docs: EDU-1522 Add manifest diagram

platform-cloud/docs/launch/launchpad.md

@@ -186,6 +186,39 @@ Workspace maintainers can edit existing pipeline details. Select the options men
 
 Select **Update** to save the updated pipeline.
 
+## Pipeline diagram
+
+A pipeline's details page displays a **Pipeline diagram** card below the pipeline details when the pipeline declares a `manifest.diagram` value in its `nextflow.config` file. Use it to show an overview of the workflow.
+
+Set `manifest.diagram` to a path relative to the repository root, or to a URL:
+
+```groovy
+manifest {
+    diagram = 'docs/images/workflow.svg'
+}
+```
+
+Platform reads the diagram from the pipeline repository at the revision you are viewing, rather than storing a copy with the pipeline. The diagram follows the repository as you change revisions. Platform caches each diagram for a few minutes, so a change in the repository can take that long to appear.
+
+Diagrams can be SVG, PNG, JPEG, GIF, or WebP files. Platform determines the format from the file extension. A file referenced by a relative path must have a matching extension. For an absolute URL without one, Platform uses the content type returned by the server.
+
+:::tip
+You can generate attractive pipeline diagrams using our open-source [nf-metro](https://seqeralabs.github.io/nf-metro/latest/) tool.
+:::
+
+For a relative path, Platform fetches the file with your stored [Git credentials][credentials]. Diagrams in private repositories work the same as diagrams in public ones. Platform fetches absolute URLs without credentials, and those URLs must use `https`.
+
+When Platform cannot retrieve the diagram, it omits the **Pipeline diagram** card instead of showing an error. This happens when:
+
+- The file is missing, or the URL is unreachable.
+- The file is larger than 1 MB.
+- The file is not one of the supported image formats.
+- A relative path contains `..`, or any character other than a letter, a number, or `. _ / + ~ @ , -`. Spaces and parentheses are rejected.
+
+:::note
+`manifest.diagram` is a new config option released in Nextflow version 26.10. However, the option is safe to use with earlier versions. Nextflow ignores unrecognized `manifest` keys, and its strict config validator warns rather than fails. You can add `diagram` to your pipeline manifest now, without affecting runs.
+:::
+
 ## URL query parameters
 
 The launch form can populate fields with values passed as URL query parameters. For example, append `?revision=master` to your launch URL to prefill the **Revision** field with `master`. Platform administrators can use custom launch URLs to hard-code required run and pipeline parameters for every run.

platform-enterprise_docs/enterprise/configuration/configtables/features_env.yml

@@ -36,6 +36,15 @@
     Enable [pipeline versioning](https://docs.seqera.io/platform-enterprise/pipelines/versioning) in the workspaces specified. Accepts a comma-separated list of workspace IDs.
   Value:                'Default: Disabled for all workspaces'
 -
+  Environment variable:            '`TOWER_PIPELINE_DIAGRAM_MAX_FILE_SIZE`'
+  Description: >
+    Maximum size of the [pipeline diagram](https://docs.seqera.io/platform-enterprise/launch/launchpad#pipeline-diagram) (`manifest.diagram`) rendered on a pipeline's details page. Larger files are skipped and no diagram is displayed.
+  Value:                'Default: `1MB`'
+-
+  Environment variable:            '`TOWER_PIPELINE_DIAGRAM_ALLOW_HTTP`'
+  Description: >
+    Allow an absolute [pipeline diagram](https://docs.seqera.io/platform-enterprise/launch/launchpad#pipeline-diagram) URL to be fetched over cleartext `http`. When `false`, absolute URLs must use `https`. This relaxes the scheme requirement only — absolute URLs that resolve to a private, loopback, or link-local address are always blocked. Diagrams referenced by a relative repository path are unaffected.
+  Value:                'Default: `false`'
   Environment variable:            '`TOWER_RUN_TIMELINE_ALLOWED_WORKSPACES`'
   Description: >
     Control which workspaces show the [execution timeline](https://docs.seqera.io/platform-enterprise/monitoring/run-details#execution-timeline) on the run details **Tasks** tab. Omit or set empty (`TOWER_RUN_TIMELINE_ALLOWED_WORKSPACES=`) to enable the timeline in all workspaces, including personal workspaces. To enable it only in specific workspaces, provide a comma-separated list of workspace IDs. Personal workspaces cannot be added to the list. Workspaces without the timeline show the **Processes** panel with per-process progress bars instead. To disable the timeline in all workspaces, set a value that matches no workspace ID, such as `0`.

platform-enterprise_docs/launch/launchpad.md

@@ -181,6 +181,41 @@ Select **Update** when you are ready to save the updated pipeline.
 Pipeline names must be unique per workspace.
 :::
 
+## Pipeline diagram
+
+A pipeline's details page displays a **Pipeline diagram** card below the pipeline details when the pipeline declares a `manifest.diagram` value in its `nextflow.config` file. Use it to show an overview of the workflow.
+
+Set `manifest.diagram` to a path relative to the repository root, or to a URL:
+
+```groovy
+manifest {
+    diagram = 'docs/images/workflow.svg'
+}
+```
+
+Platform reads the diagram from the pipeline repository at the revision you are viewing, rather than storing a copy with the pipeline. The diagram follows the repository as you change revisions. Platform caches each diagram for a few minutes, so a change in the repository can take that long to appear.
+
+Diagrams can be SVG, PNG, JPEG, GIF, or WebP files. Platform determines the format from the file extension. A file referenced by a relative path must have a matching extension. For an absolute URL without one, Platform uses the content type returned by the server.
+
+:::tip
+You can generate attractive pipeline diagrams using our open-source [nf-metro](https://seqeralabs.github.io/nf-metro/latest/) tool.
+:::
+
+For a relative path, Platform fetches the file with your stored [Git credentials][credentials]. Diagrams in private repositories work the same as diagrams in public ones. Platform fetches absolute URLs without credentials, and those URLs must use `https`. Platform blocks absolute URLs that resolve to a private, loopback, or link-local address. To display a diagram hosted inside your network, commit it to the pipeline repository and reference it by a relative path.
+
+When Platform cannot retrieve the diagram, it omits the **Pipeline diagram** card instead of showing an error. This happens when:
+
+- The file is missing, or the URL is unreachable.
+- The file is larger than the size set by `TOWER_PIPELINE_DIAGRAM_MAX_FILE_SIZE` (1 MB by default).
+- The file is not one of the supported image formats.
+- A relative path contains `..`, or any character other than a letter, a number, or `. _ / + ~ @ , -`. Spaces and parentheses are rejected.
+
+:::note
+`manifest.diagram` is a new config option released in Nextflow version 26.10. However, the option is safe to use with earlier versions. Nextflow ignores unrecognized `manifest` keys, and its strict config validator warns rather than fails. You can add `diagram` to your pipeline manifest now, without affecting runs.
+:::
+
+Administrators can change the size limit with `TOWER_PIPELINE_DIAGRAM_MAX_FILE_SIZE` and allow cleartext `http` URLs with `TOWER_PIPELINE_DIAGRAM_ALLOW_HTTP`. `TOWER_PIPELINE_DIAGRAM_ALLOW_HTTP` relaxes the scheme requirement only. The block on private, loopback, and link-local addresses always applies. See [Core features](../enterprise/configuration/overview#core-features).
+
 ## Populate launch form with URL query parameters
 
 The launch form can populate fields with values passed as URL query parameters. For example, append `?revision=master` to your launch URL to prefill the **Revision** field with `master`. This feature is useful for Platform administrators to provide custom pipeline launch URLs to users in order to hard-code required run and pipeline parameters for every run.

platform-enterprise_versioned_docs/version-26.2/enterprise/configuration/configtables/features_env.yml

@@ -35,6 +35,16 @@
   Description: >
     Enable [pipeline versioning](https://docs.seqera.io/platform-enterprise/pipelines/versioning) in the workspaces specified. Accepts a comma-separated list of workspace IDs.
   Value:                'Default: Disabled for all workspaces'
+-
+  Environment variable:            '`TOWER_PIPELINE_DIAGRAM_MAX_FILE_SIZE`'
+  Description: >
+    Maximum size of the [pipeline diagram](https://docs.seqera.io/platform-enterprise/launch/launchpad#pipeline-diagram) (`manifest.diagram`) rendered on a pipeline's details page. Larger files are skipped and no diagram is displayed.
+  Value:                'Default: `1MB`'
+-
+  Environment variable:            '`TOWER_PIPELINE_DIAGRAM_ALLOW_HTTP`'
+  Description: >
+    Allow an absolute [pipeline diagram](https://docs.seqera.io/platform-enterprise/launch/launchpad#pipeline-diagram) URL to be fetched over cleartext `http`. When `false`, absolute URLs must use `https`. This relaxes the scheme requirement only — absolute URLs that resolve to a private, loopback, or link-local address are always blocked. Diagrams referenced by a relative repository path are unaffected.
+  Value:                'Default: `false`'
 -
   Environment variable:            '`TOWER_RUN_TIMELINE_ALLOWED_WORKSPACES`'
   Description: >

platform-enterprise_versioned_docs/version-26.2/launch/launchpad.md

@@ -181,6 +181,41 @@ Select **Update** when you are ready to save the updated pipeline.
 Pipeline names must be unique per workspace.
 :::
 
+## Pipeline diagram
+
+A pipeline's details page displays a **Pipeline diagram** card below the pipeline details when the pipeline declares a `manifest.diagram` value in its `nextflow.config` file. Use it to show an overview of the workflow.
+
+Set `manifest.diagram` to a path relative to the repository root, or to a URL:
+
+```groovy
+manifest {
+    diagram = 'docs/images/workflow.svg'
+}
+```
+
+Platform reads the diagram from the pipeline repository at the revision you are viewing, rather than storing a copy with the pipeline. The diagram follows the repository as you change revisions. Platform caches each diagram for a few minutes, so a change in the repository can take that long to appear.
+
+Diagrams can be SVG, PNG, JPEG, GIF, or WebP files. Platform determines the format from the file extension. A file referenced by a relative path must have a matching extension. For an absolute URL without one, Platform uses the content type returned by the server.
+
+:::tip
+You can generate attractive pipeline diagrams using our open-source [nf-metro](https://seqeralabs.github.io/nf-metro/latest/) tool.
+:::
+
+For a relative path, Platform fetches the file with your stored [Git credentials][credentials]. Diagrams in private repositories work the same as diagrams in public ones. Platform fetches absolute URLs without credentials, and those URLs must use `https`. Platform blocks absolute URLs that resolve to a private, loopback, or link-local address. To display a diagram hosted inside your network, commit it to the pipeline repository and reference it by a relative path.
+
+When Platform cannot retrieve the diagram, it omits the **Pipeline diagram** card instead of showing an error. This happens when:
+
+- The file is missing, or the URL is unreachable.
+- The file is larger than the size set by `TOWER_PIPELINE_DIAGRAM_MAX_FILE_SIZE` (1 MB by default).
+- The file is not one of the supported image formats.
+- A relative path contains `..`, or any character other than a letter, a number, or `. _ / + ~ @ , -`. Spaces and parentheses are rejected.
+
+:::note
+`manifest.diagram` is a new config option released in Nextflow version 26.10. However, the option is safe to use with earlier versions. Nextflow ignores unrecognized `manifest` keys, and its strict config validator warns rather than fails. You can add `diagram` to your pipeline manifest now, without affecting runs.
+:::
+
+Administrators can change the size limit with `TOWER_PIPELINE_DIAGRAM_MAX_FILE_SIZE` and allow cleartext `http` URLs with `TOWER_PIPELINE_DIAGRAM_ALLOW_HTTP`. `TOWER_PIPELINE_DIAGRAM_ALLOW_HTTP` relaxes the scheme requirement only. The block on private, loopback, and link-local addresses always applies. See [Core features](../enterprise/configuration/overview#core-features).
+
 ## Populate launch form with URL query parameters
 
 The launch form can populate fields with values passed as URL query parameters. For example, append `?revision=master` to your launch URL to prefill the **Revision** field with `master`. This feature is useful for Platform administrators to provide custom pipeline launch URLs to users in order to hard-code required run and pipeline parameters for every run.