints the whole file rejects messages git would accept.

A realistic monorepo ignore file that uses `dist/*` rather than `dist/` precisely so the two `!dist/...` re-inclusions below it can work. It also carries the `.env.*` / `!.env.example` and `*.log` / `!logs/retained/*.log` pairs that every ignore-matcher has to order correctly.

The single most misunderstood rule in the format: once `build/` excludes a directory, git does not descend into it, so `!build/keep.txt` is dead. The file is valid and the behaviour is documented — it is the author's expectation that is wrong, which is exactly why an ignore-matcher must reproduce it rather than being helpful.

The corrected twin: `build/*` excludes the directory's contents instead of the directory, so git still descends and `!build/keep.txt` re-includes the file. The two fixtures differ by two characters and produce opposite results, which makes them a precise pass/fail pair for an ignore engine.

One pattern per rule in the gitignore grammar: a leading slash that anchors to the containing directory, the same name unanchored, `**` in all three positions, `?` and `[...]` classes, and a trailing slash that matches only directories. Every line is a separate assertion for a matcher's test suite.

Every escape the format defines, including the one nobody expects: a trailing space is stripped from a pattern unless it is backslash-escaped, so `draft\ ` and `draft` ignore different files. Editors that trim trailing whitespace on save silently change what this file means.

The attribute file that decides what happens to line endings on checkout: `text=auto` as the default, explicit `eol=lf` and `eol=crlf` overrides, the `binary` macro that expands to `-text -diff`, and one `-text` entry that is still given a textconv driver. This is the file whose absence causes the CRLF twins elsewhere in this category.

The non-EOL half of the format: LFS filter/diff/merge triples, `linguist-generated` and `linguist-vendored` hints that hide files from language statistics and review, `export-ignore` entries that drop paths from `git archive`, and a `merge=union` driver for an append-only changelog. Attribute values are unquoted and space-separated, so column alignment is whitespace a parser must collapse.

A realistic global config exercising the whole INI-like grammar: bracketed sections, quoted subsection names that are case-sensitive while section names are not, values with size suffixes, a shell alias whose leading `!` changes how the rest is executed, and both comment characters.

Every conditional-include form git supports — path prefix, case-insensitive path prefix, branch glob, and a condition on an existing remote URL — plus one unconditional include. Order matters: a later include overrides an earlier one, so a parser that gathers includes into a set rather than a list resolves the wrong identity.

Three submodules covering the awkward values: a relative `../currency-tables.git` URL that has to be resolved against the superproject's remote, `branch = .` meaning 'the same branch as the superproject', and `ignore = dirty` which hides a submodule's local changes from `git status`. The section name and the `path` value are separate strings and are allowed to differ.

Deliberately overlapping rules so every interesting path matches two or three of them, which is the only way to test that a resolver applies last-match-wins rather than most-specific-wins. One rule has no owners at all, which clears inherited ownership instead of adding any.

One line for each of the four rewrite forms git's mailmap supports, including the two-pair form that matches on the commit name as well as the email. Four aliases collapse onto three canonical authors, which is exactly the transformation a shortlog or contributor report has to reproduce.

A commit message file exactly as `git commit` hands it to a commit-msg hook: a conventional subject, a wrapped body, two trailers, and git's own comment block that the hook must ignore. The subject is 43 characters, comfortably inside commitlint's default 72-character header limit.

A breaking change announced twice, which the specification allows: a `!` after the scope and a `BREAKING CHANGE:` footer whose value continues onto a second line. Generators that stop a footer at the first newline lose half the sentence, and version bumpers that only look for one of the two markers under-bump the release.

A hand-maintained changelog in the Keep a Changelog layout: an Unreleased section, dated version headings in square brackets, the standard change-type subheadings, and reference-style compare links at the bottom. It describes the same releases as the generated twin in this group, so a converter between the two can be scored.

The machine-generated twin of the hand-written changelog: version headings that are themselves compare links, a leading warning glyph on the breaking-changes section, and every entry ending in a short-hash link back to the commit. The hashes are the same fictional ids used by the log fixtures in this category.

tracestate header values covering vendor-prefixed keys, optional whitespace, the exact 32-member limit and a 33-member case that must lose its last member rather than its first — plus duplicate keys, uppercase keys, a bare key and an over-long key that must be rejected.

B3 context propagation in both shapes — the compact single b3 header including the debug flag, a legacy 64-bit trace ID and the sampling-only form, plus the five X-B3-* multi-header fields — with two malformed values that must be rejected.

The body a /metrics endpoint returns: five metric families with HELP and TYPE metadata across 27 labelled series — request counters by route and status, process and runtime gauges, per-target up values (one deliberately 0) and a business gauge. The baseline exposition-parser fixture.

Ten series whose label values contain the characters that break naive line splitting — escaped quotes and backslashes, an escaped newline, non-ASCII text, braces, commas, equals signs, a leading hash and significant whitespace. The exposition format defines exactly three escapes and this file uses all of them.

Samples exposed with no HELP or TYPE at all, metadata arriving after the sample it describes, blank and whitespace-only lines and a bare comment. All of it is legal — metadata is optional — and all of it breaks parsers that assume every sample is introduced by a TYPE line.

A scrape body with metadata but no samples, which is what a freshly started process returns before it has recorded anything. Valid, and routinely mistaken for a failed scrape by code that treats an empty result as an error.

Dotted OpenTelemetry-style metric and label names written with the quoted-name syntax that Prometheus 3 accepts, mixed in one document with a legacy underscore-named family. The fixture for parsers that still assume every name matches [a-zA-Z_][a-zA-Z0-9_]*.

The CRI log format Kubernetes nodes actually write: an RFC 3339 nanosecond timestamp, a stream name, and an F or P tag marking whether the line is full or a partial continuation. One long message is split across several P lines that must be rejoined before parsing.

Five journal entries in systemd's export format — KEY=value lines separated by blank lines, with the double-underscore address fields, a syslog PRIORITY number rather than a level name, and microsecond timestamps. A parser must map priority 3 to error and 6 to info itself.

Five RFC 5424 syslog messages with the version digit, a full RFC 3339 timestamp and two structured-data elements per line — including one carrying the trace ID from this category's trace fixtures. The modern syslog most parsers still handle as if it were RFC 3164.

Four alerting rules over two groups, using the YAML features that break naive config readers: block scalars for multi-line PromQL, folded scalars for descriptions, Go template annotations with pipes, and keep_firing_for. Every expression references metrics that exist in this category's fixtures.

Five recording rules following the level:metric:operation naming convention, where one rule consumes two others recorded earlier in the same group — evaluation order inside a group is sequential, which is exactly what makes that legal and what a rule validator must understand.

Three scrape jobs with the parts that actually matter: relabel_configs rewriting a target label with a capture group, metric_relabel_configs dropping the two unbounded labels from the cardinality fixture, honor_timestamps for the textfile collector and a federation job with a match[] selector.

An Alertmanager configuration with the routing behaviour that is hard to reason about without a fixture: a continue: true branch so a critical alert reaches two receivers, an inhibition rule suppressing warnings under a matching critical, and a weekend mute window.

A Collector configuration wiring traces, metrics and logs through separate pipelines, with named component instances, a filelog receiver that parses the CRI log fixture, OTTL statements performing the semantic-convention migration from the paired trace fixtures, and a redaction processor.

Six tail-sampling policies including an inverted regex match that drops health checks and a composite policy with its own rate limit and ordered sub-policies. Policies are OR-ed and one match keeps the entire trace, which is the semantic most people get backwards.

A Fluent Bit configuration in its INI-like section format: a tail input using the CRI multiline parser that reassembles the partial-line fixture, Kubernetes enrichment, a modify filter dropping two of the high-cardinality fields, and a throttle. Keys are space-aligned, not delimited.

A log-processing topology in TOML where components declare their inputs rather than an explicit graph, including a dropped-event route consumed as parse_json.dropped. The transform bodies are triple-quoted multi-line strings holding a different language, which is what breaks TOML tooling here.

Two SLOs — availability and latency — in one multi-document YAML separated by ---, each defined as a ratio of good events to total over a rolling 28-day window. The latency SLO measures the le="1" bucket against the count, which is the correct way to do it from a histogram.

The same SPDX 2.3 SBOM in the specification's plain-text tag-value form — the serialisation many licence-compliance tools still read first, and the exact twin of the JSON document in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

An SPDX 2.3 tag-value document with only the mandatory document header and a single fictional package — no relationships, no files — for testing that a parser accepts a document with every optional block absent. Every package, version, hash and licence is fictional — the tree describes nothing real.

An SPDX 2.3 tag-value SBOM that descends to file level: two fictional build outputs with SHA-1 and SHA-256 checksums, per-file licence findings, and CONTAINS relationships back to their package. Every package, version, hash and licence is fictional — the tree describes nothing real.

An SPDX tag-value SBOM emphasising its relationship block: one DESCRIBES edge and ten DEPENDS_ON edges that form the same two diamonds as the CycloneDX graph fixture. Every package, version, hash and licence is fictional — the tree describes nothing real.

An SPDX tag-value SBOM that declares a non-standard LicenseRef with its extracted text and uses it inside compound expressions — the case that breaks compliance tools which assume every licence is an SPDX id. Every package, version, hash and licence is fictional — the tree describes nothing real.

An intentionally corrupt SPDX tag-value document, cut off part-way through a tag name so the final line has no colon or value. Kept small on purpose. Every package, version, hash and licence is fictional — the tree describes nothing real.

The same fictional tree as an SPDX 2.2 tag-value document — the version still produced by older toolchains — for upgrade and compatibility tests against the 2.3 twin in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.

An SPDX tag-value SBOM whose document name is a fictional container image digest rather than an application version — the naming convention image scanners use, and the SPDX counterpart of the CycloneDX container fixture. Every package, version, hash and licence is fictional — the tree describes nothing real.

The SPDX 2.3 SBOM in its YAML serialisation — the third form the specification defines alongside JSON and tag-value, and the one most often hand-edited in a repository. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Yarn 1 lockfile in its own line-oriented grammar — quoted descriptor headers, two-space indented fields, resolved URLs with a SHA-1 fragment — which looks like YAML but is not. Every package, version, hash and licence is fictional — the tree describes nothing real.

A modern Yarn Berry lockfile: YAML-shaped with an __metadata header, npm: protocol resolutions and cache-key-prefixed checksums — deliberately different from the Classic file in the same family. Every package, version, hash and licence is fictional — the tree describes nothing real.

A pnpm v9 lockfile with its three-section layout — importers for declared specifiers, packages for resolution metadata and snapshots for the resolved edges — pinning the same fictional tree. Every package, version, hash and licence is fictional — the tree describes nothing real.

Bun's text lockfile, where each package is a positional array of descriptor, dependency map and integrity string rather than an object — a shape that breaks parsers assuming every lock entry is keyed. Every package, version, hash and licence is fictional — the tree describes nothing real.

A hash-pinned pip requirements file with two sha256 hashes per fictional package (wheel and sdist) and line continuations — the form `--require-hashes` installs demand. Every package, version, hash and licence is fictional — the tree describes nothing real.

A pip constraints file pinning the same nine fictional packages. Constraints bound a resolution without adding dependencies, so a tool that treats this like requirements.txt installs nine packages too many. Every package, version, hash and licence is fictional — the tree describes nothing real.

A pip-compile output where every pin carries a `# via` annotation naming the requirement that pulled it in — the only place the transitive graph survives in a pip workflow. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Pipenv lockfile in JSON, with the _meta hash that ties it to its Pipfile, a named index source and nine fictional pinned packages in the default section. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Poetry lockfile: TOML array-of-tables entries with per-artifact sha256 hashes, a [package.dependencies] table per package and the content-hash that binds the lock to pyproject.toml. Every package, version, hash and licence is fictional — the tree describes nothing real.

A uv lockfile in TOML, recording an sdist and a wheel per fictional package with inline tables carrying url, hash and byte size — a newer layout than poetry.lock and a useful contrast for parser tests. Every package, version, hash and licence is fictional — the tree describes nothing real.

A conda explicit lock: an @EXPLICIT marker followed by one fully-resolved URL per fictional package with an md5 fragment — no solver involved, which is exactly what makes it a lockfile. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Rust Cargo.lock in the version 4 format — TOML [[package]] tables with a registry source, a sha256-shaped checksum and a name-only dependencies array that resolves against the other tables. Every package, version, hash and licence is fictional — the tree describes nothing real.

The same fictional Rust tree pinned by a version 3 Cargo.lock, for testing that a reader keys on the declared version rather than assuming the newest format. Every package, version, hash and licence is fictional — the tree describes nothing real.

An intentionally corrupt Cargo.lock: a valid version 4 lockfile cut off inside a [[package]] table so the final key/value pair is incomplete. Small on purpose. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Go module manifest with separate direct and // indirect require blocks for the fictional tree. Served with a .txt extension because go.mod has no registered media type; the content is verbatim go.mod syntax. Every package, version, hash and licence is fictional — the tree describes nothing real.

go.sum content: two h1: lines per fictional module — one for the module zip and one for its go.mod — which is the pairing a verifier must require. Served as .txt because go.sum has no registered media type. Every package, version, hash and licence is fictional — the tree describes nothing real.

A PHP composer.lock in JSON, pinning each fictional package by both a git reference and a dist zip shasum, with a content-hash binding it to composer.json. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Bundler lockfile in its indentation-significant block format — specs nested under GEM, transitive requirements nested one level deeper, and the BUNDLED WITH version on its own indented line. Every package, version, hash and licence is fictional — the tree describes nothing real.

A CocoaPods lockfile: a YAML-subset document listing pods with their nested requirements, a SPEC CHECKSUMS block of SHA-1 values and the CocoaPods version that produced it. Every package, version, hash and licence is fictional — the tree describes nothing real.

An Elixir mix.lock: a literal Elixir map whose values are tuples of atoms, strings and lists. It is neither JSON nor TOML, so a generic lockfile reader has to special-case it. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Dart pubspec.lock in YAML, labelling each fictional package as direct main or transitive and recording a sha256 in its description block along with the SDK constraint. Every package, version, hash and licence is fictional — the tree describes nothing real.

A NuGet lockfile keyed by target framework, distinguishing Direct from Transitive entries and recording a base64 contentHash for each fictional package. Every package, version, hash and licence is fictional — the tree describes nothing real.

A Gradle dependency lockfile: one `group:artifact:version=configurations` line per fictional module plus the `empty=` line that records configurations resolving to nothing. Every package, version, hash and licence is fictional — the tree describes nothing real.

A suppression policy that gives every waiver an owner, a reason and an expiry date — the fields that stop a suppression file becoming a permanent blindfold. All four entries are SAMPLE. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

The oldest supply-chain artifact there is: a sha256sum manifest with the exact two-space separator the tool emits, listing a fictional release tarball and its nine dependency archives. Every package, version, hash and licence is fictional — the tree describes nothing real.

An ASCII-armored detached signature block of the shape that accompanies a SHA256SUMS file. It is a SAMPLE placeholder, not a valid OpenPGP signature — armor detectors will find it, verifiers must reject it. Signatures, key ids and certificates here are SAMPLE placeholders — the base64 decodes to the words 'SAMPLE SIGNATURE', so verification must fail. Nothing here is cryptographically valid and no key material is real.

The policy an admission controller evaluates before an artifact is allowed through: required predicate types, an allowed-builder list, a minimum SLSA level, a transparency-log requirement and one dated exception. Every package, version, hash and licence is fictional — the tree describes nothing real.

A GitHub Actions CI workflow with a two-axis build matrix (three Node versions across two runners), an npm cache, and a conditional artifact upload. Six matrix combinations, so a workflow linter or matrix expander has a documented answer to check against.

The called half of a reusable-workflow pair: a workflow_call trigger with typed inputs, a default value, and a declared output wired to a job output. Pair it with the caller fixture to test cross-workflow input and output resolution.

The calling half of a reusable-workflow pair: a workflow_dispatch trigger with a choice input, two jobs that call the same reusable workflow with different arguments, and a third that consumes their outputs through needs.

An action.yml-shaped composite action definition with typed inputs, a declared output bound to a step output, and a branding block. Distinct from a workflow file, and a common blind spot in workflow linters that only understand .github/workflows.

The workflow file that exposes the YAML 1.1 boolean resolver: a bare `on` key becomes True in PyYAML, SnakeYAML and Psych, so a round-trip through those loaders loses the trigger block. The env values repeat the trap with NO, yes and off alongside a quoted control.

A deprecated-syntax workflow: ::set-output, ::set-env and ::add-path markers, a retired runner label, and v2 action pins. Every construct here was removed from the runner, so an upgrade migrator can be scored on whether it rewrites all of them.

A schema-valid workflow that should still be rejected on review: permissions: write-all at the workflow level plus three unused write scopes on the job. Nothing here is an exploit; it is the least-privilege finding a policy engine is supposed to raise.

A deployment workflow exercising the blocks that governance tools care about: a concurrency group with cancel-in-progress, paths-ignore filters, a named environment with a URL, and a job timeout. All hosts are example.invalid.

An expression-dense workflow: fromJSON-generated matrix axes, hashFiles cache keys, format and join calls, a folded multi-line if condition, and the && / || coalescing idiom that stands in for a ternary. For testing template resolvers before any schema check.

The matrix case that expanders get wrong: a 3x3 base grid, two exclude rules, and one include entry that adds a combination and an extra key. Nine minus two plus one is eight jobs, documented in the specs so an expansion can be scored exactly.

A scheduled workflow with two cron entries plus a manual workflow_dispatch trigger carrying a boolean and a choice input. For testing cron parsers, trigger extraction, and input-type handling in workflow tooling.

An intentionally invalid GitHub Actions workflow: well-formed YAML that breaks the workflow schema in four documented ways — no jobs mapping, a scalar `on`, a mapping `runs-on`, and a step carrying both uses and run. For testing that a validator rejects, and reports why.

A three-stage GitLab CI pipeline with a default block, global variables, artifact expiry, a needs-based DAG, and a coverage-extraction regex. The baseline the other GitLab fixtures vary from.

The two GitLab inheritance mechanisms in one file: YAML anchors with merge keys, which the loader resolves before GitLab sees the document, and `extends`, which GitLab resolves afterwards with a deep merge. Hidden .job keys carry both.

GitLab's `!reference` custom YAML tag used three ways: inside a script list, as a whole after_script value, and as a whole rules value. A stock YAML 1.2 loader has no constructor for it and raises; GitLab's loader resolves each key path.

Rule-driven GitLab CI: a workflow block with four ordered conditions ending in `when: never`, plus job rules combining changes patterns, regex tag matching, a null-branch comparison, and a manual allow-failure fallback.

Five include entries across the four include kinds — local path, local glob, another project at a pinned ref, a remote URL, and a bundled template. For testing include resolvers and dependency graphing without any file actually being fetched.

Both GitLab parallelisation forms in one file: a plain `parallel: 4` shard split and a `parallel: matrix` block whose two entries expand to seven combinations. Eleven jobs in total, documented so an expander can be checked exactly.

A deprecated-syntax GitLab CI file using `only`/`except` in both the array and keyed forms, plus the long-retired `type:` keyword. For scoring a migrator that must rewrite all of it to `rules` and `stage`.

Dynamic child pipelines and a cross-project downstream trigger: one job generates a pipeline file as an artifact and a trigger job includes it, while a second trigger job starts a downstream project's pipeline with strategy: depend.

An intentionally invalid GitLab CI config: valid YAML with a misspelled `stagess` key, a job naming an undeclared stage, a job with no script, and an `only:` given a bare scalar. For testing that a linter rejects it and names each fault.

A CircleCI 2.1 config with a two-job workflow, a fallback cache-key list, workspace persistence between jobs, and a test-results store. The baseline the other CircleCI fixtures vary from.

CircleCI orbs and reusable named executors: two orb imports, two executors at different resource classes, an orb-provided step, and a branch filter combining an exact name with a regex.

A reusable CircleCI command with string and boolean parameters, a conditional `when` step, and a job parameterised by an enum expanded through a workflow matrix. Exercises CircleCI's << >> template syntax, which is not YAML and not Jinja.

A CircleCI workflow matrix across three operating systems and two Go versions with one exclusion, plus a tag filter regex. Six combinations minus one is five jobs, documented so an expansion can be scored exactly.

An intentionally invalid CircleCI config: an unquoted `version: 2.10` that YAML loads as the float 2.1, a workflow referencing an undefined job, and a job with no execution environment. For testing that a validator rejects it and explains each fault.

The simplest Azure Pipelines shape: no stages or jobs, just a trigger with branch and path filters, a PR trigger, variables, and a flat step list mixing task and script steps. Baseline for the stage-based fixtures.

A three-stage Azure Pipelines definition with a build-number format expression, a variable group reference, stage conditions built from the expression functions, and a deployment job using the runOnce strategy against a named environment.

Compile-time template expressions: an `${{ each }}` loop over an object parameter, an `${{ if }}` conditional insertion, an `extends` template, and a step template with arguments. These resolve before runtime, which template-aware linters must model.

Azure's named-leg matrix form, where each leg is a mapping of variables rather than an axis product: three Python legs, a maxParallel cap, a job timeout, and a JUnit results publish step that runs on failure too.

An intentionally invalid Azure Pipelines file: valid YAML that mixes top-level steps with a stages block, depends on an undeclared stage, and gives `pool` a bare string. For testing that a validator rejects it and reports all three faults.

A declarative Jenkinsfile with a docker agent, options, environment and parameters blocks, a parallel test stage gated by a when expression, and post conditions. The dialect most Jenkins linters target.

The scripted Jenkinsfile dialect: an imperative node block with Groovy variables, a for loop that builds a parallel branch map at runtime, and try/catch error collection. Structurally unlike the declarative form, and a common parser gap.

A declarative Jenkins matrix over two axes with a nested excludes block: six platform/arch combinations minus the windows arm64 pair leaves five cells, documented in the specs so an expansion can be scored exactly.

A Jenkinsfile importing a pinned shared library and calling three custom steps that no static parser can resolve locally. For testing how tooling reports unknown steps and whether it records the library dependency and its version pin.

An intentionally invalid Jenkinsfile: an unclosed stage block so braces never balance, a steps block outside any stage, and a bare identifier where the agent directive needs any, none, or a block. For testing parser error recovery and reporting.

Three Kubernetes objects in one YAML stream, the shape kubectl apply consumes. A loader that calls the single-document API returns only the first object and silently drops the other two, which is exactly the failure this fixture is for.

A StatefulSet with volumeClaimTemplates, an ordered pod-management policy, a partitioned rolling update, and a non-root pod security context. For testing manifest linters and admission policies that reason about storage and identity.

A CronJob with an explicit timeZone, Forbid concurrency, a starting deadline, and history limits on both success and failure. For testing cron parsing and the scheduling fields policy engines most often check.

An autoscaling/v2 HPA with both a Resource and a Pods metric, plus scaleUp and scaleDown behaviour policies. The v2 metric shape differs sharply from v1 and v2beta, which is what makes it a useful conversion fixture.

A NetworkPolicy with both policy types: an ingress rule combining namespace and pod selectors, and two egress rules, one of which uses an ipBlock with an except range. For testing policy engines that reason about allowed traffic.

A three-document governance bundle. Its real edge case is quantity handling: values like "8", 16Gi and 250m are Kubernetes quantity strings, and a parser that coerces the quoted ones to numbers or normalises the suffixed ones changes their meaning.

A Kustomize overlay with a name prefix and suffix, common labels, an image tag override, a configMapGenerator merge, and a JSON-6902 patch embedded as a block scalar — YAML inside YAML, which naive rewriters mangle.

An intentionally invalid Kubernetes manifest: a removed apiVersion, a quoted string where replicas needs an integer, a selector that does not match the pod template, and containers as a mapping instead of a list. Four documented faults for a validator to report.

A Helm v2 Chart.yaml with two conditional subchart dependencies, semver range constraints, a kubeVersion constraint, maintainers and annotations. Every repository and URL is example.invalid, so nothing resolves anywhere real.

The defaults half of a Helm values pair: nested maps, an empty map and an empty list, a list of env entries, and quoted booleans that must survive as strings. Pairs with the production overrides fixture for deep-merge testing.

The overrides half of a Helm values pair, built to exercise all three merge behaviours at once: maps merge key by key, the env list replaces the defaults wholesale, and an explicit null deletes the inherited podAnnotations map.

An Argo CD Application with automated sync, prune and self-heal, retry backoff, sync options, and an ignoreDifferences rule that exempts replica counts from drift detection. All Git and cluster endpoints are example.invalid.

An Argo CronWorkflow wrapping an inline workflowSpec: a cron schedule with an explicit timezone, Replace concurrency, history limits, and a suspend flag. Nested-spec shape that flat schedule extractors miss.

A Tekton Task declaring string and array params, a workspace, a result, and two steps that use Tekton's $(params.x) and $(workspaces.x.path) variable syntax, including the $(params.flags[*]) array expansion form.

A Tekton Pipeline chaining three tasks with runAfter, a when expression that consumes a prior task's result, and a finally task that runs regardless of outcome. The finally block is a common omission in Tekton graph extractors.

A Tekton PipelineRun as a run request: a pipelineRef, params, timeouts and a workspace binding, with no status block. A completed run's status is a record of what happened and belongs with test-report fixtures, not with pipeline definitions.

The shared topology plus one back edge, making it intentionally invalid as a DAG. The document publishes the cycle it contains, so a scheduler or graph validator can be tested on both detecting the cycle and naming it.

A CWL v1.2 CommandLineTool with typed inputs, positional and prefixed bindings, a JavaScript outputEval expression, resource requirements, a Docker hint, and an IANA $namespaces block. Inert: it describes an invocation and runs nothing.

An intentionally invalid CWL document: a nonexistent cwlVersion, an unknown class, a step consuming an output no step produces, and outputs given as a bare string. Four documented faults for a CWL validator to report.

The terraform settings block: a version constraint range, two pinned providers, a local backend, default tags, and a second aliased provider configuration. The fictional examplecloud provider means nothing resolves to a real service.

Seven Terraform variables covering string, number, map and a map(object) with an optional attribute and a default, plus two validation blocks with error messages. The sensitive variable's default is explicitly a SAMPLE note, not a credential.

The resource graph: a network, a for_each subnet set, a counted instance resource, a data source, and a bucket on an aliased provider. Both repetition meta-arguments appear, plus lifecycle and an explicit depends_on edge.

The expression-heavy half of the stack: for expressions producing both a map and a filtered list, conditional expressions selecting whole objects, and a dynamic block that generates two firewall rules from a local list.

Three module calls covering the shapes a dependency grapher has to handle: a local path with explicit provider passing, a versioned registry source under for_each, and a count-gated conditional module.

Five Terraform outputs exercising a splat expression over a counted resource, a for expression over a for_each module, and a sensitive output that must stay redacted when propagated from a sensitive input.

A terraform.tfvars assigning the staging defaults, including a nested map-of-objects value. Pairs with the production overrides file, which replaces that map wholesale rather than merging into it.

The production tfvars overrides. Its point is a semantic that surprises people: a complex-typed variable is replaced whole, not deep-merged, so the staging app-b subnet does not survive the override.

An intentionally invalid Terraform configuration: an unclosed resource block, a colon where HCL needs an equals sign, a reference to an undeclared resource, and a resource block missing its second label. Four documented faults for a parser to report.

A generic HCL2 image-build definition exercising the grammar rather than any vendor schema: labelled blocks, a list variable, locals, an indent-stripping heredoc with an interpolation inside it, and a for expression producing a list.

A deeply nested HCL2 job definition — job, group, task, service, check — with duration strings, a port mapping, and restart and update policies. Four levels of block nesting, which is where hand-rolled HCL readers usually break.

A generic HCL2 policy document with three severity-graded rules, condition blocks using all_of / none_of / one_of, and a dated exemption. Grants nothing to anything; it exists so policy tooling has a realistic document to read.

An intentionally invalid HCL2 document: an unclosed block, a colon assignment, a half-quoted block label, and a heredoc whose terminator is misspelled so it swallows the remainder of the file. Four documented faults, each a distinct recovery test.

A Compose Specification file with no top-level version key, condition-based depends_on, healthchecks, and a deploy resource limit. Parsers written against the older schema often require the version key, which is exactly what this fixture separates.

Compose with three x- extension fields carrying YAML anchors that are merged into services. The trap is ordering: a tool that strips x- keys before parsing the YAML destroys the anchors and the file stops resolving.

Five Compose services across three profiles, one of which belongs to two profiles at once. Services with no profiles key always start; the rest are opt-in, which is the selection logic this fixture exists to test.

An intentionally invalid Compose file: services as a list, a service with both image and an empty build, an unquoted 8080:8080 port that YAML 1.1 reads as a base-60 integer, and a depends_on naming an undefined service.

A three-stage Dockerfile with a syntax directive, build args interpolated into FROM lines, a heredoc COPY, multi-line LABEL and ENV continuations, a non-root USER, and HEALTHCHECK in exec form. Inert: every base image is a fictional example.invalid reference.

A Makefile whose recipe lines are indented with real TAB characters, as make requires. Covers simple, conditional, appended and substitution-reference variables, .PHONY, and .DEFAULT_GOAL. Every recipe is echo-only, so running it does nothing.

Pattern rules with the automatic variables $@, $<, $^ and $*, ifeq/ifdef conditional directives, a vpath search path, and a define block invoked through $(call). All recipe lines are TAB-indented and echo-only.

An intentionally invalid Makefile whose recipe lines are indented with four spaces instead of the required TAB. This is the most common Makefile defect there is, and it is invisible in most editors — which is exactly why it belongs in a fixture set.

A Gradle Groovy DSL build script with a plugins block, a Java toolchain, five dependency configurations, task configuration via named() and a registered task. Every coordinate and repository is fictional, so nothing resolves.

A Gradle settings script — the file that actually defines a multi-project build — with pluginManagement, a repositories mode, a version catalog declaring libraries, a bundle and a plugin, and one project remapped to a custom directory.

A gradle.properties exercising the .properties grammar rather than Gradle: a \uXXXX escape, a backslash line continuation, all three key/value separator forms, and a key containing escaped separator characters.

The .properties edge cases collected in one file: both comment markers, empty values, a value whose trailing spaces are significant, unescaped = and : inside values, a # that is not a comment, escape sequences, an escaped space in a key, and a duplicate key.

A build-tool configuration in TOML, chosen for the constructs YAML has no direct equivalent for: three [[build.step]] array-of-tables entries carrying an ordered pipeline, a quoted glob key, and all three TOML date-time flavours.

Anchors and aliases across mapping, sequence and scalar nodes, including an anchor nested inside another anchored node. The point most tooling misses: an alias is a reference to the same node, so a shallow-loading parser can share mutable state between jobs.

Merge keys with their full precedence rules: local keys beat merged ones, and in a merge sequence the earlier alias wins. The file publishes the expected merged values, and a strict YAML 1.2 loader produces none of them because 1.2 dropped << from the core schema.

Every block-scalar variation in one file: literal and folded styles, all three chomping indicators, an explicit indentation indicator, a folded block with a paragraph break, and an embedded shell-shaped script whose own indentation must survive.

The Norway problem in full: eleven bare words that a YAML 1.1 resolver turns into booleans, a matching quoted control group that survives, and a country-code list where position two silently becomes false. The definitive fixture for resolver-version behaviour.

Twenty-two unquoted values whose type depends entirely on the resolver. The worst is the leading zero: 0755 is 493 under YAML 1.1 and 755 under YAML 1.2, so both resolvers return a number and they return different ones. Also covers base-60 times, a version that loses its trailing zero, an integer past IEEE-754 precision, dates, and .inf / .nan.

Duplicate keys at three nesting levels, including a duplicated top-level sequence. The spec forbids them; most loaders keep the last silently, a few keep the first, and strict linters reject the document. The file publishes the last-wins answer.

An intentionally invalid YAML file indented with real TAB characters, which the spec forbids for indentation. The final key shows the legal case — a tab inside a quoted scalar — so a parser can be checked for rejecting one without rejecting the other.

A five-document stream with explicit end markers, a comment-only document that loads as null, and a bare sequence as a whole document. The single-document API returns only the first, which is how multi-object manifests silently lose objects.

Five spellings of null against the things routinely confused with it: empty strings, empty collections, and a key written with no value at all. Includes a sequence containing a hole, an empty string and two nulls in a row.

All three scalar quoting styles side by side: plain scalars and what they cannot contain, single quotes where backslashes stay literal and '' means one quote, and double quotes as the only style that processes \t, \n and \uXXXX escapes.

Flow (JSON-like) and block collections expressing the same structures, nested inside one another in both directions, plus a flow mapping wrapped across lines and a line of strict JSON — which is valid YAML, and a useful check on a parser's JSON-subset claim.

The indentation styles that all parse identically and that formatters fight over: sequences flush with their key versus indented under it, two-space against four-space maps, and deliberately irregular but legal nesting. For testing formatters and idempotency.

Non-ASCII keys and values across Latin, Cyrillic, Arabic, CJK and emoji, plus a key containing a zero-width space and a value distinguishing a combining acute from the precomposed character. Written as UTF-8 with no BOM.

A YAML file written with CRLF line endings, which the spec accepts as a line break. A parser that splits on \n alone leaves a stray carriage return at the end of every plain scalar, so "build" becomes "build\r" and equality checks quietly fail.

A YAML file beginning with a UTF-8 byte order mark, which the spec permits at the start of a stream. A parser that does not strip it reads the first key as \ufeffname, so the lookup misses and the document appears to be missing its name field.

Nested anchor reuse kept deliberately small: two anchors, six references, thirty-one expanded nodes. It is here to test alias resolution and expansion accounting on a safe input, and is explicitly not a billion-laughs expansion bomb.

Explicit tags across the standard set — !!str, !!float, !!int, !!bool, !!null, !!binary, !!timestamp, !!omap, !!set — alongside two application-local ! tags. CI dialects use local tags in the wild, so a pipeline parser has to decide whether to reject, ignore, or resolve them.

A two-document stream where each document declares its own %YAML directive and the second adds a %TAG handle used by a local tag. Comments appear in every position they are legal, and every one of them is lost by a non-round-tripping loader.

An intentionally invalid YAML file whose flow sequence is opened and never closed, so the parser consumes the rest of the document and fails at end of stream. A good error message names the opening bracket, not the last line, which is what this fixture measures.
We use Google Analytics and show ads via Adsterra. Non-essential cookies and ad scripts run only after you allow the matching categories. See our cookie policy.