CLI · v2.0

Spanline

spanline

Run k6 from your laptop or CI. Results land in your workspace — with optional Kubernetes evidence via Kite.

Install for

Detecting platform…

Download

$ curl …

$ spanline auth login --token <api-token>

$ spanline auth workspace list

$ spanline auth workspace use <workspace-id>

$ spanline test run checkout.js --sync --name smoke

name: Performance
on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

jobs:
  k6:
    runs-on: ubuntu-latest
    env:
      SPANLINE_TOKEN: ${{ secrets.SPANLINE_TOKEN }}
      SPANLINE_WORKSPACE: ${{ secrets.SPANLINE_WORKSPACE }}
      # Enterprise self-host only (omit on Spanline Cloud):
      # SPANLINE_API: https://api.yourcompany.example
      # Optional — sealed connection tokens / env secrets (inline PEM):
      SPANLINE_ORG_RSA_PRIVATE_KEY: ${{ secrets.SPANLINE_ORG_RSA_PRIVATE_KEY }}
    steps:
      - uses: actions/checkout@v4

      - name: Install spanline
        run: |
          curl -fsSL \
            https://dl.spanline.dev/cli/2.0/spanline-linux-amd64 \
            -o /usr/local/bin/spanline
          chmod +x /usr/local/bin/spanline

      - name: Run scenario
        run: |
          spanline test run \
            --scenario-id ${{ vars.SPANLINE_SCENARIO_ID }} \
            --env staging \
            --name "ci-${{ github.run_number }}" \
            --ci \
            --upload-artifacts

Also works with GitLab CI, Jenkins, CircleCI — same binary and spanline test run --ci.

Install

Binary from dl.spanline.dev · SHA256SUMS

Login

auth login --token … from Account → API tokens · auth workspace use when you belong to more than one workspace

Run

test run — k6 + upload to your workspace

Encrypted secrets

Browser seals. Spanline stores ciphertext. CLI decrypts.

The organization keeps only the RSA public key on Spanline. The private key stays on your laptop or in CI — Spanline never holds it.

Register the public key

Organizations → Security → Toolchain. Download the private key once; the fingerprint confirms the keypair.
Browser seals secrets

Connection tokens and Environment secret values are sealed in the browser before the request is sent.
Spanline stores ciphertext only

After a public key is registered, plaintext secrets are rejected. Values are stored as sealed ciphertext (slseal1:).
CLI decrypts on your side

Load the private key with SPANLINE_ORG_RSA_PRIVATE_KEY (CI) or a local PEM file, then inject into Kite / k6 __ENV.

What Spanline stores

Public key PEM, fingerprint (sha256:…), sealed Connection tokens, and sealed Environment secret values.

What never reaches Spanline

The RSA private key, and usable plaintext of sealed tokens and secret environment variables.

CI uses the private key inline

Set SPANLINE_ORG_RSA_PRIVATE_KEY to the inline PEM. The workflow does not decrypt — spanline does.

Capabilities

What the CLI covers

Auth, run k6, stream live metrics, upload logs. Decrypt sealed Connection tokens and Environment secrets locally. With a Kite connection, attach Kubernetes Deployment and pod snapshots before and after the test.

Live metrics k6 progress and --out json stream while the run is in flight.
Abort from UI Respects abortRequested so you can stop CI from the workspace.
Environments Scenario env vars plus --env / KEY=VAL overrides. Encrypted secret values are decrypted on the CLI with the org RSA private key.
Encrypted secrets Org RSA — browser seals, API stores slseal1:, CLI decrypts. See flow.
Artifacts --upload-artifacts zips stdout, stderr, summary.json, and job.log.
Kubernetes via Kite Before/after Deployment and pod CPU/RAM via Kite — credentials from an encrypted connection token or env key, not kubeconfig.
Versions & matrix Pin --version-id; export collection matrix as JSON or CSV.
k6 auto-install Downloads a pinned k6 into cache unless --no-install-k6.
CI mode --ci for non-interactive runs — exit non-zero when thresholds fail.

Commands

Auth

spanline auth login --token …

Spanline Cloud default · CI: use SPANLINE_TOKEN (no login step)
spanline auth login --api https://api.example.com --token …

Enterprise self-host — your API origin · CI: SPANLINE_API · optional SPANLINE_APP_URL
spanline auth workspace list

List workspaces for the token · * = active
spanline auth workspace use <id>

Set default workspace · or SPANLINE_WORKSPACE / --workspace

One workspace? You can skip auth workspace use — the API picks your only workspace. Multiple workspaces? Set the active one first (or SPANLINE_WORKSPACE / --workspace); otherwise runs and --sync land in your oldest workspace, and --scenario-id from another workspace returns not found.

Test

spanline test run --scenario-id sc_… --env staging

Workspace scenario
spanline test run script.js --name smoke

Local k6 script · upload metrics/summary (not the .js)
spanline test run script.js --sync --name smoke --ci

Upsert scenario from git by --name, then run (local-first CI)
spanline test run --scenario-id sc_… --infra-ref ns/app

k6 + Kite before/after
spanline test collection-run --id cr_… --ci

Existing collection run · Kite if linked
spanline test collection-run --collection-id col_…

Create run from collection, then execute
spanline test watch --once --upload-artifacts

Webhook-handed jobs
spanline test matrix --id cr_… -o out.csv

Export matrix CSV/JSON