---
title: "runtime"
summary: "Project-wide environment files and the local environment-file assertions checked before the server is contacted."
status: shipped
generated: true
read_when:
  - "Wiring up environment files or SOPS-encrypted entries"
  - "Requiring keys to be present before a deploy is attempted"
---

This page is generated from the same Go declarations the loader enforces, so it
cannot drift from what `ob validate` accepts.

## Fields on this page

`env_checks` · `env_files` · `file` · `present` · `provider` · `require`

## Reference

| Field | Type | Default | What it does |
| --- | --- | --- | --- |
| `env_checks` | list | — | Local environment-file assertions checked before planning or deploying. |
| `env_checks[].file` | string | — | Repository-relative dotenv file whose declared keys are checked. Expects a path inside the repository, with no control character or shell metacharacter. |
| `env_checks[].present` | list | — | Environment keys that must be declared but may be empty. |
| `env_checks[].require` | list | — | Environment keys that must be declared with non-empty values. |
| `env_files` | list | — | Project-wide ordered environment-file list for application, worker, and job workloads. |
| `env_files[].file` `*` | string | — | Repository-relative environment file path. Expects a path inside the repository, with no control character or shell metacharacter. |
| `env_files[].provider` | `sops` | — | Decryptor used before staging the file. The supported encrypted provider is sops. |

`*` marks a field that is required within its own object.